- Create a change request
- Validate changes in the pre-production environment
- Rollback pre-production and production changes in case of failure
- Send approval requests
- View own requests
- Sign off and close own requests
(includes the App Manager and Group Head roles) |
- All of the Requester actions, plus:
- Approve requests
- All of the Requester and Approver actions, plus:
- Add employees to the portal
- Assign employee roles
- Approve registrations to the portal
- Configure portal settings (for example, determine the freeze schedule, determine the pre-production and production XML paths, and determine the attachment upload location)
- Use the standalone Enterprise Mode Site List Manager page
- View reports
+- **Tool-based management for website lists.** Use the Enterprise Mode Site List Manager to add website domains and domain paths and to specify whether a site renders using Enterprise Mode. Download the [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) or the [Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378), based on your operating system and schema. -- **Centralized control.** You can specify the websites or web apps to interpret using Enterprise Mode, through an XML file on a website or stored locally. Domains and paths within those domains can be treated differently, allowing granular control. Use Group Policy to let users turn Enterprise Mode on or off from the **Tools** menu and to decide whether the Enterprise browser profile appears on the **Emulation** tab of the F12 developer tools.
**Important**
All centrally-made decisions override any locally-made choices.
+- **Centralized control.** You can specify the websites or web apps to interpret using Enterprise Mode, through an XML file on a website or stored locally. Domains and paths within those domains can be treated differently, allowing granular control. Use Group Policy to let users turn Enterprise Mode on or off from the Tools menu and to decide whether the Enterprise browser profile appears on the Emulation tab of the F12 developer tools.
-- **Integrated browsing.** When Enterprise Mode is set up, users can browse the web normally, letting the browser change modes automatically to accommodate Enterprise Mode sites.
+ >[!Important]
+ >All centrally-made decisions override any locally-made choices.
-- **Data gathering.** You can configure Enterprise Mode to collect local override data, posting back to a named server. This lets you "crowd source" compatibility testing from key users; gathering their findings to add to your central site list.
+- **Integrated browsing.** When Enterprise Mode is set up, users can browse the web normally, letting the browser change modes automatically to accommodate Enterprise Mode sites.
-
+- **Data gathering.** You can configure Enterprise Mode to collect local override data, posting back to a named server. This lets you "crowd source" compatibility testing from key users; gathering their findings to add to your central site list.
-
+## Enterprise Mode and the Enterprise Mode Site List XML file
+The Enterprise Mode Site List is an XML document that specifies a list of sites, their compat mode, and their intended browser. Using [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853), you can automatically start a webpage using a specific browser. In the case of IE11, the webpage can also be launched in a specific compat mode, so it always renders correctly. Your employees can easily view this site list by typing _about:compat_ in either Microsoft Edge or IE11.
+Starting with Windows 10, version 1511 (also known as the Anniversary Update), you can also [restrict IE11 to only the legacy web apps that need it](https://blogs.windows.com/msedgedev/2016/05/19/edge14-ie11-better-together/), automatically sending sites not included in the Enterprise Mode Site List to Microsoft Edge.
+### Site list xml file
+This is a view of the [raw EMIE v2 schema.xml file](https://gist.github.com/kypflug/9e9961de771d2fcbd86b#file-emie-v2-schema-xml). There are equivalent Enterprise Mode Site List policies for both [Microsoft Edge](https://docs.microsoft.com/en-us/microsoft-edge/deploy/emie-to-improve-compatibility) and [Internet Explorer 11](turn-on-enterprise-mode-and-use-a-site-list.md). The Microsoft Edge list is used to determine which sites should open in IE11; while the IE11 list is used to determine the compat mode for a site, and which sites should open in Microsoft Edge. We recommend using one list for both browsers, where each policy points to the same XML file location.
+```xml
+
[Take tests in Windows 10](take-tests-in-windows-10.md)
Take a Test is a new app that lets you create the right environment for taking tests. Learn how to use and get it set up.
[Chromebook migration guide](chromebook-migration-guide.md)
Find out how you can migrate a Chromebook-based learning environment to a Windows 10-based learning environment.
[Set up Windows devices for education](set-up-windows-10.md)
Depending on your school's device management needs, you can use the Set up School PCs app or the Windows Configuration Designer tool to quickly set up student PCs.
[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)
Get step-by-step guidance to help you deploy Windows 10 in a school environment.
[Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md)
Get step-by-step guidance on how to deploy Windows 10 to PCs and devices across a school district.
Try it out: Windows 10 deployment (for education)
Learn how to upgrade devices running the Windows 7 operating system to Windows 10 Anniversary Update, and how to manage devices, apps, and users in Windows 10 Anniversary Update.
For the best experience, use this guide in tandem with the TechNet Virtual Lab: IT Pro Try-It-Out.
[Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](switch-to-pro-education.md)
If you have an education tenant and use Windows 10 Pro or Windows 10 S in your schools, find out how you can opt-in to a free switch to Windows 10 Pro Education.
[Switch Windows 10 Pro to Pro Education from Microsoft Store for Education](windows-10-pro-to-pro-edu-upgrade.md)
If you have an education tenant and use Windows 10 Pro in your schools now, find out how you can opt-in to a free switch to Windows 10 Pro Education.
+
+If there are any problems with the Windows 10 Pro Education license or the activation of the license, the **Activation** panel will display the appropriate error message or status. You can use this information to help you diagnose the licensing and activation process.
+
+### Troubleshoot the user experience
+
+In some instances, users may experience problems with the Windows 10 Pro Education switch. The most common problems that users may experience are as follows:
+
+- The existing operating system (Windows 10 Pro, version 1607 or higher, or Windows 10 S, version 1703) is not activated.
+- The Windows 10 Pro Education switch has lapsed or has been removed.
+
+Use the following figures to help you troubleshoot when users experience these common problems:
+
+**Figure 13** - Illustrates a device in a healthy state, where the existing operating system is activated, and the Windows 10 Pro Education switch is active.
+
+
+
+
+**Figure 14** - Illustrates a device on which the existing operating system is not activated, but the Windows 10 Pro Education switch is active.
+
+
+
+
+### Review requirements on devices
+
+Devices must be running Windows 10 Pro, version 1607 or higher, or Windows 10 S, version 1703 and be Azure AD joined, or domain joined with Azure AD Connect. Customers who are federated with Azure AD are also eligible. You can use the following procedures to review whether a particular device meets requirements.
+
+**To determine if a device is Azure AD joined**
+
+1. Open a command prompt and type the following:
+
+ ```
+ dsregcmd /status
+ ```
+
+2. Review the output under Device State. If the **AzureAdJoined** status is YES, the device is Azure Active Directory joined.
+
+**To determine the version of Windows 10**
+
+- At a command prompt, type:
+
+ ```
+ winver
+ ```
+
+ A popup window will display the Windows 10 version number and detailed OS build information.
+
+ > [!NOTE]
+ > If a device is running a previous version of Windows 10 Pro (for example, version 1511), it will not be switched to Windows 10 Pro Education when a user signs in, even if the user has been assigned a license.
+
+### Roll back Windows 10 Pro Education to Windows 10 Pro
+
+If your organization has the Windows 10 Pro to Windows 10 Pro Education switch enabled, and you decide to roll back to Windows 10 Pro or to cancel the switch, you can do this by:
+
+- Logging into Microsoft Store for Education page and turning off the automatic switch.
+- Selecting the link to turn off the automatic switch from the notification email sent to all global administrators.
+
+Once the automatic switch to Windows 10 Pro Education is turned off, the change is effective immediately. Devices that were switched will revert to Windows 10 Pro only after the license has been refreshed (every 30 days) and the next time the user signs in. This means that a user whose device was switched may not immediately see Windows 10 Pro Education rolled back to Windows 10 Pro for up to 30 days. However, users who haven't signed in during the time that a switch was enabled and then turned off will never see their device change from Windows 10 Pro.
+
+> [!NOTE]
+> Devices that were switched from Windows 10 S to Windows 10 Pro Education cannot roll back to Windows 10 S.
+
+**To roll back Windows 10 Pro Education to Windows 10 Pro**
+
+1. Log in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your school or work account, or follow the link from the notification email to turn off the automatic switch.
+2. Select **Manage > Benefits** and locate the section **Windows 10 Pro Education** and follow the link.
+3. In the **Revert to Windows 10 Pro** page, click **Revert to Windows 10 Pro**.
+
+ **Figure 15** - Revert to Windows 10 Pro
+
+ 
+
+4. You will be asked if you're sure that you want to turn off automatic switches to Windows 10 Pro Education. Click **Yes**.
+5. Click **Close** in the **Success** page.
+
+ All global admins get a confirmation email that a request was made to roll back your organization to Windows 10 Pro. If you, or another global admin, decide later that you want to turn on automatic switches again, you can do this by selecting **Switch to Windows 10 Pro Education for free** from the **Manage > Benefits** in the Microsoft Store for Education.
+
+
+## Preparing for deployment of Windows 10 Pro Education licenses
+
+If you have on-premises Active Directory Domain Services (AD DS) domains, users will use their domain-based credentials to sign in to the AD DS domain. Before you start deploying Windows 10 Pro Education to users, you need to synchronize the identities in the on-premises AD DS domain with Azure AD.
+
+You need to synchronize these identities so that users will have a *single identity* that they can use to access their on-premises apps and cloud services that use Azure AD (such as Windows 10 Pro Education). This means that users can use their existing credentials to sign in to Azure AD and access the cloud services that you provide and manage for them.
+
+Figure 11 illustrates the integration between the on-premises AD DS domain with Azure AD. [Microsoft Azure Active Directory Connect](http://www.microsoft.com/en-us/download/details.aspx?id=47594) (Azure AD Connect) is responsible for synchronization of identities between the on-premises AD DS domain and Azure AD. Azure AD Connect is a service that you can install on-premises or in a virtual machine in Azure.
+
+**Figure 16** - On-premises AD DS integrated with Azure AD
+
+
+
+For more information about integrating on-premises AD DS domains with Azure AD, see these resources:
+- [Integrating your on-premises identities with Azure Active Directory](http://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/)
+- [Azure AD + Domain Join + Windows 10](https://blogs.technet.microsoft.com/enterprisemobility/2016/02/17/azure-ad-domain-join-windows-10/)
+
+## Related topics
+
+[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)
+[Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md)
+[Compare Windows 10 editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare)
diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md
index 597919abca..7338cfbdc0 100644
--- a/education/windows/use-set-up-school-pcs-app.md
+++ b/education/windows/use-set-up-school-pcs-app.md
@@ -34,13 +34,10 @@ Set up School PCs makes it easy to set up Windows 10 PCs with Microsoft's recomm
* Prevents students from removing the PC from the school's device management system
* Prevents students from removing the Set up School PCs settings
- Keeps student PCs up-to-date without interfering with class time using Windows Update and maintenance hours
-
-A student PC that's set up using the Set up School PCs provisioning package is tailored to provide students with the tools they need for learning while removing apps and features that they don't need.
- * Customizes the Start layout with Office
- * Installs OneDrive for cloud-based documents and places it on the Start menu and taskbar
- * Uninstalls apps not specific to education, such as Solitaire
- * [Gets the student PC ready for use in an education environment](configure-windows-for-education.md)
- * Prevents students from adding personal Microsoft accounts to the PC
+- Customizes the Start layout with Office
+- Installs OneDrive for storing cloud-based documents and Sway for creating interactive reports, presentations, and more
+- Uninstalls apps not specific to education, such as Solitaire
+- Prevents students from adding personal Microsoft accounts to the PC
## Tips for success
@@ -132,13 +129,21 @@ The **Set up School PCs** app guides you through the configuration choices for t
**Figure 2** - Verify that the account you selected shows up
- 
+ 
5. Click **Next**.
4. To allow the student PCs to automatically connect to your school's wireless network, in the **Select the school's wireless network** page:
1. Select the school's Wi-Fi network from the list of available wireless networks or manually add a wireless network.
- 2. Click **Next**.
+ 2. Click **Next** if you added or selected a wireless network, or **Skip** to skip configuring a wireless network.
+
+ If you click **Skip**, you will see the following dialog.
+ * If you select **Got it**, you will go to the next page without Wi-Fi set up.
+ * If you select **Add Wi-Fi**, you will go back to the Wi-Fi page to add a wireless network.
+
+ **Figure 3** - Only skip Wi-Fi if you have a wired Ethernet connection
+
+ 
5. To assign a name to the student PCs, in the **Assign a name to these student PCs** page:
1. Add a short name that Set up School PCs will use as a prefix to identify and easily manage the group of devices, apps, and other settings through your device management client.
@@ -168,9 +173,9 @@ The **Set up School PCs** app guides you through the configuration choices for t
- To change the default lock screen background or to use your school's custom lock screen background, click **Browse** to select a new lock screen background.
- **Figure 3** - Configure student PC settings
+ **Figure 4** - Configure student PC settings
- 
+ 
When you're doing configuring the student PC settings, click **Next**.
@@ -180,50 +185,49 @@ The **Set up School PCs** app guides you through the configuration choices for t
If you set up Take a Test, this adds a **Take a Test** button on the student PC's sign-in screen. Windows will also lock down the student PC so that students can't access anything else while taking the test.
- **Figure 4** - Configure the Take a Test app
+ **Figure 5** - Configure the Take a Test app
- 
+ 
3. Click **Next** or **Skip** depending on whether you want to set up Take a Test.
-
-
-8. In the **Review package summary** page, make sure that all the settings you configured appear correctly.
+9. In the **Review package summary** page, make sure that all the settings you configured appear correctly.
1. If you need to change any of the settings, you can on the sections to go back to that page and make your changes.
- **Figure 5** - Review your settings and change them as needed
+ **Figure 7** - Review your settings and change them as needed
2. Click **Accept**.
-9. In the **Insert a USB drive now** page:
+10. In the **Insert a USB drive now** page:
1. Insert a USB drive to save your settings and create a provisioning package on the USB drive.
2. Set up School PCs will automatically detect the USB drive after it's inserted. Choose the USB drive from the list.
3. Click **Save** to save the provisioning package to the USB drive.
- **Figure 6** - Select the USB drive and save the provisioning package
+ **Figure 8** - Select the USB drive and save the provisioning package
- 
+ 
-10. When the provisioning package is ready, you will see the name of the file and you can remove the USB drive. Click **Next** if you're done, or click **Add a USB** to save the same provisioning package to another USB drive.
+11. When the provisioning package is ready, you will see the name of the file and you can remove the USB drive. Click **Next** if you're done, or click **Add a USB** to save the same provisioning package to another USB drive.
- **Figure 7** - Provisioning package is ready
+ **Figure 9** - Provisioning package is ready
- 
+ 
12. Follow the instructions in the **Get the student PCs ready** page to start setting up the student PCs.
- **Figure 8** - Line up the student PCs and get them ready for setup
+ **Figure 10** - Line up the student PCs and get them ready for setup
@@ -232,7 +236,7 @@ The **Set up School PCs** app guides you through the configuration choices for t
Select **Create new package** if you need to create a new provisioning package. Otherwise, you can remove the USB drive if you're completely done creating the package.
- **Figure 9** - Install the provisioning package on the student PCs
+ **Figure 11** - Install the provisioning package on the student PCs
@@ -250,19 +254,19 @@ The provisioning package on your USB drive is named `Set up School PCs.ppkg`. A
If the PC has gone past the account setup screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**.
- **Figure 10** - The first screen during first-run setup in Windows 10 Creators Update (version 1703)
+ **Figure 12** - The first screen during first-run setup in Windows 10 Creators Update (version 1703)
2. Insert the USB drive. Windows will recognize the drive and automatically install the provisioning package.
- **Figure 11** - Windows automatically detects the provisioning package and installs it
+ **Figure 13** - Windows automatically detects the provisioning package and installs it
3. You can remove the USB drive when you see the message that you can remove the removable media. You can then use the USB drive to start provisioning another student PC.
- **Figure 12** - Remove the USB drive when you see the message that the media can be removed
+ **Figure 14** - Remove the USB drive when you see the message that the media can be removed
diff --git a/education/windows/windows-10-pro-to-pro-edu-upgrade.md b/education/windows/windows-10-pro-to-pro-edu-upgrade.md
deleted file mode 100644
index 373293b8ac..0000000000
--- a/education/windows/windows-10-pro-to-pro-edu-upgrade.md
+++ /dev/null
@@ -1,263 +0,0 @@
----
-title: Switch Windows 10 Pro to Pro Education
-description: Describes how IT Pros can opt into switching from Windows 10 Pro to Windows 10 Pro Education from the Microsoft Store for Education.
-keywords: switch, Pro to Pro Education, education customers
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: edu
-localizationpriority: high
-author: CelesteDG
----
-
-# Switch Windows 10 Pro to Pro Education from Microsoft Store for Education
-
-Windows 10 Pro Education is a new offering in Windows 10 Anniversary Update (Windows 10, version 1607). This edition builds on the commercial version of Windows 10 Pro and provides important management controls needed in schools by providing education-specific default settings.
-
-If you have an education tenant and use Windows 10 Pro in your schools now, global administrators can opt-in to a free switch to Windows 10 Pro Education through the Microsoft Store for Education. To take advantage of this offering, make sure you meet the [requirements for switching](#requirements-for-switching).
-
-Starting with Windows 10, version 1607, academic institutions can easily move from Windows 10 Pro to Windows 10 Pro Education—no keys and no reboots. After one of your users enters the Azure AD credentials associated with a Windows 10 Pro Education license, the operating system turns from Windows 10 Pro to Windows 10 Pro Education and all the appropriate Windows 10 Pro Education features are unlocked. When a license expires or is transferred to another user, the Windows 10 Pro Education device seamlessly steps back down to Windows 10 Pro.
-
-Previously, only schools or organizations purchasing devices as part of the Shape the Future K-12 program or with a Microsoft Volume Licensing Agreement could deploy Windows 10 Pro Education to their users. Now, if you have a Azure AD for your organization, you can take advantage of the Windows 10 Pro Education features.
-
-When you switch to Windows 10 Pro Education, you get the following benefits:
-
-- **Windows 10 Pro Education edition**. Devices currently running Windows 10 Pro, version 1607 can get Windows 10 Pro Education Current Branch (CB). This benefit does not include Long Term Service Branch (LTSB).
-- **Support from one to hundreds of users**. The Windows 10 Pro Education program does not have a limitation on the number of licenses an organization can have.
-- **Roll back to Windows 10 Pro at any time**. When a user leaves the domain or you turn off the setting to automatic switch to Windows 10 Pro Education, the device reverts seamlessly to Windows 10 Pro edition (after a grace period of up to 30 days).
-
-In summary, the Windows 10 Pro Education free switch through the Microsoft Store for Education is an offering that provides organizations easier, more flexible access to the benefits of Windows 10 Pro Education edition.
-
-## Compare Windows 10 Pro and Pro Education editions
-
-In Windows 10, version 1607, the Windows 10 Pro Education edition contains the same features as the Windows 10 Pro edition except for the following differences:
-
-- Cortana is removed from Windows 10 Pro Education
-- Options to manage Windows 10 tips and tricks and Windows Store suggestions
-
-See [Windows 10 editions for education customers](windows-editions-for-education-customers.md) for more info about Windows 10 Pro Education and you can also [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare) to find out more about the features we support in other editions of Windows 10.
-
-## Requirements for switching
-
-Before you switch from Windows 10 Pro to Windows 10 Pro Education, make sure you meet these requirements:
-- Devices must be:
- - Running Windows 10 Pro, version 1607
- - Must be Azure Active Directory joined, or domain joined with Azure AD Connect. Customers who are federated with Azure Active Directory are also eligible. For more information, see [Review requirements on devices](#review-requirements-on-devices).
-
- If you haven't domain joined your devices already, [prepare for deployment of Windows 10 Pro Education licenses](#preparing-for-deployment-of-windows-10-pro-education-licenses).
-- The user making the changes must be a member of the Azure AD global administrator group.
-- The Azure AD tenant must be recognized as an education approved tenant.
-- You must have a Microsoft Store for Education account.
-
-## Switch from Windows 10 Pro to Windows 10 Pro Education
-Once you enable the setting to switch Windows 10 Pro to Windows 10 Pro Education, the switch will begin only after a user signs in to their device. The setting applies to the entire organization so you cannot select which users will receive the switch.
-
-**To turn on the automatic switch from Windows 10 Pro to Windows 10 Pro Education**
-
-1. Sign in to [Microsoft Store for Education](https://businessstore.microsoft.com/en-us/Store/Apps) with your work or school account.
-
- If this is the first time you're signing into the Microsoft Store, you'll be prompted to accept the Microsoft Store for Business and Education License Agreement.
-
-2. Go to **Manage > Account information**.
-3. In the **Account information** page, look for the **Automatic Windows 10 Pro Education upgrade** section and follow the link.
-
- You will see the following page informing you that your school is eligible for a free automatic switch from Windows 10 Pro to Windows 10 Pro Education.
-
- 
-
- **Figure 1** - Switch Windows 10 Pro to Windows 10 Pro Education
-
-4. Select **I understand enabling this setting will impact all devices running Windows 10 Pro in my organization**.
-5. Click **Send me email with a link to enable this upgrade** to receive an email with a link to the switch.
-
- 
-
- **Figure 2** - Email notification with a link to enable the switch
-
-6. Click **Enable the automatic upgrade now** to turn on automatic switches.
-
- .
-
- **Figure 3** - Enable the automatic switch
-
- Enabling the automatic switch also triggers an email message notifying all global administrators in your organization about the switch. It also contains a link that enables any global administrators to cancel the switch, if they choose. For more info about rolling back or canceling the switch, see [Roll back Windows 10 Pro Education to Windows 10 Pro](#roll-back-windows-10-pro-education-to-windows-10-pro).
-
- .
-
- **Figure 4** - Notification email sent to all global administrators
-
-7. Click **Close** in the **Success** page.
-
- In the **Upgrade Windows 10 Pro to Windows 10 Pro Education** page, you will see a message informing you when the switch was enabled and the name of the admin who enabled the switch.
-
- 
-
- **Figure 5** - Details about the automatic switch
-
-
-## Explore the switch experience
-
-So what will the users experience? How will they switch their devices?
-
-### For existing Azure AD domain joined devices
-Existing Azure AD domain joined devices will be switched from Windows 10 Pro to Windows 10 Pro Education the next time the user logs in. That's it! No additional steps are needed.
-
-### For new devices that are not Azure AD domain joined
-Now that you've turned on the setting to automatically switch Windows 10 Pro to Windows 10 Pro Education, the users are ready to switch their devices running Windows 10 Pro, version 1607 edition to Windows 10 Pro Education edition.
-
-#### Step 1: Join users’ devices to Azure AD
-
-Users can join a device to Azure AD the first time they start the device (during setup), or they can join a device that they already use running Windows 10 Pro, version 1607.
-
-**To join a device to Azure AD the first time the device is started**
-
-1. During the initial setup, on the **Who owns this PC?** page, select **My organization**, and then click **Next**, as illustrated in **Figure 6**.
-
- 
-
- **Figure 6** - The “Who owns this PC?” page in initial Windows 10 setup
-
-2. On the **Choose how you’ll connect** page, select **Join Azure AD**, and then click **Next**, as illustrated in **Figure 7**.
-
- 
-
- **Figure 7** - The “Choose how you’ll connect” page in initial Windows 10 setup
-
-3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 8**.
-
- 
-
- **Figure 8** - The “Let’s get you signed in” page in initial Windows 10 setup
-
-Now the device is Azure AD joined to the company’s subscription.
-
-**To join a device to Azure AD when the device already has Windows 10 Pro, version 1607 installed and set up**
-
-1. Go to **Settings > Accounts > Access work or school**, as illustrated in **Figure 9**.
-
- 
-
- **Figure 9** - Connect to work or school configuration in Settings
-
-2. In **Set up a work or school account**, click **Join this device to Azure Active Directory**, as illustrated in **Figure 10**.
-
- 
-
- **Figure 10** - Set up a work or school account
-
-3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 11**.
-
- 
-
- **Figure 11** - The “Let’s get you signed in” dialog box
-
-Now the device is Azure AD joined to the company’s subscription.
-
-#### Step 2: Sign in using Azure AD account
-
-Once the device is joined to your Azure AD subscription, the user will sign in by using his or her Azure AD account, as illustrated in **Figure 12**. The Windows 10 Pro Education license associated with the user will enable Windows 10 Pro Education edition capabilities on the device.
-
-
-
-**Figure 12** - Sign in by using Azure AD account
-
-#### Step 3: Verify that Pro Education edition is enabled
-
-You can verify the Windows 10 Pro Education in **Settings > Update & Security > Activation**, as illustrated in **Figure 13**.
-
-
-
-**Figure 13** - Windows 10 Pro Education in Settings
-
-
-
-If there are any problems with the Windows 10 Pro Education license or the activation of the license, the **Activation** panel will display the appropriate error message or status. You can use this information to help you diagnose the licensing and activation process.
-
-## Troubleshoot the user experience
-
-In some instances, users may experience problems with the Windows 10 Pro Education switch. The most common problems that users may experience are as follows:
-
-- The existing Windows 10 Pro, version 1607 operating system is not activated.
-
-- The Windows 10 Pro Education switch has lapsed or has been removed.
-
-Use the following figures to help you troubleshoot when users experience these common problems:
-
-
-
-**Figure 13** - Illustrates a device in a healthy state, where Windows 10 Pro, version 1607 is activated and the Windows 10 Pro Education switch is active.
-
-
-
-
-
-**Figure 14** - Illustrates a device on which Windows 10 Pro, version 1607 is not activated, but the Windows 10 Pro Education switch is active.
-
-- - -### Review requirements on devices - -Devices must be running Windows 10 Pro, version 1607, and be Azure Active Directory joined, or domain joined with Azure AD Connect. Customers who are federated with Azure Active Directory are also eligible. You can use the following procedures to review whether a particular device meets requirements. - -**To determine if a device is Azure Active Directory joined** - -1. Open a command prompt and type **dsregcmd /status**. - -2. Review the output under Device State. If the **AzureAdJoined** status is YES, the device is Azure Active Directory joined. - -**To determine the version of Windows 10** - -- At a command prompt, type: - **winver** - - A popup window will display the Windows 10 version number and detailed OS build information. - - If a device is running a previous version of Windows 10 Pro (for example, version 1511), it will not be switched to Windows 10 Pro Education when a user signs in, even if the user has been assigned a license. - -## Roll back Windows 10 Pro Education to Windows 10 Pro - -If your organization has the Windows 10 Pro to Windows 10 Pro Education switch enabled, and you decide to roll back to Windows 10 Pro or to cancel the switch, you can do this by: -- Logging into Microsoft Store for Education page and turning off the automatic switch. -- Selecting the link to turn off the automatic switch from the notification email sent to all global administrators. - -Once the automatic switch to Windows 10 Pro Education is turned off, the change is effective immediately. Devices that were switched will revert to Windows 10 Pro only after the license has been refreshed (every 30 days) and the next time the user signs in. This means that a user whose device was switched may not immediately see Windows 10 Pro Education rolled back to Windows 10 Pro for up to 30 days. However, users who haven't signed in during the time that an switch was enabled and then turned off will never see their device change from Windows 10 Pro. - -**To roll back Windows 10 Pro Education to Windows 10 Pro** -1. Log in to [Microsoft Store for Education](https://businessstore.microsoft.com/en-us/Store/Apps) with your school or work account, or follow the link from the notification email to turn off the automatic switch. -2. Select **Manage > Account information** and locate the section **Automatic Windows 10 Pro Education upgrade** and follow the link. -3. In the **Upgrade Windows 10 Pro to Windows 10 Pro Education** page, select **Turn off the automatic upgrade to Windows 10 Pro Education**. - -  - - **Figure 15** - Link to turn off the automatic switch - -4. You will be asked if you're sure that you want to turn off automatic switches to Windows 10 Pro Education. Click **Yes**. -5. Click **Close** in the **Success** page. -6. In the **Upgrade Windows 10 Pro to Windows 10 Pro Education** page, you will see information on when the switch was disabled. - - If you decide later that you want to turn on automatic switches again, you can do this from the **Upgrade Windows 10 Pro to Windows 10 Pro Education**. - -## Preparing for deployment of Windows 10 Pro Education licenses - -If you have on-premises Active Directory Domain Services (AD DS) domains, users will use their domain-based credentials to sign in to the AD DS domain. Before you start deploying Windows 10 Pro Education to users, you need to synchronize the identities in the on-premises AD DS domain with Azure AD. - -You need to synchronize these identities so that users will have a *single identity* that they can use to access their on-premises apps and cloud services that use Azure AD (such as Windows 10 Pro Education). This means that users can use their existing credentials to sign in to Azure AD and access the cloud services that you provide and manage for them. - -**Figure 16** illustrates the integration between the on-premises AD DS domain with Azure AD. [Microsoft Azure Active Directory Connect](http://www.microsoft.com/en-us/download/details.aspx?id=47594) (Azure AD Connect) is responsible for synchronization of identities between the on-premises AD DS domain and Azure AD. Azure AD Connect is a service that you can install on-premises or in a virtual machine in Azure. - - - -**Figure 16** - On-premises AD DS integrated with Azure AD - -For more information about integrating on-premises AD DS domains with Azure AD, see these resources: -- [Integrating your on-premises identities with Azure Active Directory](http://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/) -- [Azure AD + Domain Join + Windows 10](https://blogs.technet.microsoft.com/enterprisemobility/2016/02/17/azure-ad-domain-join-windows-10/) - -## Related topics - -[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) - -[Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md) - -[Compare Windows 10 editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare) diff --git a/education/windows/windows-editions-for-education-customers.md b/education/windows/windows-editions-for-education-customers.md index db3fb46f6a..b798212e27 100644 --- a/education/windows/windows-editions-for-education-customers.md +++ b/education/windows/windows-editions-for-education-customers.md @@ -39,7 +39,7 @@ Existing devices running Windows 10 Pro, currently activated with the original O Customers with Academic Volume Licensing agreements with rights for Windows can get Windows 10 Pro Education through the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). -Customers who deploy Windows 10 Pro are able to configure the product to have similar feature settings to Windows 10 Pro Education using policies. More detailed information on these policies and the configuration steps required is available in Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](https://go.microsoft.com/fwlink/?LinkId=822627). We recommend that K-12 customers using commercial Windows 10 Pro read the [document](https://go.microsoft.com/fwlink/?LinkId=822627) and apply desired settings for your environment. +Customers who deploy Windows 10 Pro are able to configure the product to have similar feature settings to Windows 10 Pro Education using policies. More detailed information on these policies and the configuration steps required is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](https://go.microsoft.com/fwlink/?LinkId=822627). We recommend that K-12 customers using commercial Windows 10 Pro read the [document](https://go.microsoft.com/fwlink/?LinkId=822627) and apply desired settings for your environment. ## Windows 10 Education diff --git a/store-for-business/update-windows-store-for-business-account-settings.md b/store-for-business/update-windows-store-for-business-account-settings.md index e2266ea8a6..637220cb67 100644 --- a/store-for-business/update-windows-store-for-business-account-settings.md +++ b/store-for-business/update-windows-store-for-business-account-settings.md @@ -61,13 +61,13 @@ Taxes for Microsoft Store for Business purchases are determined by your business - Switzerland - United Kingdom -These countries can provide their VAT number or local equivalent in **Payments & billing**. However, they can only acquire free apps. +These countries can provide their VAT number or local equivalent in **Payments & billing**. |Market| Tax identifier | |------|----------------| -| Brazil | CPNJ (required), CCMID (optional) | -| India | CST ID, VAT ID | -| Taiwan | Unified business number| +| Brazil | CNPJ (required) | +| India | CST ID, VAT ID (both are optional) | +| Taiwan | VAT ID (optional) | ### Tax-exempt status diff --git a/store-for-business/windows-store-for-business-overview.md b/store-for-business/windows-store-for-business-overview.md index 92902b6347..0edcf1dfa2 100644 --- a/store-for-business/windows-store-for-business-overview.md +++ b/store-for-business/windows-store-for-business-overview.md @@ -157,6 +157,193 @@ For more information, see [Manage settings in the Store for Business](manage-set Microsoft Store for Business and Education is currently available in these markets. + +### Support for free and paid apps
| Support for free and paid apps | @@ -294,22 +481,29 @@ Microsoft Store for Business and Education is currently available in these marke
|---|
| Support for free apps only | -
|---|
-
|
-
**Duration**, represented as an XML TimeSpan data type, does not allow years and months. You represent the **NextUpdate** attribute as a XML DateTime data type in UTC. | **Required?** Yes. At least one is required. | +| **LogDuration** or **LogEndDate** | Configures auditing only to extend beyond the expiration of enforcing the Pin Rules.
**LogEndDate**, represented as an XML DateTime data type in UTC, takes precedence if both are specified.
You represent **LogDuration** as an XML TimeSpan data type, which does not allow years and months.
If neither attribute is specified, auditing expiration uses **Duration** or **NextUpdate** attributes. | No. | +| **ListIdentifier** | Provides a friendly name for the list of pin rules. Windows does not use this attribute for certificate pinning enforcement, however it is included when the pin rules are converted to a certificate trust list (CTL). | No. | #### PinRule Element -The **PinRule** element can have the following attributes: +The **PinRule** element can have the following attributes. -- **Name** - - Uniquely identifies the **PinRule**. - Windows uses this attribute to identify the element for a parsing error or for verbose output. - The attribute is not included in the generated certificate trust list (CTL). - - **Required?** Yes. - -- **Error** - - Describes the action Windows performs when it encounters a PIN mismatch. - You can choose from the following string values: - - **Revoked** - Windows reports the certificate protecting the site as if it was revoked. This typically prevents the user from accessing the site. - - **InvalidName** - Windows reports the certificate protecting the site as if the name on the certificate does not match the name of the site. This typically results in prompting the user before accessing the site. - - **None** - The default value. No error is returned. You can use this setting to audit the pin rules without introducing any user friction. - - **Required?** No. - -- **Log** - - A Boolean value represent as string that equals **true** or **false**. - By default, logging is enabled (**true**). - - **Required?** No. +| Attribute | Description | Required | +|-----------|-------------|----------| +| **Name** | Uniquely identifies the **PinRule**. Windows uses this attribute to identify the element for a parsing error or for verbose output. The attribute is not included in the generated certificate trust list (CTL). | Yes.| +| **Error** | Describes the action Windows performs when it encounters a PIN mismatch. You can choose from the following string values:
- **Revoked** - Windows reports the certificate protecting the site as if it was revoked. This typically prevents the user from accessing the site.
- **InvalidName** - Windows reports the certificate protecting the site as if the name on the certificate does not match the name of the site. This typically results in prompting the user before accessing the site.
- **None** - The default value. No error is returned. You can use this setting to audit the pin rules without introducing any user friction. | No. | +| **Log** | A Boolean value represent as string that equals **true** or **false**. By default, logging is enabled (**true**). | No. | #### Certificate element -The **Certificate** element can have the following attributes: +The **Certificate** element can have the following attributes. -- **File** - - Path to a file containing one or more certificates. - Where the certificate(s) can be encoded as: - - single certificate - - p7b - - sst. - - These files can also be Base64 formatted. - All **Site** elements included in the same **PinRule** element can match any of these certificates. - - **Required?** Yes (File, Directory or Base64 must be present). - -- **Directory** - - Path to a directory containing one or more of the above certificate files. - Skips any files not containing any certificates. - - **Required?** Yes (File, Directory or Base64 must be present). - -- **Base64** - - Base64 encoded certificate(s). - Where the certificate(s) can be encoded as: - - single certificate - - p7b - - sst. - - This allows the certificates to be included in the XML file without a file directory dependency. - - > [!Note] - > You can use **certutil -encode** to a .cer file into base64. You can then use Notepad to copy and paste the base64 encoded certificate into the pin rule. - - **Required?** Yes (File, Directory or Base64 must be present). - -- **EndDate** - - Enables you to configure an expiration date for when the certificate is no longer valid in the pin rule. - - If you are in the process of switching to a new root or CA, you can set the **EndDate** to allow matching of this element’s certificates. - - If the current time is past the **EndDate**, then, when creating the certificate trust list (CTL), the parser outputs a warning message and exclude the certificate(s) from the Pin Rule in the generated CTL. - - For help with formatting Pin Rules, see [Representing a Date in XML](#representing-a-date-in-xml). - - **Required?** No. +| Attribute | Description | Required | +|-----------|-------------|----------| +| **File** | Path to a file containing one or more certificates. Where the certificate(s) can be encoded as:
- single certificate
- p7b
- sst
These files can also be Base64 formatted. All **Site** elements included in the same **PinRule** element can match any of these certificates. | Yes (File, Directory or Base64 must be present). | +| **Directory** | Path to a directory containing one or more of the above certificate files. Skips any files not containing any certificates. | Yes (File, Directory or Base64 must be present). | +| **Base64** | Base64 encoded certificate(s). Where the certificate(s) can be encoded as:
- single certificate
- p7b
- sst
This allows the certificates to be included in the XML file without a file directory dependency.
Note:
You can use **certutil -encode** to convert a .cer file into base64. You can then use Notepad to copy and paste the base64 encoded certificate into the pin rule. | Yes (File, Directory or Base64 must be present). | +| **EndDate** | Enables you to configure an expiration date for when the certificate is no longer valid in the pin rule.
If you are in the process of switching to a new root or CA, you can set the **EndDate** to allow matching of this element’s certificates.
If the current time is past the **EndDate**, then, when creating the certificate trust list (CTL), the parser outputs a warning message and exclude the certificate(s) from the Pin Rule in the generated CTL.
For help with formatting Pin Rules, see [Representing a Date in XML](#representing-a-date-in-xml).| No.| #### Site element -The **Site** element can have the following attributes: +The **Site** element can have the following attributes. -- **Domain** - - Contains the DNS name to be matched for this pin rule. - When creating the certificate trust list, the parser normalizes the input name string value as follows: - - If the DNS name has a leading "*" it is removed. - - Non-ASCII DNS name are converted to ASCII Puny Code. - - Upper case ASCII characters are converted to lower case. - - If the normalized name has a leading ".", then, wildcard left hand label matching is enabled. - For example, ".xyz.com" would match "abc.xyz.com". - - **Required?** Yes. - -- **AllSubdomains** - - By default, wildcard left hand label matching is restricted to a single left hand label. - This attribute can be set to "true" to enable wildcard matching of all of the left hand labels. - - For example, setting this attribute would also match "123.abc.xyz.com" for the ".xyz.com" domain value. - - **Required?** No. +| Attribute | Description | Required | +|-----------|-------------|----------| +| **Domain** | Contains the DNS name to be matched for this pin rule. When creating the certificate trust list, the parser normalizes the input name string value as follows:
- If the DNS name has a leading "*" it is removed.
- Non-ASCII DNS name are converted to ASCII Puny Code.
- Upper case ASCII characters are converted to lower case.
If the normalized name has a leading ".", then, wildcard left hand label matching is enabled. For example, ".xyz.com" would match "abc.xyz.com". | Yes.| +| **AllSubdomains** | By default, wildcard left hand label matching is restricted to a single left hand label. This attribute can be set to "true" to enable wildcard matching of all of the left-hand labels.
For example, setting this attribute would also match "123.abc.xyz.com" for the ".xyz.com" domain value.| No.| ### Create a Pin Rules Certificate Trust List @@ -289,9 +189,12 @@ Sign-in to the reference computer using domain administrator equivalent credenti 8. Right-click the **Registry** node and click **New**. 9. In the **New Registry Properties** dialog box, select **Update** from the **Action** list. Select **HKEY_LOCAL_MACHINE** from the **Hive** list. 10. For the **Key Path**, click **…** to launch the **Registry Item Browser**. Navigate to the following registry key and select the **PinRules** registry value name: + HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType0\CertDllCreateCertificateChainEngine\Config + Click **Select** to close the **Registry Item Browser**. -11. The **Key Path** should contain the selected registry key. The **Value name** configuration should contain the registry value name **_PinRules_**. **Value type** should read **_REGBINARY_** and **Value data** should contain a long series of numbers from 0-9 and letters ranging from A-F (hexadecimal). Click **OK** to save your settings and close the dialog box. + +11. The **Key Path** should contain the selected registry key. The **Value name** configuration should contain the registry value name **_PinRules_**. **Value type** should read **_REG\_BINARY_** and **Value data** should contain a long series of numbers from 0-9 and letters ranging from A-F (hexadecimal). Click **OK** to save your settings and close the dialog box.  @@ -302,10 +205,6 @@ Sign-in to the reference computer using domain administrator equivalent credenti To assist in constructing certificate pinning rules, you can configure the **PinRulesLogDir** setting under the certificate chain configuration registry key to include a parent directory to log pin rules. -```code -HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType0\CertDllCreateCertificateChainEngine\Config -``` - | Name | Value | |------|-------| | Key | HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType0\CertDllCreateCertificateChainEngine\Config | diff --git a/windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo.md b/windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo.md index 80474a70be..d8344768fc 100644 --- a/windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo.md +++ b/windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo.md @@ -85,7 +85,7 @@ First, create the WMI filter and configure it to look for a specified version (o After you have created a filter with the correct query, link the filter to the GPO. Filters can be reused with many GPOs simultaneously; you do not have to create a new one for each GPO if an existing one meets your needs. -1. Open theGroup Policy Management console. +1. Open the Group Policy Management console. 2. In the navigation pane, find and then click the GPO that you want to modify. diff --git a/windows/application-management/docfx.json b/windows/application-management/docfx.json index a0c06828be..cc2687ac6a 100644 --- a/windows/application-management/docfx.json +++ b/windows/application-management/docfx.json @@ -32,7 +32,8 @@ "externalReference": [], "globalMetadata": { "uhfHeaderId": "MSDocsHeader-WindowsIT", - "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json" + "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "ms.technology": "windows" }, "fileMetadata": {}, "template": [], diff --git a/windows/client-management/TOC.md b/windows/client-management/TOC.md index 120dc8ffe8..57e0175c71 100644 --- a/windows/client-management/TOC.md +++ b/windows/client-management/TOC.md @@ -9,5 +9,5 @@ ## [Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md) ## [Windows 10 Mobile deployment and management guide](windows-10-mobile-and-mdm.md) ## [Windows libraries](windows-libraries.md) -## [Mobile Device Management](mdm/index.md) +## [Mobile device management protocol](mdm/index.md) ## [Change history for Client management](change-history-for-client-management.md) diff --git a/windows/client-management/docfx.json b/windows/client-management/docfx.json index 107c56cde2..b42d904675 100644 --- a/windows/client-management/docfx.json +++ b/windows/client-management/docfx.json @@ -32,7 +32,8 @@ "externalReference": [], "globalMetadata": { "uhfHeaderId": "MSDocsHeader-WindowsIT", - "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json" + "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "ms.technology": "windows" }, "fileMetadata": {}, "template": [], diff --git a/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md b/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md index a7c3befabe..69f6f73aa0 100644 --- a/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md +++ b/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md @@ -191,7 +191,7 @@ To see the Notebooks that your Azure AD account has access to, tap **More Notebo ## Use Windows Store for Business -[Windows Store for Business](/microsoft-store/index) allows you to specify applications to be available to your users in the Windows Store application. These applications show up on a tab titled for your company. Applications approved in the Windows Store for Business portal can be installed by users. +[Microsoft Store for Business](/microsoft-store/index) allows you to specify applications to be available to your users in the Windows Store application. These applications show up on a tab titled for your company. Applications approved in the Microsoft Store for Business portal can be installed by users.  diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 35f400979f..3e072988e3 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -141,6 +141,7 @@ #### [EnterpriseModernAppManagement DDF](enterprisemodernappmanagement-ddf.md) #### [EnterpriseModernAppManagement XSD](enterprisemodernappmanagement-xsd.md) ### [FileSystem CSP](filesystem-csp.md) +### [Firewall CSP](firewall-csp.md) ### [HealthAttestation CSP](healthattestation-csp.md) #### [HealthAttestation DDF](healthattestation-ddf.md) ### [HotSpot CSP](hotspot-csp.md) diff --git a/windows/client-management/mdm/activesync-csp.md b/windows/client-management/mdm/activesync-csp.md index 11681a3787..a395891a14 100644 --- a/windows/client-management/mdm/activesync-csp.md +++ b/windows/client-management/mdm/activesync-csp.md @@ -1,15 +1,12 @@ --- title: ActiveSync CSP description: ActiveSync CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: c65093ef-bd36-4f32-9dab-edb7bcfb3188 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ActiveSync CSP diff --git a/windows/client-management/mdm/activesync-ddf-file.md b/windows/client-management/mdm/activesync-ddf-file.md index 691947b55a..8aa90d6d7c 100644 --- a/windows/client-management/mdm/activesync-ddf-file.md +++ b/windows/client-management/mdm/activesync-ddf-file.md @@ -1,15 +1,12 @@ --- title: ActiveSync DDF file description: ActiveSync DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: c4cd4816-ad8f-45b2-9b81-8abb18254096 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ActiveSync DDF file diff --git a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md index 3cea96c4cd..e1c6986fe5 100644 --- a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md +++ b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md @@ -1,15 +1,12 @@ --- title: Add an Azure AD tenant and Azure AD subscription description: Here's a step-by-step guide to adding an Azure Active Directory tenant, adding an Azure AD subscription, and registering your subscription. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 36D94BEC-A6D8-47D2-A547-EBD7B7D163FA -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Add an Azure AD tenant and Azure AD subscription diff --git a/windows/client-management/mdm/alljoynmanagement-csp.md b/windows/client-management/mdm/alljoynmanagement-csp.md index 196534eb9b..0746ed4175 100644 --- a/windows/client-management/mdm/alljoynmanagement-csp.md +++ b/windows/client-management/mdm/alljoynmanagement-csp.md @@ -1,15 +1,12 @@ --- title: AllJoynManagement CSP description: The AllJoynManagement configuration service provider (CSP) allows an IT administrator to enumerate the AllJoyn devices that are connected to the AllJoyn bus. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 468E0EE5-EED3-48FF-91C0-89F9D159AA8C -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # AllJoynManagement CSP diff --git a/windows/client-management/mdm/alljoynmanagement-ddf.md b/windows/client-management/mdm/alljoynmanagement-ddf.md index d7de78a5f4..ebc2840da3 100644 --- a/windows/client-management/mdm/alljoynmanagement-ddf.md +++ b/windows/client-management/mdm/alljoynmanagement-ddf.md @@ -1,15 +1,12 @@ --- title: AllJoynManagement DDF description: AllJoynManagement DDF -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 540C2E60-A041-4749-A027-BBAF0BB046E4 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # AllJoynManagement DDF diff --git a/windows/client-management/mdm/application-csp.md b/windows/client-management/mdm/application-csp.md index 9ed4ad4239..463b2e0c07 100644 --- a/windows/client-management/mdm/application-csp.md +++ b/windows/client-management/mdm/application-csp.md @@ -1,15 +1,12 @@ --- title: APPLICATION configuration service provider description: APPLICATION configuration service provider -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 0705b5e9-a1e7-4d70-a73d-7f758ffd8099 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # APPLICATION configuration service provider diff --git a/windows/client-management/mdm/applicationrestrictions-xsd.md b/windows/client-management/mdm/applicationrestrictions-xsd.md index c1c0a561a1..312d90524e 100644 --- a/windows/client-management/mdm/applicationrestrictions-xsd.md +++ b/windows/client-management/mdm/applicationrestrictions-xsd.md @@ -1,15 +1,12 @@ --- title: ApplicationRestrictions XSD description: Here's the XSD for the ApplicationManagement/ApplicationRestrictions policy. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: A5AA2B59-3736-473E-8F70-A90FD61EE426 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ApplicationRestrictions XSD diff --git a/windows/client-management/mdm/applocker-csp.md b/windows/client-management/mdm/applocker-csp.md index a8104b8cd5..a73544002c 100644 --- a/windows/client-management/mdm/applocker-csp.md +++ b/windows/client-management/mdm/applocker-csp.md @@ -1,15 +1,12 @@ --- title: AppLocker CSP description: AppLocker CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 32FEA2C9-3CAD-40C9-8E4F-E3C69637580F -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # AppLocker CSP diff --git a/windows/client-management/mdm/applocker-ddf-file.md b/windows/client-management/mdm/applocker-ddf-file.md index d743bc90b9..e332216b02 100644 --- a/windows/client-management/mdm/applocker-ddf-file.md +++ b/windows/client-management/mdm/applocker-ddf-file.md @@ -1,15 +1,12 @@ --- title: AppLocker DDF file description: AppLocker DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 79E199E0-5454-413A-A57A-B536BDA22496 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # AppLocker DDF file diff --git a/windows/client-management/mdm/applocker-xsd.md b/windows/client-management/mdm/applocker-xsd.md index 8a5ed59bcb..1d578d006d 100644 --- a/windows/client-management/mdm/applocker-xsd.md +++ b/windows/client-management/mdm/applocker-xsd.md @@ -1,15 +1,12 @@ --- title: AppLocker XSD description: Here's the XSD for the AppLocker CSP. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 70CF48DD-AD7D-4BCF-854F-A41BFD95F876 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # AppLocker XSD diff --git a/windows/client-management/mdm/appv-deploy-and-config.md b/windows/client-management/mdm/appv-deploy-and-config.md index 1583fe4479..d7f18cf787 100644 --- a/windows/client-management/mdm/appv-deploy-and-config.md +++ b/windows/client-management/mdm/appv-deploy-and-config.md @@ -1,14 +1,11 @@ --- title: Deploy and configure App-V apps using MDM description: Deploy and configure App-V apps using MDM -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Deploy and configure App-V apps using MDM diff --git a/windows/client-management/mdm/assign-seats.md b/windows/client-management/mdm/assign-seats.md index 0e0aedaff6..b39d6d9cdf 100644 --- a/windows/client-management/mdm/assign-seats.md +++ b/windows/client-management/mdm/assign-seats.md @@ -1,15 +1,12 @@ --- title: Assign seat description: The Assign seat operation assigns seat for a specified user in the Windows Store for Business. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: B42BF490-35C9-405C-B5D6-0D9F0E377552 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Assign seat diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index bc9933dc97..aad87ff0e5 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -1,15 +1,12 @@ --- title: AssignedAccess CSP description: The AssignedAccess configuration service provider (CSP) is used set the device to run in kiosk mode. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 421CC07D-6000-48D9-B6A3-C638AAF83984 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # AssignedAccess CSP diff --git a/windows/client-management/mdm/assignedaccess-ddf.md b/windows/client-management/mdm/assignedaccess-ddf.md index 7bff2aad34..4f2fae2306 100644 --- a/windows/client-management/mdm/assignedaccess-ddf.md +++ b/windows/client-management/mdm/assignedaccess-ddf.md @@ -1,15 +1,12 @@ --- title: AssignedAccess DDF description: AssignedAccess DDF -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 224FADDB-0EFD-4E5A-AE20-1BD4ABE24306 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # AssignedAccess DDF diff --git a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md index 9c47fe110e..ebdb1d406e 100644 --- a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md @@ -1,15 +1,12 @@ --- title: Azure Active Directory integration with MDM description: Azure Active Directory is the world largest enterprise cloud identity management service. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: D03B0765-5B5F-4C7B-9E2B-18E747D504EE -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 1c046fef02..308b678f24 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -1,14 +1,11 @@ --- title: BitLocker CSP description: BitLocker CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # BitLocker CSP @@ -674,7 +671,7 @@ The following example is provided to show proper format and should not be taken
+ +## CSP support + + +[APPLICATION CSP](application-csp.md) + +
| Configuration service provider | -Supported in Windows 10 Pro | -Supported in Windows 10 Business | -Supported in Windows 10 Enterprise | -Supported in Windows 10 Education | -Supported in Windows 10 Home | -Supported in Windows 10 Mobile | -Supported in Windows 10 Mobile Enterprise | +
|---|---|---|---|---|---|---|---|
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +|
 |
+ |
+ + | |
+ |
+ |
+ |
|
| [ActiveSync CSP](activesync-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [AllJoynManagement CSP](alljoynmanagement-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [APPLICATION CSP](application-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [AppLocker CSP](applocker-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [AssignedAccess CSP](assignedaccess-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [BitLocker CSP](bitlocker-csp.md) | - |
-2 |
-2 |
-2 |
- |
-2 |
-2 |
-
-
| [BOOTSTRAP CSP](bootstrap-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [BrowserFavorite CSP](browserfavorite-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [CellularSettings CSP](cellularsettings-csp.md) | -2 |
-- | 2 |
-2 |
-2 |
- |
- |
-
-
| [CertificateStore CSP](certificatestore-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [CleanPC CSP](cleanpc-csp.md) | - |
-2 |
-2 |
-2 |
- |
- |
- |
-
| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [CM_CellularEntries CSP](cm-cellularentries-csp.md) | -2 |
-- | 2 |
-2 |
-2 |
- |
- |
-
-
| [CM_ProxyEntries CSP](cm-proxyentries-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [CMPolicy CSP](cmpolicy-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [CMPolicyEnterprise CSP](cmpolicyenterprise-csp.md) | - |
-- | |
- |
- |
-1 |
-1 |
-
-
| [CustomDeviceUI CSP](customdeviceui-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [Defender CSP](defender-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [DevDetail CSP](devdetail-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [DeveloperSetup CSP](developersetup-csp.md) | - |
- |
- |
- |
- |
- |
- |
-
| [DeviceInstanceService CSP](deviceinstanceservice-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [DeviceLock CSP](devicelock-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [DeviceManageability CSP](devicemanageability-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [DeviceStatus CSP](devicestatus-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [DevInfo CSP](devinfo-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [DiagnosticLog CSP](diagnosticlog-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [DMAcc CSP](dmacc-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [DMClient CSP](dmclient-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [DynamicManagement CSP](dynamicmanagement-csp.md) | - |
- |
-2 |
-2 |
- |
-2 |
-2 |
-
-
| [EMAIL2 CSP](email2-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [EnterpriseAPN CSP](enterpriseapn-csp.md) | -2 |
-- | 2 |
-2 |
-2 |
- |
- |
-
-
| [EnterpriseAppManagement CSP](enterpriseappmanagement-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [EnterpriseAppVManagement CSP](enterpriseappvmanagement-csp.md) | - |
- |
-2 |
-2 |
- |
- |
- |
-
-
| [EnterpriseAssignedAccess CSP](enterpriseassignedaccess-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [EnterpriseDesktopAppManagement CSP](enterprisedesktopappmanagement-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [EnterpriseExt CSP](enterpriseext-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [EnterpriseExtFileSystem CSP](enterpriseextfilessystem-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [FileSystem CSP](filesystem-csp.md) | - |
-- | |
- |
- |
-
- (Provisioning only) |
-
- (Provisioning only) |
-
-
| [HealthAttestation CSP](healthattestation-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [HotSpot CSP](hotspot-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [Maps CSP](maps-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [Messaging CSP](messaging-csp.md) | - |
- |
- |
- |
- |
-2 |
-2 |
-
| [NAP CSP](nap-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [NAPDEF CSP](napdef-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [NetworkProxy CSP](networkproxy-csp.md) | -2 |
-2 |
-2 |
-2 |
- |
-2 |
-2 |
-
-
| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) | - |
- |
- |
- |
- |
- |
- |
-
| [NodeCache CSP](nodecache-csp.md) | - |
-- | |
- |
- |
- |
- |
-
| [Office CSP](office-csp.md) | -2 |
-2 |
-2 |
-2 |
- |
- |
- |
-
-
| [PassportForWork CSP](passportforwork-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [Policy CSP](policy-configuration-service-provider.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [Personalization CSP](personalization-csp.md) | - |
- |
-2 |
-2 |
- |
- |
- |
-
| [PolicyManager CSP](policymanager-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [Provisioning CSP](provisioning-csp.md) | -
- (Provisioning only) |
-- |
- (Provisioning only) |
-
- (Provisioning only) |
-
- (Provisioning only) |
-
- (Provisioning only) |
-
- (Provisioning only) |
-
| [PROXY CSP](proxy-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [PXLOGICAL CSP](pxlogical-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [Reboot CSP](reboot-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [Registry CSP](registry-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [RemoteFind CSP](remotefind-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [RemoteLock](remotelock-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [RemoteRing CSP](remotering-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [RemoteWipe CSP](remotewipe-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [Reporting CSP](reporting-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [SecureAssessment CSP](secureassessment-csp.md) | -1 |
-- | 1 |
-1 |
- |
- |
- |
-
-
| [SecurityPolicy CSP](securitypolicy-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [SharedPC CSP](sharedpc-csp.md) | -1 |
-- | 1 |
-1 |
- |
- |
- |
-
-
| [Storage CSP](storage-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [SUPL CSP](supl-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [SurfaceHub](surfacehub-csp.md) | -- | - | - | - | - | - | - |
| [UnifiedWriteFilter CSP](unifiedwritefilter-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [Update CSP](update-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [VPN CSP](vpn-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [VPNv2 CSP](vpnv2-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [W4 APPLICATION CSP](w4-application-csp.md) | -- | - | - | - | - | |
-- - |
| [w7 APPLICATION CSP](w7-application-csp.md) | -- | - | - | - | - | |
-- - |
| [WiFi CSP](wifi-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [Win32AppInventory CSP](win32appinventory-csp.md) | -1 |
-- | 1 |
-1 |
- |
- |
- |
-
-
| [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) | -1 |
-- | 1 |
-1 |
- |
- |
- |
-
-
| [WindowsLicensing CSP](windowslicensing-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| [WindowsSecurityAuditing CSP](windowssecurityauditing-csp.md) | - |
-- | |
- |
- |
- |
- |
-
-
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ 1 |
+ 1 |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
| 2 |
+ 2 |
+ + | 2 |
+ 2 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
| 2 |
+ 2 |
+ + | 2 |
+ 2 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
| 2 |
+ 2 |
+ + | 2 |
+ 2 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ 2 |
+ 2 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ (Provisioning only) |
+ (Provisioning only) |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ 2 |
+ 2 |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ 2 |
+ 2 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
| (Provisioning only) |
+ (Provisioning only) |
+ + | (Provisioning only) |
+ (Provisioning only) |
+ (Provisioning only) |
+ (Provisioning only) |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
| + | + | + | + | + | + | + |
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
| + | + | + | + | + | |
+ + |
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
| + | + | + | + | + | |
+ + |
+ + Footnotes: - 1 - Added in Windows 10, version 1607 @@ -1057,4 +2432,55 @@ Footnotes: - [RootCATrustedCertificates CSP](rootcacertificates-csp.md) - [Update CSP](update-csp.md) - [VPNv2 CSP](vpnv2-csp.md) -- [WiFi CSP](wifi-csp.md) \ No newline at end of file +- [WiFi CSP](wifi-csp.md) + +## CSPs supported in Windows 10 S + +The CSPs supported in Windows 10 S is the same as in Windows 10 Pro except that Office CSP and EnterpriseDesktop CSP are not available in Windows 10 S. Here is the list: + +- [ActiveSync CSP](activesync-csp.md) +- [APPLICATION CSP](application-csp.md) +- [AppLocker CSP](applocker-csp.md) +- [BOOTSTRAP CSP](bootstrap-csp.md) +- [CellularSettings CSP](cellularsettings-csp.md) +- [CertificateStore CSP](certificatestore-csp.md) +- [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) +- [CM_CellularEntries CSP](cm-cellularentries-csp.md) +- [Defender CSP](defender-csp.md) +- [DevDetail CSP](devdetail-csp.md) +- [DeviceManageability CSP](devicemanageability-csp.md) +- [DeviceStatus CSP](devicestatus-csp.md) +- [DevInfo CSP](devinfo-csp.md) +- [DiagnosticLog CSP](diagnosticlog-csp.md) +- [DMAcc CSP](dmacc-csp.md) +- [DMClient CSP](dmclient-csp.md) +- [EMAIL2 CSP](email2-csp.md) +- [EnterpriseAPN CSP](enterpriseapn-csp.md) +- [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) +- [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) +- [HealthAttestation CSP](healthattestation-csp.md) +- [NAP CSP](nap-csp.md) +- [NAPDEF CSP](napdef-csp.md) +- [NetworkProxy CSP](networkproxy-csp.md) +- [NodeCache CSP](nodecache-csp.md) +- [PassportForWork CSP](passportforwork-csp.md) +- [Policy CSP](policy-configuration-service-provider.md) +- [Provisioning CSP](provisioning-csp.md) +- [PROXY CSP](proxy-csp.md) +- [PXLOGICAL CSP](pxlogical-csp.md) +- [Reboot CSP](reboot-csp.md) +- [RemoteFind CSP](remotefind-csp.md) +- [RemoteWipe CSP](remotewipe-csp.md) +- [Reporting CSP](reporting-csp.md) +- [RootCATrustedCertificates CSP](rootcacertificates-csp.md) +- [SecureAssessment CSP](secureassessment-csp.md) +- [SecurityPolicy CSP](securitypolicy-csp.md) +- [SharedPC CSP](sharedpc-csp.md) +- [Storage CSP](storage-csp.md) +- [SUPL CSP](supl-csp.md) +- [Update CSP](update-csp.md) +- [VPNv2 CSP](vpnv2-csp.md) +- [WiFi CSP](wifi-csp.md) +- [Win32AppInventory CSP](win32appinventory-csp.md) +- [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) +- [WindowsLicensing CSP](windowslicensing-csp.md) diff --git a/windows/client-management/mdm/create-a-custom-configuration-service-provider.md b/windows/client-management/mdm/create-a-custom-configuration-service-provider.md index c2611732f7..1d424f8364 100644 --- a/windows/client-management/mdm/create-a-custom-configuration-service-provider.md +++ b/windows/client-management/mdm/create-a-custom-configuration-service-provider.md @@ -1,15 +1,12 @@ --- title: Create a custom configuration service provider description: Create a custom configuration service provider -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 0cb37f03-5bf2-4451-8276-23f4a1dee33f -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Create a custom configuration service provider diff --git a/windows/client-management/mdm/customdeviceui-csp.md b/windows/client-management/mdm/customdeviceui-csp.md index 383d5c9222..955159f333 100644 --- a/windows/client-management/mdm/customdeviceui-csp.md +++ b/windows/client-management/mdm/customdeviceui-csp.md @@ -1,15 +1,12 @@ --- title: CustomDeviceUI CSP description: CustomDeviceUI CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 20ED1867-7B9E-4455-B397-53B8B15C95A3 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # CustomDeviceUI CSP diff --git a/windows/client-management/mdm/customdeviceui-ddf.md b/windows/client-management/mdm/customdeviceui-ddf.md index 062cbc615c..d44a97a49e 100644 --- a/windows/client-management/mdm/customdeviceui-ddf.md +++ b/windows/client-management/mdm/customdeviceui-ddf.md @@ -1,15 +1,12 @@ --- title: CustomDeviceUI DDF description: CustomDeviceUI DDF -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: E6D6B902-C57C-48A6-9654-CCBA3898455E -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # CustomDeviceUI DDF diff --git a/windows/client-management/mdm/data-structures-windows-store-for-business.md b/windows/client-management/mdm/data-structures-windows-store-for-business.md index 0232b01dbe..18b093df38 100644 --- a/windows/client-management/mdm/data-structures-windows-store-for-business.md +++ b/windows/client-management/mdm/data-structures-windows-store-for-business.md @@ -3,16 +3,13 @@ title: Data structures for Windows Store for Business MS-HAID: - 'p\_phdevicemgmt.business\_store\_data\_structures' - 'p\_phDeviceMgmt.data\_structures\_windows\_store\_for\_business' -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: ABE44EC8-CBE5-4775-BA8A-4564CB73531B description: -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Data structures for Windows Store for Business diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 4bd4c9f828..71e91e480e 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -1,15 +1,12 @@ --- title: Defender CSP description: Defender CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 481AA74F-08B2-4A32-B95D-5A3FD05B335C -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Defender CSP diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md index 007b3ddb41..f6856761c6 100644 --- a/windows/client-management/mdm/defender-ddf.md +++ b/windows/client-management/mdm/defender-ddf.md @@ -1,15 +1,12 @@ --- title: Defender DDF file description: Defender DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 39B9E6CF-4857-4199-B3C3-EC740A439F65 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Defender DDF file diff --git a/windows/client-management/mdm/design-a-custom-windows-csp.md b/windows/client-management/mdm/design-a-custom-windows-csp.md index a774358ba9..ed969ccbee 100644 --- a/windows/client-management/mdm/design-a-custom-windows-csp.md +++ b/windows/client-management/mdm/design-a-custom-windows-csp.md @@ -4,15 +4,12 @@ description: Design a custom configuration service provider MS-HAID: - 'p\_phDeviceMgmt.designing\_a\_custom\_configuration\_service\_provider' - 'p\_phDeviceMgmt.design\_a\_custom\_windows\_csp' -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 0fff9516-a71a-4036-a57b-503ef1a81a37 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Design a custom configuration service provider diff --git a/windows/client-management/mdm/devdetail-csp.md b/windows/client-management/mdm/devdetail-csp.md index 7995dfe17d..40ee770991 100644 --- a/windows/client-management/mdm/devdetail-csp.md +++ b/windows/client-management/mdm/devdetail-csp.md @@ -1,15 +1,12 @@ --- title: DevDetail CSP description: DevDetail CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 719bbd2d-508d-439b-b175-0874c7e6c360 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DevDetail CSP diff --git a/windows/client-management/mdm/devdetail-ddf-file.md b/windows/client-management/mdm/devdetail-ddf-file.md index 44978a8d9f..e7fbbcac7a 100644 --- a/windows/client-management/mdm/devdetail-ddf-file.md +++ b/windows/client-management/mdm/devdetail-ddf-file.md @@ -1,15 +1,12 @@ --- title: DevDetail DDF file description: DevDetail DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 645fc2b5-2d2c-43b1-9058-26bedbe9f00d -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DevDetail DDF file diff --git a/windows/client-management/mdm/developersetup-csp.md b/windows/client-management/mdm/developersetup-csp.md index 2d0adc299e..1a00b5f67c 100644 --- a/windows/client-management/mdm/developersetup-csp.md +++ b/windows/client-management/mdm/developersetup-csp.md @@ -1,15 +1,12 @@ --- title: DeveloperSetup CSP description: The DeveloperSetup configuration service provider (CSP) is used to configure developer mode on the device. This CSP was added in the next major update of Windows 10. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DeveloperSetup CSP diff --git a/windows/client-management/mdm/developersetup-ddf.md b/windows/client-management/mdm/developersetup-ddf.md index b5f6b24d0a..b9a3348cca 100644 --- a/windows/client-management/mdm/developersetup-ddf.md +++ b/windows/client-management/mdm/developersetup-ddf.md @@ -1,15 +1,12 @@ --- title: DeveloperSetup DDF file description: This topic shows the OMA DM device description framework (DDF) for the DeveloperSetup configuration service provider. This CSP was added in Windows 10, version 1703. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DeveloperSetup DDF file diff --git a/windows/client-management/mdm/device-update-management.md b/windows/client-management/mdm/device-update-management.md index 4b038d4122..724d2abe69 100644 --- a/windows/client-management/mdm/device-update-management.md +++ b/windows/client-management/mdm/device-update-management.md @@ -1,15 +1,12 @@ --- title: Device update management description: In the current device landscape of PC, tablets, phones, and IoT devices, the Mobile Device Management (MDM) solutions are becoming prevalent as a lightweight device management technology. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: C27BAEE7-2890-4FB7-9549-A6EACC790777 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- diff --git a/windows/client-management/mdm/deviceinstanceservice-csp.md b/windows/client-management/mdm/deviceinstanceservice-csp.md index d79ad2c02d..55339fb966 100644 --- a/windows/client-management/mdm/deviceinstanceservice-csp.md +++ b/windows/client-management/mdm/deviceinstanceservice-csp.md @@ -1,15 +1,12 @@ --- title: DeviceInstanceService CSP description: DeviceInstanceService CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: f113b6bb-6ce1-45ad-b725-1b6610721e2d -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DeviceInstanceService CSP diff --git a/windows/client-management/mdm/devicelock-csp.md b/windows/client-management/mdm/devicelock-csp.md index 38770ab2e9..47a36d95c3 100644 --- a/windows/client-management/mdm/devicelock-csp.md +++ b/windows/client-management/mdm/devicelock-csp.md @@ -1,15 +1,12 @@ --- title: DeviceLock CSP description: DeviceLock CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 9a547efb-738e-4677-95d3-5506d350d8ab -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DeviceLock CSP diff --git a/windows/client-management/mdm/devicelock-ddf-file.md b/windows/client-management/mdm/devicelock-ddf-file.md index b5e4ffdda4..466bcbbf38 100644 --- a/windows/client-management/mdm/devicelock-ddf-file.md +++ b/windows/client-management/mdm/devicelock-ddf-file.md @@ -1,15 +1,12 @@ --- title: DeviceLock DDF file description: DeviceLock DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 46a691b9-6350-4987-bfc7-f8b1eece3ad9 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DeviceLock DDF file diff --git a/windows/client-management/mdm/devicemanageability-csp.md b/windows/client-management/mdm/devicemanageability-csp.md index 32076d5301..8adc363d59 100644 --- a/windows/client-management/mdm/devicemanageability-csp.md +++ b/windows/client-management/mdm/devicemanageability-csp.md @@ -1,15 +1,12 @@ --- title: DeviceManageability CSP description: The DeviceManageability configuration service provider (CSP) is used retrieve the general information about MDM configuration capabilities on the device. This CSP was added in Windows 10, version 1607. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: FE563221-D5B5-4EFD-9B60-44FE4066B0D2 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DeviceManageability CSP diff --git a/windows/client-management/mdm/devicemanageability-ddf.md b/windows/client-management/mdm/devicemanageability-ddf.md index e09aa33beb..1adb50855e 100644 --- a/windows/client-management/mdm/devicemanageability-ddf.md +++ b/windows/client-management/mdm/devicemanageability-ddf.md @@ -1,15 +1,12 @@ --- title: DeviceManageability DDF description: This topic shows the OMA DM device description framework (DDF) for the DeviceManageability configuration service provider. This CSP was added in Windows 10, version 1607. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: D7FA8D51-95ED-40D2-AA84-DCC4BBC393AB -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DeviceManageability DDF diff --git a/windows/client-management/mdm/devicestatus-csp.md b/windows/client-management/mdm/devicestatus-csp.md index 5402d8bf31..e89043b5c1 100644 --- a/windows/client-management/mdm/devicestatus-csp.md +++ b/windows/client-management/mdm/devicestatus-csp.md @@ -1,15 +1,12 @@ --- title: DeviceStatus CSP description: The DeviceStatus configuration service provider is used by the enterprise to keep track of device inventory and query the state of compliance of these devices with their enterprise policies. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 039B2010-9290-4A6E-B77B-B2469B482360 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DeviceStatus CSP diff --git a/windows/client-management/mdm/devicestatus-ddf.md b/windows/client-management/mdm/devicestatus-ddf.md index 54ca1a523e..b0e6ad935c 100644 --- a/windows/client-management/mdm/devicestatus-ddf.md +++ b/windows/client-management/mdm/devicestatus-ddf.md @@ -1,15 +1,12 @@ --- title: DeviceStatus DDF description: This topic shows the OMA DM device description framework (DDF) for the DeviceStatus configuration service provider. DDF files are used only with OMA DM provisioning XML. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 780DC6B4-48A5-4F74-9F2E-6E0D88902A45 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DeviceStatus DDF diff --git a/windows/client-management/mdm/devinfo-csp.md b/windows/client-management/mdm/devinfo-csp.md index 221125f2b6..b11d4a12cf 100644 --- a/windows/client-management/mdm/devinfo-csp.md +++ b/windows/client-management/mdm/devinfo-csp.md @@ -1,15 +1,12 @@ --- title: DevInfo CSP description: DevInfo CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: d3eb70db-1ce9-4c72-a13d-651137c1713c -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DevInfo CSP diff --git a/windows/client-management/mdm/devinfo-ddf-file.md b/windows/client-management/mdm/devinfo-ddf-file.md index 8e41569f6f..0ee45fd363 100644 --- a/windows/client-management/mdm/devinfo-ddf-file.md +++ b/windows/client-management/mdm/devinfo-ddf-file.md @@ -1,15 +1,12 @@ --- title: DevInfo DDF file description: DevInfo DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: beb07cc6-4133-4c0f-aa05-64db2b4a004f -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DevInfo DDF file diff --git a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md index b64b4d7e22..d4c94639bd 100644 --- a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md +++ b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md @@ -1,15 +1,12 @@ --- title: Diagnose MDM failures in Windows 10 description: To help diagnose enrollment or device management issues in Windows 10 devices managed by an MDM server, you can examine the MDM logs collected from the desktop or mobile device. The following sections describe the procedures for collecting MDM logs. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 12D8263B-D839-4B19-9346-31E0CDD0CBF9 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Diagnose MDM failures in Windows 10 diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index 9ca2099bf6..da0d026cab 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -1,15 +1,12 @@ --- title: DiagnosticLog CSP description: DiagnosticLog CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: F76E0056-3ACD-48B2-BEA1-1048C96571C3 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DiagnosticLog CSP diff --git a/windows/client-management/mdm/diagnosticlog-ddf.md b/windows/client-management/mdm/diagnosticlog-ddf.md index eac5538d83..48154f0bad 100644 --- a/windows/client-management/mdm/diagnosticlog-ddf.md +++ b/windows/client-management/mdm/diagnosticlog-ddf.md @@ -1,15 +1,12 @@ --- title: DiagnosticLog DDF description: DiagnosticLog DDF -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 9DD75EDA-5913-45B4-9BED-20E30CDEBE16 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DiagnosticLog DDF diff --git a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md index f9d18d62b9..29889b69f1 100644 --- a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md @@ -4,15 +4,12 @@ description: Disconnecting may be initiated either locally by the user from the MS-HAID: - 'p\_phdevicemgmt.disconnecting\_from\_the\_management\_infrastructure\_\_unenrollment\_' - 'p\_phDeviceMgmt.disconnecting\_from\_mdm\_unenrollment' -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 33B2B248-631B-451F-B534-5DA095C4C8E8 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- diff --git a/windows/client-management/mdm/dmacc-csp.md b/windows/client-management/mdm/dmacc-csp.md index d88c945408..df7701702a 100644 --- a/windows/client-management/mdm/dmacc-csp.md +++ b/windows/client-management/mdm/dmacc-csp.md @@ -1,15 +1,12 @@ --- title: DMAcc CSP description: DMAcc CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 43e73d8a-6617-44e7-8459-5c96f4422e63 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DMAcc CSP diff --git a/windows/client-management/mdm/dmacc-ddf-file.md b/windows/client-management/mdm/dmacc-ddf-file.md index ec803dc8cc..dbca78b881 100644 --- a/windows/client-management/mdm/dmacc-ddf-file.md +++ b/windows/client-management/mdm/dmacc-ddf-file.md @@ -1,15 +1,12 @@ --- title: DMAcc DDF file description: DMAcc DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 44dc99aa-2a85-498b-8f52-a81863765606 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DMAcc DDF file diff --git a/windows/client-management/mdm/dmclient-csp.md b/windows/client-management/mdm/dmclient-csp.md index ef09308e53..59c7ae444e 100644 --- a/windows/client-management/mdm/dmclient-csp.md +++ b/windows/client-management/mdm/dmclient-csp.md @@ -1,15 +1,12 @@ --- title: DMClient CSP description: The DMClient configuration service provider is used to specify additional enterprise-specific mobile device management configuration settings for identifying the device in the enterprise domain, security mitigation for certificate renewal, and server-triggered enterprise unenrollment. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: a5cf35d9-ced0-4087-a247-225f102f2544 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DMClient CSP diff --git a/windows/client-management/mdm/dmclient-ddf-file.md b/windows/client-management/mdm/dmclient-ddf-file.md index 1e585b2aae..85bc763412 100644 --- a/windows/client-management/mdm/dmclient-ddf-file.md +++ b/windows/client-management/mdm/dmclient-ddf-file.md @@ -1,15 +1,12 @@ --- title: DMClient DDF file description: DMClient DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: A21B33AF-DB76-4059-8170-FADF2CB898A0 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DMClient DDF file diff --git a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md index b4cb648b0b..c78e43cc7d 100644 --- a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md +++ b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md @@ -1,9 +1,6 @@ --- title: DMProcessConfigXMLFiltered function description: Configures phone settings by using OMA Client Provisioning XML. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' Search.Refinement.TopicID: 184 ms.assetid: 31D79901-6206-454C-AE78-9B85A3B3487F keywords: ["DMProcessConfigXMLFiltered function"] @@ -15,11 +12,11 @@ api_location: - dmprocessxmlfiltered.dll api_type: - DllExport -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DMProcessConfigXMLFiltered function diff --git a/windows/client-management/mdm/dmsessionactions-csp.md b/windows/client-management/mdm/dmsessionactions-csp.md index ac58e9d890..17fa2ec201 100644 --- a/windows/client-management/mdm/dmsessionactions-csp.md +++ b/windows/client-management/mdm/dmsessionactions-csp.md @@ -1,14 +1,11 @@ --- title: DMSessionActions CSP description: DMSessionActions CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DMSessionActions CSP diff --git a/windows/client-management/mdm/dmsessionactions-ddf.md b/windows/client-management/mdm/dmsessionactions-ddf.md index 02f826d653..1983b804cc 100644 --- a/windows/client-management/mdm/dmsessionactions-ddf.md +++ b/windows/client-management/mdm/dmsessionactions-ddf.md @@ -1,14 +1,11 @@ --- title: DMSessionActions DDF file description: DMSessionActions DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DMSessionActions DDF file diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md index 0d1719a0f7..b0a286169f 100644 --- a/windows/client-management/mdm/dynamicmanagement-csp.md +++ b/windows/client-management/mdm/dynamicmanagement-csp.md @@ -1,14 +1,11 @@ --- title: DynamicManagement CSP description: DynamicManagement CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DynamicManagement CSP diff --git a/windows/client-management/mdm/dynamicmanagement-ddf.md b/windows/client-management/mdm/dynamicmanagement-ddf.md index 85d5d0d84d..c1b15243de 100644 --- a/windows/client-management/mdm/dynamicmanagement-ddf.md +++ b/windows/client-management/mdm/dynamicmanagement-ddf.md @@ -1,15 +1,12 @@ --- title: DynamicManagement DDF file description: DynamicManagement DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 7e266db0-2fd9-4412-b428-4550f41a1738 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # DynamicManagement DDF file diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index 73dba1be35..23d7112ba0 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -1,15 +1,12 @@ --- title: EAP configuration description: The topic provides a step-by-step guide for creating an Extensible Authentication Protocol (EAP) configuration XML for the VPN profile and information about EAP certificate filtering in Windows 10. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: DD3F2292-4B4C-4430-A57F-922FED2A8FAE -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # EAP configuration diff --git a/windows/client-management/mdm/email2-csp.md b/windows/client-management/mdm/email2-csp.md index 0447cef4b7..54fe0d1273 100644 --- a/windows/client-management/mdm/email2-csp.md +++ b/windows/client-management/mdm/email2-csp.md @@ -1,15 +1,12 @@ --- title: EMAIL2 CSP description: EMAIL2 CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: bcfc9d98-bc2e-42c6-9b81-0b5bf65ce2b8 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # EMAIL2 CSP diff --git a/windows/client-management/mdm/email2-ddf-file.md b/windows/client-management/mdm/email2-ddf-file.md index c43030646c..58614e459a 100644 --- a/windows/client-management/mdm/email2-ddf-file.md +++ b/windows/client-management/mdm/email2-ddf-file.md @@ -1,15 +1,12 @@ --- title: EMAIL2 DDF file description: EMAIL2 DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 7e266db0-2fd9-4412-b428-4550f41a1738 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # EMAIL2 DDF file diff --git a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md index 3ba2111904..6fc5284a64 100644 --- a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md +++ b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md @@ -1,15 +1,12 @@ --- title: Enable offline upgrades to Windows 10 for Windows Embedded 8.1 Handheld devices description: Like any Windows devices, Windows 10 Mobile devices use Microsoft Update by default to download updates over the Internet. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: ED3DAF80-847C-462B-BDB1-486577906772 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Enable offline upgrades to Windows 10 for Windows Embedded 8.1 Handheld devices diff --git a/windows/client-management/mdm/enterprise-app-management.md b/windows/client-management/mdm/enterprise-app-management.md index 39b6750b5c..d6b71a088d 100644 --- a/windows/client-management/mdm/enterprise-app-management.md +++ b/windows/client-management/mdm/enterprise-app-management.md @@ -1,15 +1,12 @@ --- title: Enterprise app management description: This topic covers one of the key mobile device management (MDM) features in Windows 10 for managing the lifecycle of apps across all of Windows. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 225DEE61-C3E3-4F75-BC79-5068759DFE99 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Enterprise app management diff --git a/windows/client-management/mdm/enterpriseapn-csp.md b/windows/client-management/mdm/enterpriseapn-csp.md index b68a89083d..c61db977e9 100644 --- a/windows/client-management/mdm/enterpriseapn-csp.md +++ b/windows/client-management/mdm/enterpriseapn-csp.md @@ -1,15 +1,12 @@ --- title: EnterpriseAPN CSP description: The EnterpriseAPN configuration service provider is used by the enterprise to provision an APN for the Internet. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: E125F6A5-EE44-41B1-A8CC-DF295082E6B2 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # EnterpriseAPN CSP diff --git a/windows/client-management/mdm/enterpriseapn-ddf.md b/windows/client-management/mdm/enterpriseapn-ddf.md index 80ddc0cd38..8d656ebb72 100644 --- a/windows/client-management/mdm/enterpriseapn-ddf.md +++ b/windows/client-management/mdm/enterpriseapn-ddf.md @@ -1,15 +1,12 @@ --- title: EnterpriseAPN DDF description: EnterpriseAPN DDF -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: A953ADEF-4523-425F-926C-48DA62EB9E21 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # EnterpriseAPN DDF diff --git a/windows/client-management/mdm/enterpriseappmanagement-csp.md b/windows/client-management/mdm/enterpriseappmanagement-csp.md index bc20aed7de..4067c76438 100644 --- a/windows/client-management/mdm/enterpriseappmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappmanagement-csp.md @@ -1,15 +1,12 @@ --- title: EnterpriseAppManagement CSP description: EnterpriseAppManagement CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 698b8bf4-652e-474b-97e4-381031357623 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # EnterpriseAppManagement CSP diff --git a/windows/client-management/mdm/enterpriseappvmanagement-csp.md b/windows/client-management/mdm/enterpriseappvmanagement-csp.md index 18fc2e083f..17b4288eb5 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-csp.md @@ -1,14 +1,11 @@ --- title: EnterpriseAppVManagement CSP description: EnterpriseAppVManagement CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # EnterpriseAppVManagement CSP diff --git a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md index 05d5811f5b..19c14ddfc4 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md @@ -1,14 +1,11 @@ --- title: EnterpriseAppVManagement DDF file description: EnterpriseAppVManagement DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # EnterpriseAppVManagement DDF file diff --git a/windows/client-management/mdm/enterpriseassignedaccess-csp.md b/windows/client-management/mdm/enterpriseassignedaccess-csp.md index 36a8f79379..ed4d8e0a6e 100644 --- a/windows/client-management/mdm/enterpriseassignedaccess-csp.md +++ b/windows/client-management/mdm/enterpriseassignedaccess-csp.md @@ -1,15 +1,12 @@ --- title: EnterpriseAssignedAccess CSP description: EnterpriseAssignedAccess CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 5F88E567-77AA-4822-A0BC-3B31100639AA -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # EnterpriseAssignedAccess CSP @@ -19,9 +16,8 @@ The EnterpriseAssignedAccess configuration service provider allows IT administra > **Note** The EnterpriseAssignedAccess CSP is only supported in Windows 10 Mobile. - -For more information about how to interact with the lockdown XML at runtime, see [**DeviceLockdownProfile class**](https://msdn.microsoft.com/library/windows/hardware/mt186983). +To use an app to create a lockdown XML see [Use the Lockdown Designer app to create a Lockdown XML file](https://docs.microsoft.com/en-us/windows/configuration/mobile-devices/mobile-lockdown-designer). For more information about how to interact with the lockdown XML at runtime, see [**DeviceLockdownProfile class**](https://msdn.microsoft.com/library/windows/hardware/mt186983). The following diagram shows the EnterpriseAssignedAccess configuration service provider in tree format as used by both the Open Mobile Alliance (OMA) Device Management (DM) and OMA Client Provisioning. @@ -47,137 +43,103 @@ When using the AssignedAccessXml in the EnterpriseAssignedAccess CSP through an When using the AssignedAccessXml in a provisioning package using the Windows Imaging and Configuration Designer (ICD) tool, do not use escaped characters. - +Entry | Description +----------- | ------------ +ActionCenter | You can enable or disable the Action Center (formerly known as Notification Center) on the device. Set to true to enable the Action Center, or set to false to disable the Action Center. +ActionCenter | Example: `
+Application | Include PinToStart to display an app on the Start screen. For apps pinned to the Start screen, identify a tile size (small, medium, or large), and a location. The size of a small tile is 1 column x 1 row, a medium tile is 2 x 2, and a large tile is 4 x 2. For the tile location, the first value indicates the column and the second value indicates the row. A value of 0 (zero) indicates the first column, a value of 1 indicates the second column, and so on. Include autoRun as an attribute to configure the application to run automatically.
+
+Application example:
+``` syntax
+| Entry | -Description | -
|---|---|
ActionCenter |
-You can enable or disable the Action Center (formerly known as Notification Center) on the device. Set to true to enable the Action Center, or set to false to disable the Action Center. -Example: -In Windows 10, when the Action Center is disabled, Above Lock notifications and toasts are also disabled. When the Action Center is enabled, the following policies are also enabled: -
For more information about these policies, see [Policy CSP](policy-configuration-service-provider.md) -You can also add the following optional attributes to the ActionCenter element to override the default behavior: -
Valid values are 0 (policy disabled), 1 (policy enabled), and -1 (not set, policy enabled). -In this example, the Action Center is enabled and both policies are disabled. -These optional attributes are independent of each other. -In this example, Action Center is enabled, the notifications policy is disabled, and the toast policy is enabled by default because it is not set. - |
-
StartScreenSize |
-Specify the size of the Start screen. In addition to 4/6 columns, you can also use 4/6/8 depending on screen resolutions. -Valid values: -
If you have existing lockdown XML, you must update it if your device has >=400epx on its short axis so that tiles on Start can fill all 8 columns if you want to use all 8 columns instead of 6, or use 6 columns instead of 4. -Example: - |
-
Application |
-Provide the product ID for each app that will be available on the device. -You can find the product ID for a locally developed app in the AppManifest.xml file of the app. For the list of product ID and AUMID see [ProductIDs in Windows 10 Mobile](#productid). -To turn on the notification for a Windows app, you must include the application's AUMID in the lockdown XML. However, the user can change the setting at any time from user interface. -Include PinToStart to display an app on the Start screen. For apps pinned to the Start screen, identify a tile size (small, medium, or large), and a location. The size of a small tile is 1 column x 1 row, a medium tile is 2 x 2, and a large tile is 4 x 2. -For the tile location, the first value indicates the column and the second value indicates the row. A value of 0 indicates the first column, a value of 1 indicates the second column, and so on. -Include autoRun as an attribute to configure the application to run automatically. -Example: -Multiple App Packages enable multiple apps to exist inside the same package. Since ProductIds identify packages and not applications, specifying a ProductId is not enough to distinguish between individual apps inside a multiple app package. Trying to include application from a multiple app package with just a ProductId can result in unexpected behavior. -To support pinning applications in multiple app packages, use an AUMID parameter in lockdown XML. For the list of product ID and AUMID, see [ProductIDs in Windows 10 Mobile](#productid). The following example shows how to pin both Outlook mail and Outlook calendar. - |
-
Folder |
-A folder should be contained in <Applications/> node among with other <Application/> nodes, it shares most grammar with the Application Node, folderId is mandatory, folderName is optional, which is the folder name displayed on Start. folderId is a unique unsigned integer for each folder. -For example: -An application that belongs in the folder would add an optional attribute ParentFolderId, which maps to folderId of the folder. In this case, the location of this application will be located inside the folder. - |
-
Settings |
-Settings pages -Starting in Windows 10, version 1511, you can specify the following settings pages in the lockdown XML file. -
-Important Do not specify a group entry without a page entry because it will cause an undefined behavior.
-
-
-
-
Quick action settings -Starting in Windows 10, version 1511, you can specify the following quick action settings in the lockdown XML file. The following list shows the quick action settings and settings page dependencies (group and page). -Note: Only Windows 10, versions 1511 and 1607, the dependent settings group and pages are automatically added when the quick action item is specified in the lockdown XML. This statement does not apply to Windows 10, version 1703. + +**Quick action settings** + +Starting in Windows 10, version 1511, you can specify the following quick action settings in the lockdown XML file. The following list shows the quick action settings and settings page dependencies (group and page). + +> [!Note] +> Only Windows 10, versions 1511 and 1607, the dependent settings group and pages are automatically added when the quick action item is specified in the lockdown XML. This statement does not apply to Windows 10, version 1703. +
In this example, all settings pages and quick action settings are allowed. An empty <Settings> node indicates that none of the settings are blocked. -In this example, all System setting pages are enabled. Note that the System page group is added as well as all of the System subpage names. -To remove access to all of the settings in the system, the settings application would simply not be listed in the app list for a particular role. |
-
Buttons |
-The following list identifies the hardware buttons on the device that you can lock down in ButtonLockdownList. When a user taps a button that is in the lockdown list, nothing will happen. + +In this example, all settings pages and quick action settings are allowed. An empty \
Example: -The Search and custom buttons can be remapped or configured to open a specific application. Button remapping takes effect for the device and applies to all users. -
-Note
-
-The lockdown settings for a button, per user role, will apply regardless of the button mapping. -
-
-
-
-Warning
-
-Button remapping can enable a user to open an application that is not in the Allow list. Use button lock down to prevent application access for a user role. -
-
-
-To remap a button in lockdown XML, you supply the button name, the button event (typically "press"), and the product ID for the application the button will open. -Example: -Disabling navigation buttons -To disable navigation buttons (such as Home or Back) in lockdown XML, you supply the name (for example, Start) and button event (typically "press"). -The following section contains a sample lockdown XML file that shows how to disable navigation buttons. -Example: - |
-
MenuItems |
-Use DisableMenuItems to prevent use of the context menu, which is displayed when a user presses and holds an application in the All Programs list. You can include this entry in the default profile and in any additional user role profiles that you create. -Example: -
-Important
-
-If DisableMenuItems is not included in a profile, users of that profile can uninstall apps. -
-
- |
-
Tiles |
-Turning-on tile manipulation -By default, under Assigned Access, tile manipulation is turned off (blocked) and only available if enabled in the user’s profile. -If tile manipulation is enabled in the user’s profile, they can pin/unpin, move, and resize tiles based on their preferences. When multiple people use one device and you want to enable tile manipulation for multiple users, you must enable it for each user in their user profile. -
-Important
-
-If a device is turned off then back on, the tiles reset to their predefined layout. If a device has only one profile, the only way to reset the tiles is to turn off then turn on the device. If a device has multiple profiles, the device resets the tiles to the predefined layout based on the logged-in user’s profile. -
-
-
-The following sample file contains configuration for enabling tile manipulation. -
-Note
-
-Tile manipulation is disabled when you don’t have a
-
-
-Example: - |
-
CSP Runner |
-Allows CSPs to be executed on the device per user role. You can use this to implement role specific policies, such as changing the color scheme when an admin logs on the device, or to set configurations per role. |
-
Root node for the Firewall configuration service provider.
+ +**MdmStore** +Interior node.
+Supported operation is Get.
+ +**MdmStore/Global** +Interior node.
+Supported operations are Get and Replace.
+ +**MdmStore/Global/PolicyVersionSupported** +DWORD value that contains the maximum policy version that the server host can accept. The version number is two octets in size. The lowest-order octet is the minor version; the second-to-lowest octet is the major version. This value is not merged and is always a fixed value for a particular firewall and advanced security components software build.
+Value type in integer. Supported operation is Get.
+ +**MdmStore/Global/CurrentProfiles** +DWORD value that contains a bitmask of the current enforced profiles that are maintained by the server firewall host. See FW_PROFILE_TYPE for the bitmasks that are used to identify profile types. This value is available only in the dynamic store; therefore, it is not merged and has no merge law.
+Value type in integer. Supported operation is Get.
+ +**MdmStore/Global/DisableStatefulFtp** +This value is an on/off switch. If off, the firewall performs stateful File Transfer Protocol (FTP) filtering to allow secondary connections. The value is a DWORD; 0x00000000 means off; 0x00000001 means on. The merge law for this option is to let "on" values win.
+Boolean value. Supported operations are Get and Replace.
+ +**MdmStore/Global/SaIdleTime** +This value configures the security association idle time, in seconds. Security associations are deleted after network traffic is not seen for this specified period of time. The value is a DWORD and MUST be a value in the range of 300 to 3,600 inclusive. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.<
+Value type is integer. Supported operations are Get and Replace.
+ +**MdmStore/Global/TPresharedKeyEncodingBD** +Specifies the preshared key encoding that is used. The value is a DWORD and MUST be a valid value from the PRESHARED_KEY_ENCODING_VALUES enumeration. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.
+Value type is integer. Supported operations are Get and Replace.
+ +**MdmStore/Global/IPsecExempt** +This configuration value configures IPsec exceptions. The value is a DWORD and MUST be a combination of the valid flags that are defined in IPSEC_EXEMPT_VALUES; therefore, the maximum value MUST always be IPSEC_EXEMPT_MAX-1 for servers supporting a schema version of 0x0201 and IPSEC_EXEMPT_MAX_V2_0-1 for servers supporting a schema version of 0x0200. If the maximum value is exceeded when the method RRPC_FWSetGlobalConfig (Opnum 4) is called, the method returns ERROR_INVALID_PARAMETER. This error code is returned if no other preceding error is discovered. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.
+Value type is integer. Supported operations are Get and Replace.
+ +**MdmStore/Global/CRLcheck** +This value specifies how certificate revocation list (CRL) verification is enforced. The value is a DWORD and MUST be 0, 1, or 2. A value of 0 disables CRL checking. A value of 1 specifies that CRL checking is attempted and that certificate validation fails only if the certificate is revoked. Other failures that are encountered during CRL checking (such as the revocation URL being unreachable) do not cause certificate validation to fail. A value of 2 means that checking is required and that certificate validation fails if any error is encountered during CRL processing. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.
+Value type is integer. Supported operations are Get and Replace.
+ +**MdmStore/Global/PolicyVersion** +This value contains the policy version of the policy store being managed. This value is not merged and therefore, has no merge law.
+Value type is string. Supported operation is Get.
+ +**MdmStore/Global/BinaryVersionSupported** +This value contains the binary version of the structures and data types that are supported by the server. This value is not merged. In addition, this value is always a fixed value for a specific firewall and advanced security component's software build. This value identifies a policy configuration option that is supported only on servers that have a schema version of 0x0201.
+Value type is string. Supported operation is Get.
+ +**MdmStore/Global/OpportunisticallyMatchAuthSetPerKM** +This value is a DWORD used as an on/off switch. When this option is off, keying modules MUST ignore the entire authentication set if they do not support all of the authentication suites specified in the set. When this option is on, keying modules MUST ignore only the authentication suites that they don’t support. For schema versions 0x0200, 0x0201, and 0x020A, this value is invalid and MUST NOT be used.
+Boolean value. Supported operations are Get and Replace.
+ +**MdmStore/Global/EnablePacketQueue** +This value specifies how scaling for the software on the receive side is enabled for both the encrypted receive and clear text forward path for the IPsec tunnel gateway scenario. Use of this option also ensures that the packet order is preserved. The data type for this option value is a DWORD and is a combination of flags. A value of 0x00 indicates that all queuing is to be disabled. A value of 0x01 specifies that inbound encrypted packets are to be queued. A value of 0x02 specifies that packets are to be queued after decryption is performed for forwarding.
+Value type is integer. Supported operations are Get and Replace.
+ +**MdmStore/DomainProfile** +Interior node. Supported operation is Get.
+ +**MdmStore/PrivateProfile** +Interior node. Supported operation is Get.
+ +**MdmStore/PublicProfile** +Interior node. Supported operation is Get.
+ +**/EnableFirewall** +This value is an on/off switch for the firewall and advanced security enforcement. It is a DWORD type value; 0x00000000 is off; 0x00000001 is on. If this value is off, the server MUST NOT block any network traffic, regardless of other policy settings. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.
+Value type is integer. Supported operations are Get and Replace.
+ +**/DisableStealthMode** +This value is a DWORD used as an on/off switch. When this option is off, the server operates in stealth mode. The firewall rules used to enforce stealth mode are implementation-specific. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.
+Value type is integer. Supported operations are Get and Replace.
+ +**/Shielded** +This value is a DWORD used as an on/off switch. If this value is on and EnableFirewall is on, the server MUST block all incoming traffic regardless of other policy settings. The merge law for this option is to let "on" values win.
+Value type is integer. Supported operations are Get and Replace.
+ +**/DisableUnicastResponsesToMulticastBroadcast** +This value is a DWORD used as an on/off switch. If it is on, unicast responses to multicast broadcast traffic is blocked. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.
+Value type is integer. Supported operations are Get and Replace.
+ +**/DisableInboundNotifications** +This value is a DWORD used as an on/off switch. If this value is off, the firewall MAY display a notification to the user when an application is blocked from listening on a port. If this value is on, the firewall MUST NOT display such a notification. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.
+Value type is integer. Supported operations are Get and Replace.
+ +**/AuthAppsAllowUserPrefMerge** +This value is a DWORD used as an on/off switch. If this value is off, authorized application firewall rules in the local store are ignored and not enforced. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.
+Value type is integer. Supported operations are Get and Replace.
+ +**/GlobalPortsAllowUserPrefMerge** +This value is a DWORD used as an on/off switch. If this value is off, global port firewall rules in the local store are ignored and not enforced. The setting only has meaning if it is set or enumerated in the Group Policy store or if it is enumerated from the GroupPolicyRSoPStore. The merge law for this option is to let the value GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.
+Value type is integer. Supported operations are Get and Replace.
+ +**/AllowLocalPolicyMerge** +This value is a DWORD used as an on/off switch. If this value is off, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.
+Value type is integer. Supported operations are Get and Replace.
+ +**/AllowLocalIpsecPolicyMerge** +This value is a DWORD; it is an on/off switch. If this value is off, connection security rules from the local store are ignored and not enforced, regardless of the schema version and connection security rule version. The merge law for this option is to always use the value of the GroupPolicyRSoPStore.
+Value type is integer. Supported operations are Get and Replace.
+ +**/DefaultOutboundAction** +This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.
+Value type is integer. Supported operations are Get and Replace.
+ +**/DefaultInboundAction** +This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. The merge law for this option is to let the value of the GroupPolicyRSoPStore.win if it is configured; otherwise, the local store value is used.
+Value type is integer. Supported operations are Get and Replace.
+ +**/DisableStealthModeIpsecSecuredPacketExemption** +This value is a DWORD used as an on/off switch. This option is ignored if DisableStealthMode is on. Otherwise, when this option is on, the firewall's stealth mode rules MUST NOT prevent the host computer from responding to unsolicited network traffic if that traffic is secured by IPsec. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used. For schema versions 0x0200, 0x0201, and 0x020A, this value is invalid and MUST NOT be used.
+Value type is integer. Supported operations are Get and Replace.
+ +**FirewallRules** +A list of rules controlling traffic through the Windows Firewall. Each Rule ID is OR'ed. Within each rule ID each Filter type is AND'ed.
+ +**FirewallRules/_FirewallRuleName_** +Unique alpha numeric identifier for the rule. The rule name must not include a forward slash (/).
+ +**FirewallRules/_FirewallRuleName_/App** +Rules that control connections for an app, program, or service. Specified based on the intersection of the following nodes:
+-
+
- PackageFamilyName +
- FilePath +
- FQBN +
- ServiceName +
Supported operation is Get.
+ +**FirewallRules/_FirewallRuleName_/App/PackageFamilyName** +This App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of a Windows Store application.
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
+ +**FirewallRules/_FirewallRuleName_/App/FilePath** +This App/Id value represents the full file path of the app. For example, C:\Windows\System\Notepad.exe.
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
+ +**FirewallRules/_FirewallRuleName_/App/Fqbn** +Fully Qualified Binary Name
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
+ +**FirewallRules/_FirewallRuleName_/App/ServiceName** +This is a service name used in cases when a service, not an application, is sending or receiving traffic.
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
+ +**FirewallRules/_FirewallRuleName_/Protocol** +0-255 number representing the ip protocol (TCP = 6, UDP = 17)
+Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+ +**FirewallRules/_FirewallRuleName_/LocalPortRanges** +Comma separated list of ranges. For example, 100-120,200,300-320.
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
+ +**FirewallRules/_FirewallRuleName_/RemotePortRanges** +Comma separated list of ranges, For example, 100-120,200,300-320.
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
+ +**FirewallRules/_FirewallRuleName_/LocalAddressRanges** +Comma separated list of local addresses covered by the rule. The default value is "\*". Valid tokens include:
+-
+
- "\*" indicates any local address. If present, this must be the only token included. +
- A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255. +
- A valid IPv6 address. +
- An IPv4 address range in the format of "start address - end address" with no spaces included. +
- An IPv6 address range in the format of "start address - end address" with no spaces included. +
Value type is string. Supported operations are Add, Get, Replace, and Delete.
+ +**FirewallRules/_FirewallRuleName_/RemoteAddressRanges** +List of comma separated tokens specifying the remote addresses covered by the rule. The default value is "\*". Valid tokens include:
+-
+
- "\*" indicates any remote address. If present, this must be the only token included. +
- "Defaultgateway" +
- "DHCP" +
- "DNS" +
- "WINS" +
- "Intranet" +
- "RemoteCorpNetwork" +
- "Internet" +
- "PlayToRenderers" +
- "LocalSubnet" indicates any local address on the local subnet. This token is not case-sensitive. +
- A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255. +
- A valid IPv6 address. +
- An IPv4 address range in the format of "start address - end address" with no spaces included. +
- An IPv6 address range in the format of "start address - end address" with no spaces included. +
Value type is string. Supported operations are Add, Get, Replace, and Delete.
+ +**FirewallRules/_FirewallRuleName_/Description** +Specifies the description of the rule.
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
+ +**FirewallRules/_FirewallRuleName_/Enabled** +Indicates whether the rule is enabled or disabled. If the rule must be enabled, this value must be set to true. +If not specified - a new rule is disabled by default.
+Boolean value. Supported operations are Add, Get, Replace, and Delete.
+ +**FirewallRules/_FirewallRuleName_/Action** +Specifies the action for the rule.
+Supported operation is Get.
+ +**FirewallRules/_FirewallRuleName_/Action/Type** +Specifies the action the rule enforces. Supported values:
+-
+
- 0 - Block +
- 1 - Allow +
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+ +**FirewallRules/_FirewallRuleName_/IcmpTypesAndCodes** +List of ICMP types and codes separated by semicolon. "\*" indicates all ICMP types and codes.<
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
+ +**FirewallRules/_FirewallRuleName_/LocalUserAuthorizedList** +Specifies the list of authorized local users for the app container. This is a string in Security Descriptor Definition Language (SDDL) format.
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
+ +**FirewallRules/_FirewallRuleName_/FriendlyName** +Specifies the friendly name of the rule. The string must not contain the "|" character.
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
+ +**FirewallRules/_FirewallRuleName_/Name** +Name of the rule.
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
diff --git a/windows/client-management/mdm/get-inventory.md b/windows/client-management/mdm/get-inventory.md index 8305769663..405f3c7a29 100644 --- a/windows/client-management/mdm/get-inventory.md +++ b/windows/client-management/mdm/get-inventory.md @@ -4,15 +4,12 @@ description: The Get Inventory operation retrieves information from the Windows MS-HAID: - 'p\_phdevicemgmt.get\_seatblock' - 'p\_phDeviceMgmt.get\_inventory' -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: C5485722-FC49-4358-A097-74169B204E74 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Get Inventory diff --git a/windows/client-management/mdm/get-localized-product-details.md b/windows/client-management/mdm/get-localized-product-details.md index d9ef11678f..16f29cb848 100644 --- a/windows/client-management/mdm/get-localized-product-details.md +++ b/windows/client-management/mdm/get-localized-product-details.md @@ -1,15 +1,12 @@ --- title: Get localized product details description: The Get localized product details operation retrieves the localization information of a product from the Windows Store for Business. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: EF6AFCA9-8699-46C9-A3BB-CD2750C07901 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Get localized product details diff --git a/windows/client-management/mdm/get-offline-license.md b/windows/client-management/mdm/get-offline-license.md index 8877b2cf4e..cf3a27b38c 100644 --- a/windows/client-management/mdm/get-offline-license.md +++ b/windows/client-management/mdm/get-offline-license.md @@ -1,15 +1,12 @@ --- title: Get offline license description: The Get offline license operation retrieves the offline license information of a product from the Windows Store for Business. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 08DAD813-CF4D-42D6-A783-994A03AEE051 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Get offline license diff --git a/windows/client-management/mdm/get-product-details.md b/windows/client-management/mdm/get-product-details.md index c05f6502b7..c602332f9b 100644 --- a/windows/client-management/mdm/get-product-details.md +++ b/windows/client-management/mdm/get-product-details.md @@ -1,15 +1,12 @@ --- title: Get product details description: The Get product details operation retrieves the product information from the Windows Store for Business for a specific application. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: BC432EBA-CE5E-43BD-BD54-942774767286 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Get product details diff --git a/windows/client-management/mdm/get-product-package.md b/windows/client-management/mdm/get-product-package.md index 448c3933a2..ef80b65d3b 100644 --- a/windows/client-management/mdm/get-product-package.md +++ b/windows/client-management/mdm/get-product-package.md @@ -1,15 +1,12 @@ --- title: Get product package description: The Get product package operation retrieves the information about a specific application in the Windows Store for Business. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 4314C65E-6DDC-405C-A591-D66F799A341F -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Get product package diff --git a/windows/client-management/mdm/get-product-packages.md b/windows/client-management/mdm/get-product-packages.md index 448a755ac2..24d354e7c2 100644 --- a/windows/client-management/mdm/get-product-packages.md +++ b/windows/client-management/mdm/get-product-packages.md @@ -1,15 +1,12 @@ --- title: Get product packages description: The Get product packages operation retrieves the information about applications in the Windows Store for Business. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 039468BF-B9EE-4E1C-810C-9ACDD55C0835 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Get product packages diff --git a/windows/client-management/mdm/get-seat.md b/windows/client-management/mdm/get-seat.md index 2d24e0e3ab..301be7db93 100644 --- a/windows/client-management/mdm/get-seat.md +++ b/windows/client-management/mdm/get-seat.md @@ -1,15 +1,12 @@ --- title: Get seat description: The Get seat operation retrieves the information about an active seat for a specified user in the Windows Store for Business. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 715BAEB2-79FD-4945-A57F-482F9E7D07C6 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Get seat diff --git a/windows/client-management/mdm/get-seats-assigned-to-a-user.md b/windows/client-management/mdm/get-seats-assigned-to-a-user.md index b755a4fc0f..77e13c0706 100644 --- a/windows/client-management/mdm/get-seats-assigned-to-a-user.md +++ b/windows/client-management/mdm/get-seats-assigned-to-a-user.md @@ -1,15 +1,12 @@ --- title: Get seats assigned to a user description: The Get seats assigned to a user operation retrieves information about assigned seats in the Windows Store for Business. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: CB963E44-8C7C-46F9-A979-89BBB376172B -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Get seats assigned to a user diff --git a/windows/client-management/mdm/get-seats.md b/windows/client-management/mdm/get-seats.md index ba26bb6f6b..1e5fbe93dd 100644 --- a/windows/client-management/mdm/get-seats.md +++ b/windows/client-management/mdm/get-seats.md @@ -1,15 +1,12 @@ --- title: Get seats description: The Get seats operation retrieves the information about active seats in the Windows Store for Business. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 32945788-47AC-4259-B616-F359D48F4F2F -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Get seats diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 6eb645cf52..fb44d96773 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -1,15 +1,12 @@ --- title: Device HealthAttestation CSP description: Device HealthAttestation CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 6F2D783C-F6B4-4A81-B9A2-522C4661D1AC -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Device HealthAttestation CSP diff --git a/windows/client-management/mdm/healthattestation-ddf.md b/windows/client-management/mdm/healthattestation-ddf.md index 3c50a72760..f3e857ee6f 100644 --- a/windows/client-management/mdm/healthattestation-ddf.md +++ b/windows/client-management/mdm/healthattestation-ddf.md @@ -1,15 +1,12 @@ --- title: HealthAttestation DDF description: HealthAttestation DDF -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: D20AC78D-D2D4-434B-B9FD-294BCD9D1DDE -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # HealthAttestation DDF diff --git a/windows/client-management/mdm/hotspot-csp.md b/windows/client-management/mdm/hotspot-csp.md index 905181c7ee..181c625ca6 100644 --- a/windows/client-management/mdm/hotspot-csp.md +++ b/windows/client-management/mdm/hotspot-csp.md @@ -1,15 +1,12 @@ --- title: HotSpot CSP description: HotSpot CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: ec49dec1-fa79-420a-a9a7-e86668b3eebf -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # HotSpot CSP diff --git a/windows/client-management/mdm/iconfigserviceprovider2.md b/windows/client-management/mdm/iconfigserviceprovider2.md index f241ae1aa4..be59397ff3 100644 --- a/windows/client-management/mdm/iconfigserviceprovider2.md +++ b/windows/client-management/mdm/iconfigserviceprovider2.md @@ -1,15 +1,12 @@ --- title: IConfigServiceProvider2 description: IConfigServiceProvider2 -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 8deec0fb-59a6-4d08-8ddb-6d0d3d868a10 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # IConfigServiceProvider2 diff --git a/windows/client-management/mdm/iconfigserviceprovider2configmanagernotification.md b/windows/client-management/mdm/iconfigserviceprovider2configmanagernotification.md index eed45454d3..2d72418a32 100644 --- a/windows/client-management/mdm/iconfigserviceprovider2configmanagernotification.md +++ b/windows/client-management/mdm/iconfigserviceprovider2configmanagernotification.md @@ -1,15 +1,12 @@ --- title: IConfigServiceProvider2 ConfigManagerNotification description: IConfigServiceProvider2 ConfigManagerNotification -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: b1f0fe0f-afbe-4b36-a75d-34239a86a75c -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # IConfigServiceProvider2::ConfigManagerNotification diff --git a/windows/client-management/mdm/iconfigserviceprovider2getnode.md b/windows/client-management/mdm/iconfigserviceprovider2getnode.md index 8ad2ca892a..d9efa4d469 100644 --- a/windows/client-management/mdm/iconfigserviceprovider2getnode.md +++ b/windows/client-management/mdm/iconfigserviceprovider2getnode.md @@ -1,15 +1,12 @@ --- title: IConfigServiceProvider2 GetNode description: IConfigServiceProvider2 GetNode -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 4dc10a59-f6a2-45c0-927c-d594afc9bb91 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # IConfigServiceProvider2::GetNode diff --git a/windows/client-management/mdm/icspnode.md b/windows/client-management/mdm/icspnode.md index e5155263e0..5da7ad4b29 100644 --- a/windows/client-management/mdm/icspnode.md +++ b/windows/client-management/mdm/icspnode.md @@ -1,15 +1,12 @@ --- title: ICSPNode description: ICSPNode -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 023466e6-a8ab-48ad-8548-291409686ac2 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ICSPNode diff --git a/windows/client-management/mdm/icspnodeadd.md b/windows/client-management/mdm/icspnodeadd.md index 97a7e667cc..20be80123e 100644 --- a/windows/client-management/mdm/icspnodeadd.md +++ b/windows/client-management/mdm/icspnodeadd.md @@ -1,15 +1,12 @@ --- title: ICSPNode Add description: ICSPNode Add -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 5f03d350-c82b-4747-975f-385fd8b5b3a8 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ICSPNode::Add diff --git a/windows/client-management/mdm/icspnodeclear.md b/windows/client-management/mdm/icspnodeclear.md index 213e75a31a..5c0f660fa3 100644 --- a/windows/client-management/mdm/icspnodeclear.md +++ b/windows/client-management/mdm/icspnodeclear.md @@ -1,15 +1,12 @@ --- title: ICSPNode Clear description: ICSPNode Clear -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: b414498b-110a-472d-95c0-2d5b38cd78a6 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- diff --git a/windows/client-management/mdm/icspnodecopy.md b/windows/client-management/mdm/icspnodecopy.md index b5008ab367..cf113766b6 100644 --- a/windows/client-management/mdm/icspnodecopy.md +++ b/windows/client-management/mdm/icspnodecopy.md @@ -1,15 +1,12 @@ --- title: ICSPNode Copy description: ICSPNode Copy -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: cd5ce0bc-a08b-4f82-802d-c7ff8701b41f -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ICSPNode::Copy diff --git a/windows/client-management/mdm/icspnodedeletechild.md b/windows/client-management/mdm/icspnodedeletechild.md index 158c31361e..686df037ea 100644 --- a/windows/client-management/mdm/icspnodedeletechild.md +++ b/windows/client-management/mdm/icspnodedeletechild.md @@ -1,15 +1,12 @@ --- title: ICSPNode DeleteChild description: ICSPNode DeleteChild -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 8cf3663d-a4cf-4d11-b03a-f1d096ad7f9c -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ICSPNode::DeleteChild diff --git a/windows/client-management/mdm/icspnodedeleteproperty.md b/windows/client-management/mdm/icspnodedeleteproperty.md index 2280c6e984..74126c9679 100644 --- a/windows/client-management/mdm/icspnodedeleteproperty.md +++ b/windows/client-management/mdm/icspnodedeleteproperty.md @@ -1,15 +1,12 @@ --- title: ICSPNode DeleteProperty description: ICSPNode DeleteProperty -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 7e21851f-d663-4558-b3e8-590d24b4f6c4 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ICSPNode::DeleteProperty diff --git a/windows/client-management/mdm/icspnodeexecute.md b/windows/client-management/mdm/icspnodeexecute.md index 97a0b3f76b..ef2c4dfa1a 100644 --- a/windows/client-management/mdm/icspnodeexecute.md +++ b/windows/client-management/mdm/icspnodeexecute.md @@ -1,15 +1,12 @@ --- title: ICSPNode Execute description: ICSPNode Execute -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 5916e7b7-256d-49fd-82b6-db0547a215ec -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ICSPNode::Execute diff --git a/windows/client-management/mdm/icspnodegetchildnodenames.md b/windows/client-management/mdm/icspnodegetchildnodenames.md index 420ed62d10..aa63ca5b8e 100644 --- a/windows/client-management/mdm/icspnodegetchildnodenames.md +++ b/windows/client-management/mdm/icspnodegetchildnodenames.md @@ -1,15 +1,12 @@ --- title: ICSPNode GetChildNodeNames description: ICSPNode GetChildNodeNames -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: dc057f2b-282b-49ac-91c4-bb83bd3ca4dc -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ICSPNode::GetChildNodeNames diff --git a/windows/client-management/mdm/icspnodegetproperty.md b/windows/client-management/mdm/icspnodegetproperty.md index 8d4a28d933..673d9e8e15 100644 --- a/windows/client-management/mdm/icspnodegetproperty.md +++ b/windows/client-management/mdm/icspnodegetproperty.md @@ -1,15 +1,12 @@ --- title: ICSPNode GetProperty description: ICSPNode GetProperty -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: a2bdc158-72e0-4cdb-97ce-f5cf1a44b7db -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ICSPNode::GetProperty diff --git a/windows/client-management/mdm/icspnodegetpropertyidentifiers.md b/windows/client-management/mdm/icspnodegetpropertyidentifiers.md index a4624bfac7..55fabbe552 100644 --- a/windows/client-management/mdm/icspnodegetpropertyidentifiers.md +++ b/windows/client-management/mdm/icspnodegetpropertyidentifiers.md @@ -1,15 +1,12 @@ --- title: ICSPNode GetPropertyIdentifiers description: ICSPNode GetPropertyIdentifiers -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 8a052cd3-d74c-40c4-845f-f804b920deb4 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ICSPNode::GetPropertyIdentifiers diff --git a/windows/client-management/mdm/icspnodegetvalue.md b/windows/client-management/mdm/icspnodegetvalue.md index 95d95c5813..fe58b75211 100644 --- a/windows/client-management/mdm/icspnodegetvalue.md +++ b/windows/client-management/mdm/icspnodegetvalue.md @@ -1,15 +1,12 @@ --- title: ICSPNode GetValue description: ICSPNode GetValue -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: c684036d-98be-4659-8ce8-f72436a39b90 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ICSPNode::GetValue diff --git a/windows/client-management/mdm/icspnodemove.md b/windows/client-management/mdm/icspnodemove.md index b106a7cb80..53c5047934 100644 --- a/windows/client-management/mdm/icspnodemove.md +++ b/windows/client-management/mdm/icspnodemove.md @@ -1,15 +1,12 @@ --- title: ICSPNode Move description: ICSPNode Move -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: efb359c3-5c86-4975-bf6f-a1c33922442a -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ICSPNode::Move diff --git a/windows/client-management/mdm/icspnodesetproperty.md b/windows/client-management/mdm/icspnodesetproperty.md index 7805bd3a38..daae584a37 100644 --- a/windows/client-management/mdm/icspnodesetproperty.md +++ b/windows/client-management/mdm/icspnodesetproperty.md @@ -1,15 +1,12 @@ --- title: ICSPNode SetProperty description: ICSPNode SetProperty -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: e235c38f-ea04-4cd8-adec-3c6c0ce7172d -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ICSPNode::SetProperty diff --git a/windows/client-management/mdm/icspnodesetvalue.md b/windows/client-management/mdm/icspnodesetvalue.md index cc4c4dcf3f..ccb5ff6c76 100644 --- a/windows/client-management/mdm/icspnodesetvalue.md +++ b/windows/client-management/mdm/icspnodesetvalue.md @@ -1,15 +1,12 @@ --- title: ICSPNode SetValue description: ICSPNode SetValue -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: b218636d-fe8b-4a0f-b4e8-a621f65619d3 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ICSPNode::SetValue diff --git a/windows/client-management/mdm/icspnodetransactioning.md b/windows/client-management/mdm/icspnodetransactioning.md index 34e1557544..536708cb7d 100644 --- a/windows/client-management/mdm/icspnodetransactioning.md +++ b/windows/client-management/mdm/icspnodetransactioning.md @@ -1,15 +1,12 @@ --- title: ICSPNodeTransactioning description: ICSPNodeTransactioning -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 24dc518a-4a8d-41fe-9bc6-217bbbdf6a3f -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ICSPNodeTransactioning diff --git a/windows/client-management/mdm/icspvalidate.md b/windows/client-management/mdm/icspvalidate.md index db4a3ea48f..42828da848 100644 --- a/windows/client-management/mdm/icspvalidate.md +++ b/windows/client-management/mdm/icspvalidate.md @@ -1,15 +1,12 @@ --- title: ICSPValidate description: ICSPValidate -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: b0993f2d-6269-412f-a329-af25fff34ca2 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ICSPValidate diff --git a/windows/client-management/mdm/images/provisioning-csp-firewall.png b/windows/client-management/mdm/images/provisioning-csp-firewall.png new file mode 100644 index 0000000000..a2cb0ecde8 Binary files /dev/null and b/windows/client-management/mdm/images/provisioning-csp-firewall.png differ diff --git a/windows/client-management/mdm/implement-server-side-mobile-application-management.md b/windows/client-management/mdm/implement-server-side-mobile-application-management.md index 360eca3308..904aabcc23 100644 --- a/windows/client-management/mdm/implement-server-side-mobile-application-management.md +++ b/windows/client-management/mdm/implement-server-side-mobile-application-management.md @@ -1,14 +1,11 @@ --- title: Implement server-side support for mobile application management on Windows description: The Windows version of mobile application management (MAM) is a lightweight solution for managing company data access and security on personal devices. MAM support is built into Windows on top of Windows Information Protection (WIP). -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- diff --git a/windows/client-management/mdm/index.md b/windows/client-management/mdm/index.md index 6c42d88644..70a844c704 100644 --- a/windows/client-management/mdm/index.md +++ b/windows/client-management/mdm/index.md @@ -4,15 +4,12 @@ description: Windows 10 provides an enterprise management solution to help IT p MS-HAID: - 'p\_phDeviceMgmt.provisioning\_and\_device\_management' - 'p\_phDeviceMgmt.mobile\_device\_management\_windows\_mdm' -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 50ac90a7-713e-4487-9cb9-b6d6fdaa4e5b -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Mobile device management diff --git a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md index eef8e355a3..98510df8a0 100644 --- a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md +++ b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md @@ -4,15 +4,12 @@ description: The Windows Store for Business has a new web service designed for t MS-HAID: - 'p\_phdevicemgmt.business\_store\_portal\_management\_tool' - 'p\_phDeviceMgmt.management\_tool\_for\_windows\_store\_for\_business' -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 0E39AE85-1703-4B24-9A7F-831C6455068F -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Management tool for the Windows Store for Business diff --git a/windows/client-management/mdm/maps-csp.md b/windows/client-management/mdm/maps-csp.md index dfe6a73a3b..7a5f26f5ef 100644 --- a/windows/client-management/mdm/maps-csp.md +++ b/windows/client-management/mdm/maps-csp.md @@ -1,15 +1,12 @@ --- title: Maps CSP description: The Maps configuration service provider (CSP) is used to configure the maps to download to the device. This CSP was added in Windows 10, version 1511. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: E5157296-7C31-4B08-8877-15304C9F6F26 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Maps CSP diff --git a/windows/client-management/mdm/maps-ddf-file.md b/windows/client-management/mdm/maps-ddf-file.md index b4b0100012..e91dbca47e 100644 --- a/windows/client-management/mdm/maps-ddf-file.md +++ b/windows/client-management/mdm/maps-ddf-file.md @@ -1,15 +1,12 @@ --- title: Maps DDF file description: This topic shows the OMA DM device description framework (DDF) for the Maps configuration service provider. This CSP was added in Windows 10, version 1511. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: EF22DBB6-0578-4FD0-B8A6-19DC03288FAF -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Maps DDF file diff --git a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md index 26b3ed04f0..c2896dd7cd 100644 --- a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md @@ -4,15 +4,12 @@ description: MDM enrollment of Windows-based devices MS-HAID: - 'p\_phdevicemgmt.enrollment\_ui' - 'p\_phDeviceMgmt.mdm\_enrollment\_of\_windows\_devices' -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 4651C81B-D2D6-446A-AA24-04D01C1D0883 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # MDM enrollment of Windows-based devices diff --git a/windows/client-management/mdm/messaging-csp.md b/windows/client-management/mdm/messaging-csp.md index 1d14736623..25454c6580 100644 --- a/windows/client-management/mdm/messaging-csp.md +++ b/windows/client-management/mdm/messaging-csp.md @@ -1,14 +1,11 @@ --- title: Messaging CSP description: Messaging CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Messaging CSP diff --git a/windows/client-management/mdm/messaging-ddf.md b/windows/client-management/mdm/messaging-ddf.md index 87fbd0072f..8a3d8d7e7d 100644 --- a/windows/client-management/mdm/messaging-ddf.md +++ b/windows/client-management/mdm/messaging-ddf.md @@ -1,14 +1,11 @@ --- title: Messaging DDF file description: Messaging DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Messaging DDF file diff --git a/windows/client-management/mdm/mobile-device-enrollment.md b/windows/client-management/mdm/mobile-device-enrollment.md index 9192197a28..e0a4d74fa3 100644 --- a/windows/client-management/mdm/mobile-device-enrollment.md +++ b/windows/client-management/mdm/mobile-device-enrollment.md @@ -1,15 +1,12 @@ --- title: Mobile device enrollment description: Mobile device enrollment is the first phase of enterprise management. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 08C8B3DB-3263-414B-A368-F47B94F47A11 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Mobile device enrollment diff --git a/windows/client-management/mdm/nap-csp.md b/windows/client-management/mdm/nap-csp.md index b4660ca511..d62bf09a6c 100644 --- a/windows/client-management/mdm/nap-csp.md +++ b/windows/client-management/mdm/nap-csp.md @@ -1,15 +1,12 @@ --- title: NAP CSP description: NAP CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 82f04492-88a6-4afd-af10-a62b8d444d21 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # NAP CSP diff --git a/windows/client-management/mdm/napdef-csp.md b/windows/client-management/mdm/napdef-csp.md index 8df98c23fd..0019bd057b 100644 --- a/windows/client-management/mdm/napdef-csp.md +++ b/windows/client-management/mdm/napdef-csp.md @@ -1,15 +1,12 @@ --- title: NAPDEF CSP description: NAPDEF CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 9bcc65dd-a72b-4f90-aba7-4066daa06988 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # NAPDEF CSP diff --git a/windows/client-management/mdm/networkproxy-csp.md b/windows/client-management/mdm/networkproxy-csp.md index 17bfecb9bd..2e9efd2de6 100644 --- a/windows/client-management/mdm/networkproxy-csp.md +++ b/windows/client-management/mdm/networkproxy-csp.md @@ -1,14 +1,11 @@ --- title: NetworkProxy CSP description: NetworkProxy CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # NetworkProxy CSP diff --git a/windows/client-management/mdm/networkproxy-ddf.md b/windows/client-management/mdm/networkproxy-ddf.md index 47e68fe01b..6657bc67ee 100644 --- a/windows/client-management/mdm/networkproxy-ddf.md +++ b/windows/client-management/mdm/networkproxy-ddf.md @@ -1,14 +1,11 @@ --- title: NetworkProxy DDF file description: AppNetworkProxyLocker DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # NetworkProxy DDF file diff --git a/windows/client-management/mdm/networkqospolicy-csp.md b/windows/client-management/mdm/networkqospolicy-csp.md index 99983160de..eb09ca2909 100644 --- a/windows/client-management/mdm/networkqospolicy-csp.md +++ b/windows/client-management/mdm/networkqospolicy-csp.md @@ -1,14 +1,11 @@ --- title: NetworkQoSPolicy CSP description: he NetworkQoSPolicy CSP applies the Quality of Service (QoS) policy for Microsoft Surface Hub. This CSP was added in Windows 10, version 1703. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # NetworkQoSPolicy CSP diff --git a/windows/client-management/mdm/networkqospolicy-ddf.md b/windows/client-management/mdm/networkqospolicy-ddf.md index a8a04b9de5..e22f1a5ac3 100644 --- a/windows/client-management/mdm/networkqospolicy-ddf.md +++ b/windows/client-management/mdm/networkqospolicy-ddf.md @@ -1,15 +1,12 @@ --- title: NetworkQoSPolicy DDF description: This topic shows the OMA DM device description framework (DDF) for the NetworkQoSPolicy configuration service provider. DDF files are used only with OMA DM provisioning XML. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # NetworkQoSPolicy DDF diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 4bb5eecbe0..f0f271a8e3 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -4,15 +4,12 @@ description: This topic provides information about what's new and breaking chang MS-HAID: - 'p\_phdevicemgmt.mdm\_enrollment\_and\_management\_overview' - 'p\_phDeviceMgmt.new\_in\_windows\_mdm\_enrollment\_management' -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 9C42064F-091C-4901-BC73-9ABE79EE4224 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # What's new in MDM enrollment and management @@ -883,6 +880,14 @@ For details about Microsoft mobile device management protocols for Windows 10 sUpdated the following topics to indicate MDM support in Windows 10 S.
+-
+
- [Configuration service provider reference](configuration-service-provider-reference.md) +
- [Policy CSP](policy-configuration-service-provider.md) +
Added following deep link parameters to the table:
-
@@ -1223,6 +1228,18 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
- Ownership
Added new CSP in the next major update to Windows 10.
+Updated the following topics to indicate MDM support in Windows 10 S.
+-
+
- [Configuration service provider reference](configuration-service-provider-reference.md) +
- [Policy CSP](policy-configuration-service-provider.md) +
| MDM CSP setting path/name | -GP english name | -GP english category path | -GP name | -GP ADMX file name | -
|---|---|---|---|---|
| ActiveXControls/ApprovedInstallationSites | -Approved Installation Sites for ActiveX Controls | -Windows Components/ActiveX Installer Service | -ApprovedActiveXInstallSites | -ActiveXInstallService.admx | -
| AppVirtualization/AllowAppVClient | -Enable App-V Client | -System/App-V | -EnableAppV | -appv.admx | -
| AppVirtualization/AllowDynamicVirtualization | -Enable Dynamic Virtualization | -System/App-V/Virtualization | -Virtualization_JITVEnable | -appv.admx | -
| AppVirtualization/AllowPackageCleanup | -Enable automatic cleanup of unused appv packages | -System/App-V/Package Management | -PackageManagement_AutoCleanupEnable | -appv.admx | -
| AppVirtualization/AllowPackageScripts | -Enable Package Scripts | -System/App-V/Scripting | -Scripting_Enable_Package_Scripts | -appv.admx | -
| AppVirtualization/AllowPublishingRefreshUX | -Enable Publishing Refresh UX | -System/App-V/Publishing | -Enable_Publishing_Refresh_UX | -appv.admx | -
| AppVirtualization/AllowReportingServer | -Reporting Server | -System/App-V/Reporting | -Reporting_Server_Policy | -appv.admx | -
| AppVirtualization/AllowRoamingFileExclusions | -Roaming File Exclusions | -System/App-V/Integration | -Integration_Roaming_File_Exclusions | -appv.admx | -
| AppVirtualization/AllowRoamingRegistryExclusions | -Roaming Registry Exclusions | -System/App-V/Integration | -Integration_Roaming_Registry_Exclusions | -appv.admx | -
| AppVirtualization/AllowStreamingAutoload | -Specify what to load in background (aka AutoLoad) | -System/App-V/Streaming | -Steaming_Autoload | -appv.admx | -
| AppVirtualization/ClientCoexistenceAllowMigrationmode | -Enable Migration Mode | -System/App-V/Client Coexistence | -Client_Coexistence_Enable_Migration_mode | -appv.admx | -
| AppVirtualization/IntegrationAllowRootGlobal | -Integration Root User | -System/App-V/Integration | -Integration_Root_User | -appv.admx | -
| AppVirtualization/IntegrationAllowRootUser | -Integration Root Global | -System/App-V/Integration | -Integration_Root_Global | -appv.admx | -
| AppVirtualization/PublishingAllowServer1 | -Publishing Server 1 Settings | -System/App-V/Publishing | -Publishing_Server1_Policy | -appv.admx | -
| AppVirtualization/PublishingAllowServer2 | -Publishing Server 2 Settings | -System/App-V/Publishing | -Publishing_Server2_Policy | -appv.admx | -
| AppVirtualization/PublishingAllowServer3 | -Publishing Server 3 Settings | -System/App-V/Publishing | -Publishing_Server3_Policy | -appv.admx | -
| AppVirtualization/PublishingAllowServer4 | -Publishing Server 4 Settings | -System/App-V/Publishing | -Publishing_Server4_Policy | -appv.admx | -
| AppVirtualization/PublishingAllowServer5 | -Publishing Server 5 Settings | -System/App-V/Publishing | -Publishing_Server5_Policy | -appv.admx | -
| AppVirtualization/StreamingAllowCertificateFilterForClient_SSL | -Certificate Filter For Client SSL | -System/App-V/Streaming | -Streaming_Certificate_Filter_For_Client_SSL | -appv.admx | -
| AppVirtualization/StreamingAllowHighCostLaunch | -Allow First Time Application Launches if on a High Cost Windows 8 Metered Connection | -System/App-V/Streaming | -Streaming_Allow_High_Cost_Launch | -appv.admx | -
| AppVirtualization/StreamingAllowLocationProvider | -Location Provider | -System/App-V/Streaming | -Streaming_Location_Provider | -appv.admx | -
| AppVirtualization/StreamingAllowPackageInstallationRoot | -Package Installation Root | -System/App-V/Streaming | -Streaming_Package_Installation_Root | -appv.admx | -
| AppVirtualization/StreamingAllowPackageSourceRoot | -Package Source Root | -System/App-V/Streaming | -Streaming_Package_Source_Root | -appv.admx | -
| AppVirtualization/StreamingAllowReestablishmentInterval | -Reestablishment Interval | -System/App-V/Streaming | -Streaming_Reestablishment_Interval | -appv.admx | -
| AppVirtualization/StreamingAllowReestablishmentRetries | -Reestablishment Retries | -System/App-V/Streaming | -Streaming_Reestablishment_Retries | -appv.admx | -
| AppVirtualization/StreamingSharedContentStoreMode | -Shared Content Store (SCS) mode | -System/App-V/Streaming | -Streaming_Shared_Content_Store_Mode | -appv.admx | -
| AppVirtualization/StreamingSupportBranchCache | -Enable Support for BranchCache | -System/App-V/Streaming | -Streaming_Support_Branch_Cache | -appv.admx | -
| AppVirtualization/StreamingVerifyCertificateRevocationList | -Verify certificate revocation list | -System/App-V/Streaming | -Streaming_Verify_Certificate_Revocation_List | -appv.admx | -
| AppVirtualization/VirtualComponentsAllowList | -Virtual Component Process Allow List | -System/App-V/Virtualization | -Virtualization_JITVAllowList | -appv.admx | -
| AttachmentManager/DoNotPreserveZoneInformation | -Do not preserve zone information in file attachments | -Windows Components/Attachment Manager | -AM_MarkZoneOnSavedAtttachments | -AttachmentManager.admx | -
| AttachmentManager/HideZoneInfoMechanism | -Hide mechanisms to remove zone information | -Windows Components/Attachment Manager | -AM_RemoveZoneInfo | -AttachmentManager.admx | -
| AttachmentManager/NotifyAntivirusPrograms | -Notify antivirus programs when opening attachments | -Windows Components/Attachment Manager | -AM_CallIOfficeAntiVirus | -AttachmentManager.admx | -
| Autoplay/DisallowAutoplayForNonVolumeDevices | -Disallow Autoplay for non-volume devices | -Windows Components/AutoPlay Policies | -NoAutoplayfornonVolume | -AutoPlay.admx | -
| Autoplay/SetDefaultAutoRunBehavior | -Set the default behavior for AutoRun | -Windows Components/AutoPlay Policies | -NoAutorun | -AutoPlay.admx | -
| Autoplay/TurnOffAutoPlay | -Turn off Autoplay | -Windows Components/AutoPlay Policies | -Autorun | -AutoPlay.admx | -
| Connectivity/HardenedUNCPaths | -Hardened UNC Paths | -Network/Network Provider | -Pol_HardenedPaths | -networkprovider.admx | -
| CredentialProviders/AllowPINLogon | -Turn on convenience PIN sign-in | -System/Logon | -AllowDomainPINLogon | -credentialproviders.admx | -
| CredentialProviders/BlockPicturePassword | -Turn off picture password sign-in | -System/Logon | -BlockDomainPicturePassword | -credentialproviders.admx | -
| CredentialsUI/DisablePasswordReveal | -Do not display the password reveal button | -Windows Components/Credential User Interface | -DisablePasswordReveal | -credui.admx | -
| CredentialsUI/EnumerateAdministrators | -Enumerate administrator accounts on elevation | -Windows Components/Credential User Interface | -EnumerateAdministrators | -credui.admx | -
| DataUsage/SetCost3G | -Set 3G Cost | -Network/WWAN Service/WWAN Media Cost | -SetCost3G | -wwansvc.admx | -
| DataUsage/SetCost4G | -Set 4G Cost | -Network/WWAN Service/WWAN Media Cost | -SetCost4G | -wwansvc.admx | -
| Desktop/PreventUserRedirectionOfProfileFolders | -- | - | - | desktop.admx | -
| DeviceInstallation/PreventInstallationOfMatchingDeviceIDs | -Prevent installation of devices that match any of these device IDs | -System/Device Installation/Device Installation Restrictions | -DeviceInstall_IDs_Deny | -deviceinstallation.admx | -
| DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses | -Prevent installation of devices using drivers that match these device setup classes | -System/Device Installation/Device Installation Restrictions | -DeviceInstall_Classes_Deny | -deviceinstallation.admx | -
| DeviceLock/PreventLockScreenSlideShow | -- | - | - | ControlPanelDisplay.admx | -
| ErrorReporting/CustomizeConsentSettings | -Customize consent settings | -Windows Components/Windows Error Reporting/Consent | -WerConsentCustomize_2 | -ErrorReporting.admx | -
| ErrorReporting/DisableWindowsErrorReporting | -Disable Windows Error Reporting | -Windows Components/Windows Error Reporting | -WerDisable_2 | -ErrorReporting.admx | -
| ErrorReporting/DisplayErrorNotification | -Display Error Notification | -Windows Components/Windows Error Reporting | -PCH_ShowUI | -ErrorReporting.admx | -
| ErrorReporting/DoNotSendAdditionalData | -Do not send additional data | -Windows Components/Windows Error Reporting | -WerNoSecondLevelData_2 | -ErrorReporting.admx | -
| ErrorReporting/PreventCriticalErrorDisplay | -Prevent display of the user interface for critical errors | -Windows Components/Windows Error Reporting | -WerDoNotShowUI | -ErrorReporting.admx | -
| EventLogService/ControlEventLogBehavior | -Control Event Log behavior when the log file reaches its maximum size | -Windows Components/Event Log Service/Application | -Channel_Log_Retention_1 | -eventlog.admx | -
| EventLogService/SpecifyMaximumFileSizeApplicationLog | -Specify the maximum log file size (KB) | -Windows Components/Event Log Service/Application | -Channel_LogMaxSize_1 | -eventlog.admx | -
| EventLogService/SpecifyMaximumFileSizeSecurityLog | -Specify the maximum log file size (KB) | -Windows Components/Event Log Service/Security | -Channel_LogMaxSize_2 | -eventlog.admx | -
| EventLogService/SpecifyMaximumFileSizeSystemLog | -Specify the maximum log file size (KB) | -Windows Components/Event Log Service/System | -Channel_LogMaxSize_4 | -eventlog.admx | -
| InternetExplorer/AddSearchProvider | -Add a specific list of search providers to the user's list of search providers | -Windows Components/Internet Explorer | -AddSearchProvider | -inetres.admx | -
| InternetExplorer/AllowActiveXFiltering | -Turn on ActiveX Filtering | -Windows Components/Internet Explorer | -TurnOnActiveXFiltering | -inetres.admx | -
| InternetExplorer/AllowAddOnList | -Add-on List | -Windows Components/Internet Explorer/Security Features/Add-on Management | -AddonManagement_AddOnList | -inetres.admx | -
| InternetExplorer/AllowEnhancedProtectedMode | -Turn on Enhanced Protected Mode | -Windows Components/Internet Explorer/Internet Control Panel/Advanced Page | -Advanced_EnableEnhancedProtectedMode | -inetres.admx | -
| InternetExplorer/AllowEnterpriseModeFromToolsMenu | -Let users turn on and use Enterprise Mode from the Tools menu | -Windows Components/Internet Explorer | -EnterpriseModeEnable | -inetres.admx | -
| InternetExplorer/AllowEnterpriseModeSiteList | -Use the Enterprise Mode IE website list | -Windows Components/Internet Explorer | -EnterpriseModeSiteList | -inetres.admx | -
| InternetExplorer/AllowInternetExplorer7PolicyList | -Use Policy List of Internet Explorer 7 sites | -CompatView_UsePolicyList | -inetres.admx | -|
| InternetExplorer/AllowInternetExplorerStandardsMode | -Turn on Internet Explorer Standards Mode for local intranet | -Windows Components/Internet Explorer/Compatibility View | -CompatView_IntranetSites | -inetres.admx | -
| InternetExplorer/AllowInternetZoneTemplate | -Internet Zone Template | -Windows Components/Internet Explorer/Internet Control Panel/Security Page | -IZ_PolicyInternetZoneTemplate | -inetres.admx | -
| InternetExplorer/AllowIntranetZoneTemplate | -Intranet Zone Template | -Windows Components/Internet Explorer/Internet Control Panel/Security Page | -IZ_PolicyIntranetZoneTemplate | -inetres.admx | -
| InternetExplorer/AllowLocalMachineZoneTemplate | -Local Machine Zone Template | -Windows Components/Internet Explorer/Internet Control Panel/Security Page | -IZ_PolicyLocalMachineZoneTemplate | -inetres.admx | -
| InternetExplorer/AllowLockedDownInternetZoneTemplate | -Locked-Down Internet Zone Template | -Windows Components/Internet Explorer/Internet Control Panel/Security Page | -IZ_PolicyInternetZoneLockdownTemplate | -inetres.admx | -
| InternetExplorer/AllowLockedDownIntranetZoneTemplate | -Locked-Down Intranet Zone Template | -Windows Components/Internet Explorer/Internet Control Panel/Security Page | -IZ_PolicyIntranetZoneLockdownTemplate | -inetres.admx | -
| InternetExplorer/AllowLockedDownLocalMachineZoneTemplate | -Locked-Down Local Machine Zone Template | -Windows Components/Internet Explorer/Internet Control Panel/Security Page | -IZ_PolicyLocalMachineZoneLockdownTemplate | -inetres.admx | -
| InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate | -Locked-Down Restricted Sites Zone Template | -Windows Components/Internet Explorer/Internet Control Panel/Security Page | -IZ_PolicyRestrictedSitesZoneLockdownTemplate | -inetres.admx | -
| InternetExplorer/AllowOneWordEntry | -Go to an intranet site for a one-word entry in the Address bar | -Windows Components/Internet Explorer/Internet Settings/Advanced settings/Browsing | -UseIntranetSiteForOneWordEntry | -inetres.admx | -
| InternetExplorer/AllowSiteToZoneAssignmentList | -Site to Zone Assignment List | -Windows Components/Internet Explorer/Internet Control Panel/Security Page | -IZ_Zonemaps | -inetres.admx | -
| InternetExplorer/AllowSuggestedSites | -Turn on Suggested Sites | -Windows Components/Internet Explorer | -EnableSuggestedSites | -inetres.admx | -
| InternetExplorer/AllowTrustedSitesZoneTemplate | -Trusted Sites Zone Template | -Windows Components/Internet Explorer/Internet Control Panel/Security Page | -IZ_PolicyTrustedSitesZoneTemplate | -inetres.admx | -
| InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate | -Locked-Down Trusted Sites Zone Template | -IZ_PolicyTrustedSitesZoneLockdownTemplate | -inetres.admx | -|
| InternetExplorer/AllowsRestrictedSitesZoneTemplate | -Restricted Sites Zone Template | -Windows Components/Internet Explorer/Internet Control Panel/Security Page | -IZ_PolicyRestrictedSitesZoneTemplate | -inetres.admx | -
| InternetExplorer/DisableAdobeFlash | -Turn off Adobe Flash in Internet Explorer and prevent applications from using Internet Explorer technology to instantiate Flash objects | -Windows Components/Internet Explorer/Security Features/Add-on Management | -DisableFlashInIE | -inetres.admx | -
| InternetExplorer/DisableBypassOfSmartScreenWarnings | -- | - | - | inetres.admx | -
| InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles | -- | - | - | inetres.admx | -
| InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation | -Prevent participation in the Customer Experience Improvement Program | -Windows Components/Internet Explorer | -SQM_DisableCEIP | -inetres.admx | -
| InternetExplorer/DisableEnclosureDownloading | -Prevent downloading of enclosures | -Windows Components/RSS Feeds | -Disable_Downloading_of_Enclosures | -inetres.admx | -
| InternetExplorer/DisableEncryptionSupport | -Turn off encryption support | -Windows Components/Internet Explorer/Internet Control Panel/Advanced Page | -Advanced_SetWinInetProtocols | -inetres.admx | -
| InternetExplorer/DisableFirstRunWizard | -Prevent running First Run wizard | -Windows Components/Internet Explorer | -NoFirstRunCustomise | -inetres.admx | -
| InternetExplorer/DisableFlipAheadFeature | -Turn off the flip ahead with page prediction feature | -Windows Components/Internet Explorer/Internet Control Panel/Advanced Page | -Advanced_DisableFlipAhead | -inetres.admx | -
| InternetExplorer/DisableHomePageChange | -Disable changing home page settings | -Windows Components/Internet Explorer | -RestrictHomePage | -inetres.admx | -
| InternetExplorer/DisableProxyChange | -- | - | - | inetres.admx | -
| InternetExplorer/DisableSearchProviderChange | -Prevent changing the default search provider | -Windows Components/Internet Explorer | -NoSearchProvider | -inetres.admx | -
| InternetExplorer/DisableSecondaryHomePageChange | -Disable changing secondary home page settings | -Windows Components/Internet Explorer | -SecondaryHomePages | -inetres.admx | -
| InternetExplorer/DisableUpdateCheck | -- | - | - | inetres.admx | -
| InternetExplorer/DoNotAllowUsersToAddSites | -- | - | - | inetres.admx | -
| InternetExplorer/DoNotAllowUsersToChangePolicies | -- | - | - | inetres.admx | -
| InternetExplorer/DoNotBlockOutdatedActiveXControls | -Turn off blocking of outdated ActiveX controls for Internet Explorer | -Windows Components/Internet Explorer/Security Features/Add-on Management | -VerMgmtDisable | -inetres.admx | -
| InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains | -Turn off blocking of outdated ActiveX controls for Internet Explorer on specific domains | -Windows Components/Internet Explorer/Security Features/Add-on Management | -VerMgmtDomainAllowlist | -inetres.admx | -
| InternetExplorer/IncludeAllLocalSites | -Intranet Sites: Include all local (intranet) sites not listed in other zones | -Windows Components/Internet Explorer/Internet Control Panel/Security Page | -IZ_IncludeUnspecifiedLocalSites | -inetres.admx | -
| InternetExplorer/IncludeAllNetworkPaths | -Intranet Sites: Include all network paths (UNCs) | -Windows Components/Internet Explorer/Internet Control Panel/Security Page | -IZ_UNCAsIntranet | -inetres.admx | -
| InternetExplorer/InternetZoneAllowAccessToDataSources | -Access data sources across domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone | -IZ_PolicyAccessDataSourcesAcrossDomains_1 | -inetres.admx | -
| InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls | -Automatic prompting for ActiveX controls | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone | -IZ_PolicyNotificationBarActiveXURLaction_1 | -inetres.admx | -
| InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads | -Automatic prompting for file downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone | -IZ_PolicyNotificationBarDownloadURLaction_1 | -inetres.admx | -
| InternetExplorer/InternetZoneAllowFontDownloads | -Allow font downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone | -IZ_PolicyFontDownload_1 | -inetres.admx | -
| InternetExplorer/InternetZoneAllowLessPrivilegedSites | -Web sites in less privileged Web content zones can navigate into this zone | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone | -IZ_PolicyZoneElevationURLaction_1 | -inetres.admx | -
| InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents | -Run .NET Framework-reliant components not signed with Authenticode | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone | -IZ_PolicyUnsignedFrameworkComponentsURLaction_1 | -inetres.admx | -
| InternetExplorer/InternetZoneAllowScriptlets | -Allow scriptlets | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone | -IZ_Policy_AllowScriptlets_1 | -inetres.admx | -
| InternetExplorer/InternetZoneAllowSmartScreenIE | -Turn on SmartScreen Filter scan | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone | -IZ_Policy_Phishing_1 | -inetres.admx | -
| InternetExplorer/InternetZoneAllowUserDataPersistence | -Userdata persistence | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone | -IZ_PolicyUserdataPersistence_1 | -inetres.admx | -
| InternetExplorer/InternetZoneInitializeAndScriptActiveXControls | -Initialize and script ActiveX controls not marked as safe | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone | -IZ_PolicyScriptActiveXNotMarkedSafe_1 | -inetres.admx | -
| InternetExplorer/InternetZoneNavigateWindowsAndFrames | -Navigate windows and frames across different domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone | -IZ_PolicyNavigateSubframesAcrossDomains_1 | -inetres.admx | -
| InternetExplorer/IntranetZoneAllowAccessToDataSources | -Access data sources across domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone | -IZ_PolicyAccessDataSourcesAcrossDomains_3 | -inetres.admx | -
| InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls | -Automatic prompting for ActiveX controls | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone | -IZ_PolicyNotificationBarActiveXURLaction_3 | -inetres.admx | -
| InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads | -Automatic prompting for file downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone | -IZ_PolicyNotificationBarDownloadURLaction_3 | -inetres.admx | -
| InternetExplorer/IntranetZoneAllowFontDownloads | -Allow font downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone | -IZ_PolicyFontDownload_3 | -inetres.admx | -
| InternetExplorer/IntranetZoneAllowLessPrivilegedSites | -Web sites in less privileged Web content zones can navigate into this zone | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone | -IZ_PolicyZoneElevationURLaction_3 | -inetres.admx | -
| InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents | -Run .NET Framework-reliant components not signed with Authenticode | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone | -IZ_PolicyUnsignedFrameworkComponentsURLaction_3 | -inetres.admx | -
| InternetExplorer/IntranetZoneAllowScriptlets | -Allow scriptlets | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone | -IZ_Policy_AllowScriptlets_3 | -inetres.admx | -
| InternetExplorer/IntranetZoneAllowSmartScreenIE | -Turn on SmartScreen Filter scan | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone | -IZ_Policy_Phishing_3 | -inetres.admx | -
| InternetExplorer/IntranetZoneAllowUserDataPersistence | -Userdata persistence | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone | -IZ_PolicyUserdataPersistence_3 | -inetres.admx | -
| InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls | -Initialize and script ActiveX controls not marked as safe | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone | -IZ_PolicyScriptActiveXNotMarkedSafe_3 | -inetres.admx | -
| InternetExplorer/IntranetZoneNavigateWindowsAndFrames | -Navigate windows and frames across different domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone | -IZ_PolicyNavigateSubframesAcrossDomains_3 | -inetres.admx | -
| InternetExplorer/LocalMachineZoneAllowAccessToDataSources | -Access data sources across domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone | -IZ_PolicyAccessDataSourcesAcrossDomains_9 | -inetres.admx | -
| InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls | -Automatic prompting for ActiveX controls | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone | -IZ_PolicyNotificationBarActiveXURLaction_9 | -inetres.admx | -
| InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads | -Automatic prompting for file downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone | -IZ_PolicyNotificationBarDownloadURLaction_9 | -inetres.admx | -
| InternetExplorer/LocalMachineZoneAllowFontDownloads | -Allow font downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone | -IZ_PolicyFontDownload_9 | -inetres.admx | -
| InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites | -Web sites in less privileged Web content zones can navigate into this zone | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone | -IZ_PolicyZoneElevationURLaction_9 | -inetres.admx | -
| InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents | -Run .NET Framework-reliant components not signed with Authenticode | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone | -IZ_PolicyUnsignedFrameworkComponentsURLaction_9 | -inetres.admx | -
| InternetExplorer/LocalMachineZoneAllowScriptlets | -Allow scriptlets | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone | -IZ_Policy_AllowScriptlets_9 | -inetres.admx | -
| InternetExplorer/LocalMachineZoneAllowSmartScreenIE | -Turn on SmartScreen Filter scan | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone | -IZ_Policy_Phishing_9 | -inetres.admx | -
| InternetExplorer/LocalMachineZoneAllowUserDataPersistence | -Userdata persistence | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone | -IZ_PolicyUserdataPersistence_9 | -inetres.admx | -
| InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls | -Initialize and script ActiveX controls not marked as safe | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone | -IZ_PolicyScriptActiveXNotMarkedSafe_9 | -inetres.admx | -
| InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames | -Navigate windows and frames across different domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone | -IZ_PolicyNavigateSubframesAcrossDomains_9 | -inetres.admx | -
| InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources | -Access data sources across domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone | -IZ_PolicyAccessDataSourcesAcrossDomains_2 | -inetres.admx | -
| InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls | -Automatic prompting for ActiveX controls | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone | -IZ_PolicyNotificationBarActiveXURLaction_2 | -inetres.admx | -
| InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads | -Automatic prompting for file downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone | -IZ_PolicyNotificationBarDownloadURLaction_2 | -inetres.admx | -
| InternetExplorer/LockedDownInternetZoneAllowFontDownloads | -Allow font downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone | -IZ_PolicyFontDownload_2 | -inetres.admx | -
| InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites | -Web sites in less privileged Web content zones can navigate into this zone | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone | -IZ_PolicyZoneElevationURLaction_2 | -inetres.admx | -
| InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents | -Run .NET Framework-reliant components not signed with Authenticode | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone | -IZ_PolicyUnsignedFrameworkComponentsURLaction_2 | -inetres.admx | -
| InternetExplorer/LockedDownInternetZoneAllowScriptlets | -Allow scriptlets | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone | -IZ_Policy_AllowScriptlets_2 | -inetres.admx | -
| InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE | -Turn on SmartScreen Filter scan | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone | -IZ_Policy_Phishing_2 | -inetres.admx | -
| InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence | -Userdata persistence | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone | -IZ_PolicyUserdataPersistence_2 | -inetres.admx | -
| InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls | -Initialize and script ActiveX controls not marked as safe | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone | -IZ_PolicyScriptActiveXNotMarkedSafe_2 | -inetres.admx | -
| InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames | -Navigate windows and frames across different domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone | -IZ_PolicyNavigateSubframesAcrossDomains_2 | -inetres.admx | -
| InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources | -Access data sources across domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone | -IZ_PolicyAccessDataSourcesAcrossDomains_4 | -inetres.admx | -
| InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls | -Automatic prompting for ActiveX controls | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone | -IZ_PolicyNotificationBarActiveXURLaction_4 | -inetres.admx | -
| InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads | -Automatic prompting for file downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone | -IZ_PolicyNotificationBarDownloadURLaction_4 | -inetres.admx | -
| InternetExplorer/LockedDownIntranetZoneAllowFontDownloads | -Allow font downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone | -IZ_PolicyFontDownload_4 | -inetres.admx | -
| InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites | -Web sites in less privileged Web content zones can navigate into this zone | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone | -IZ_PolicyZoneElevationURLaction_4 | -inetres.admx | -
| InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents | -Run .NET Framework-reliant components not signed with Authenticode | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone | -IZ_PolicyUnsignedFrameworkComponentsURLaction_4 | -inetres.admx | -
| InternetExplorer/LockedDownIntranetZoneAllowScriptlets | -Allow scriptlets | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone | -IZ_Policy_AllowScriptlets_4 | -inetres.admx | -
| InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE | -Turn on SmartScreen Filter scan | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone | -IZ_Policy_Phishing_4 | -inetres.admx | -
| InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence | -Userdata persistence | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone | -IZ_PolicyUserdataPersistence_4 | -inetres.admx | -
| InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls | -Initialize and script ActiveX controls not marked as safe | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone | -IZ_PolicyScriptActiveXNotMarkedSafe_4 | -inetres.admx | -
| InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames | -Navigate windows and frames across different domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone | -IZ_PolicyNavigateSubframesAcrossDomains_4 | -inetres.admx | -
| InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources | -Access data sources across domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone | -IZ_PolicyAccessDataSourcesAcrossDomains_10 | -inetres.admx | -
| InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls | -Automatic prompting for ActiveX controls | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone | -IZ_PolicyNotificationBarActiveXURLaction_10 | -inetres.admx | -
| InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads | -Automatic prompting for file downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone | -IZ_PolicyNotificationBarDownloadURLaction_10 | -inetres.admx | -
| InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads | -Allow font downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone | -IZ_PolicyFontDownload_10 | -inetres.admx | -
| InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites | -Web sites in less privileged Web content zones can navigate into this zone | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone | -IZ_PolicyZoneElevationURLaction_10 | -inetres.admx | -
| InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents | -Run .NET Framework-reliant components not signed with Authenticode | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone | -IZ_PolicyUnsignedFrameworkComponentsURLaction_10 | -inetres.admx | -
| InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets | -Allow scriptlets | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone | -IZ_Policy_AllowScriptlets_10 | -inetres.admx | -
| InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE | -Turn on SmartScreen Filter scan | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone | -IZ_Policy_Phishing_10 | -inetres.admx | -
| InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence | -Userdata persistence | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone | -IZ_PolicyUserdataPersistence_10 | -inetres.admx | -
| InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls | -Initialize and script ActiveX controls not marked as safe | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone | -IZ_PolicyScriptActiveXNotMarkedSafe_10 | -inetres.admx | -
| InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames | -Navigate windows and frames across different domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone | -IZ_PolicyNavigateSubframesAcrossDomains_10 | -inetres.admx | -
| InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources | -Access data sources across domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone | -IZ_PolicyAccessDataSourcesAcrossDomains_8 | -inetres.admx | -
| InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls | -Automatic prompting for ActiveX controls | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone | -IZ_PolicyNotificationBarActiveXURLaction_8 | -inetres.admx | -
| InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads | -Automatic prompting for file downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone | -IZ_PolicyNotificationBarDownloadURLaction_8 | -inetres.admx | -
| InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads | -Allow font downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone | -IZ_PolicyFontDownload_8 | -inetres.admx | -
| InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites | -Web sites in less privileged Web content zones can navigate into this zone | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone | -IZ_PolicyZoneElevationURLaction_8 | -inetres.admx | -
| InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents | -Run .NET Framework-reliant components not signed with Authenticode | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone | -IZ_PolicyUnsignedFrameworkComponentsURLaction_8 | -inetres.admx | -
| InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets | -Allow scriptlets | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone | -IZ_Policy_AllowScriptlets_8 | -inetres.admx | -
| InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE | -Turn on SmartScreen Filter scan | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone | -IZ_Policy_Phishing_8 | -inetres.admx | -
| InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence | -Userdata persistence | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone | -IZ_PolicyUserdataPersistence_8 | -inetres.admx | -
| InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls | -Initialize and script ActiveX controls not marked as safe | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone | -IZ_PolicyScriptActiveXNotMarkedSafe_8 | -inetres.admx | -
| InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames | -Navigate windows and frames across different domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone | -IZ_PolicyNavigateSubframesAcrossDomains_8 | -inetres.admx | -
| InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources | -Access data sources across domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone | -IZ_PolicyAccessDataSourcesAcrossDomains_6 | -inetres.admx | -
| InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls | -Automatic prompting for ActiveX controls | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone | -IZ_PolicyNotificationBarActiveXURLaction_6 | -inetres.admx | -
| InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads | -Automatic prompting for file downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone | -IZ_PolicyNotificationBarDownloadURLaction_6 | -inetres.admx | -
| InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads | -Allow font downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone | -IZ_PolicyFontDownload_6 | -inetres.admx | -
| InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites | -Web sites in less privileged Web content zones can navigate into this zone | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone | -IZ_PolicyZoneElevationURLaction_6 | -inetres.admx | -
| InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents | -Run .NET Framework-reliant components not signed with Authenticode | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone | -IZ_PolicyUnsignedFrameworkComponentsURLaction_6 | -inetres.admx | -
| InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets | -Allow scriptlets | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone | -IZ_Policy_AllowScriptlets_6 | -inetres.admx | -
| InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE | -Turn on SmartScreen Filter scan | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone | -IZ_Policy_Phishing_6 | -inetres.admx | -
| InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence | -Userdata persistence | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone | -IZ_PolicyUserdataPersistence_6 | -inetres.admx | -
| InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls | -Initialize and script ActiveX controls not marked as safe | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone | -IZ_PolicyScriptActiveXNotMarkedSafe_6 | -inetres.admx | -
| InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames | -Navigate windows and frames across different domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone | -IZ_PolicyNavigateSubframesAcrossDomains_6 | -inetres.admx | -
| InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources | -Access data sources across domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone | -IZ_PolicyAccessDataSourcesAcrossDomains_7 | -inetres.admx | -
| InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls | -Automatic prompting for ActiveX controls | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone | -IZ_PolicyNotificationBarActiveXURLaction_7 | -inetres.admx | -
| InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads | -Automatic prompting for file downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone | -IZ_PolicyNotificationBarDownloadURLaction_7 | -inetres.admx | -
| InternetExplorer/RestrictedSitesZoneAllowFontDownloads | -Allow font downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone | -IZ_PolicyFontDownload_7 | -inetres.admx | -
| InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites | -Web sites in less privileged Web content zones can navigate into this zone | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone | -IZ_PolicyZoneElevationURLaction_7 | -inetres.admx | -
| InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents | -Run .NET Framework-reliant components not signed with Authenticode | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone | -IZ_PolicyUnsignedFrameworkComponentsURLaction_7 | -inetres.admx | -
| InternetExplorer/RestrictedSitesZoneAllowScriptlets | -Allow scriptlets | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone | -IZ_Policy_AllowScriptlets_7 | -inetres.admx | -
| InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE | -Turn on SmartScreen Filter scan | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone | -IZ_Policy_Phishing_7 | -inetres.admx | -
| InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence | -Userdata persistence | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone | -IZ_PolicyUserdataPersistence_7 | -inetres.admx | -
| InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls | -Initialize and script ActiveX controls not marked as safe | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone | -IZ_PolicyScriptActiveXNotMarkedSafe_7 | -inetres.admx | -
| InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames | -Navigate windows and frames across different domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone | -IZ_PolicyNavigateSubframesAcrossDomains_7 | -inetres.admx | -
| InternetExplorer/SearchProviderList | -Restrict search providers to a specific list | -Windows Components/Internet Explorer | -SpecificSearchProvider | -inetres.admx | -
| InternetExplorer/TrustedSitesZoneAllowAccessToDataSources | -Access data sources across domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone | -IZ_PolicyAccessDataSourcesAcrossDomains_5 | -inetres.admx | -
| InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls | -Automatic prompting for ActiveX controls | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone | -IZ_PolicyNotificationBarActiveXURLaction_5 | -inetres.admx | -
| InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads | -Automatic prompting for file downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone | -IZ_PolicyNotificationBarDownloadURLaction_5 | -inetres.admx | -
| InternetExplorer/TrustedSitesZoneAllowFontDownloads | -Allow font downloads | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone | -IZ_PolicyFontDownload_5 | -inetres.admx | -
| InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites | -Web sites in less privileged Web content zones can navigate into this zone | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone | -IZ_PolicyZoneElevationURLaction_5 | -inetres.admx | -
| InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents | -Run .NET Framework-reliant components not signed with Authenticode | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone | -IZ_PolicyUnsignedFrameworkComponentsURLaction_5 | -inetres.admx | -
| InternetExplorer/TrustedSitesZoneAllowScriptlets | -Allow scriptlets | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone | -IZ_Policy_AllowScriptlets_5 | -inetres.admx | -
| InternetExplorer/TrustedSitesZoneAllowSmartScreenIE | -Turn on SmartScreen Filter scan | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone | -IZ_Policy_Phishing_5 | -inetres.admx | -
| InternetExplorer/TrustedSitesZoneAllowUserDataPersistence | -Userdata persistence | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone | -IZ_PolicyUserdataPersistence_5 | -inetres.admx | -
| InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls | -Initialize and script ActiveX controls not marked as safe | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone | -IZ_PolicyScriptActiveXNotMarkedSafe_5 | -inetres.admx | -
| InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames | -Navigate windows and frames across different domains | -Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone | -IZ_PolicyNavigateSubframesAcrossDomains_5 | -inetres.admx | -
| Kerberos/AllowForestSearchOrder | -- | ForestSearch | -Kerberos.admx | -|
| Kerberos/KerberosClientSupportsClaimsCompoundArmor | -Kerberos client support for claims, compound authentication and Kerberos armoring | -System/Kerberos | -EnableCbacAndArmor | -Kerberos.admx | -
| Kerberos/RequireKerberosArmoring | -Fail authentication requests when Kerberos armoring is not available | -System/Kerberos | -ClientRequireFast | -Kerberos.admx | -
| Kerberos/RequireStrictKDCValidation | -Require strict KDC validation | -System/Kerberos | -ValidateKDC | -Kerberos.admx | -
| Kerberos/SetMaximumContextTokenSize | -Set maximum Kerberos SSPI context token buffer size | -System/Kerberos | -MaxTokenSize | -Kerberos.admx | -
| Power/AllowStandbyWhenSleepingPluggedIn | -Allow standby states (S1-S3) when sleeping (plugged in) | -System/Power Management/Sleep Settings | -AllowStandbyStatesAC_2 | -power.admx | -
| Power/RequirePasswordWhenComputerWakesOnBattery | -Require a password when a computer wakes (on battery) | -System/Power Management/Sleep Settings | -DCPromptForPasswordOnResume_2 | -power.admx | -
| Power/RequirePasswordWhenComputerWakesPluggedIn | -Require a password when a computer wakes (plugged in) | -System/Power Management/Sleep Settings | -ACPromptForPasswordOnResume_2 | -power.admx | -
| Printers/PointAndPrintRestrictions | -Point and Print Restrictions | -Printers | -PointAndPrint_Restrictions_Win7 | -Printing.admx | -
| Printers/PointAndPrintRestrictions_User | -Point and Print Restrictions | -PointAndPrint_Restrictions | -Printing.admx | -|
| Printers/PublishPrinters | -Allow printers to be published | -Printers | -PublishPrinters | -Printing2.admx | -
| RemoteAssistance/CustomizeWarningMessages | -Customize warning messages | -System/Remote Assistance | -RA_Options | -remoteassistance.admx | -
| RemoteAssistance/SessionLogging | -Turn on session logging | -System/Remote Assistance | -RA_Logging | -remoteassistance.admx | -
| RemoteAssistance/SolicitedRemoteAssistance | -Configure Solicited Remote Assistance | -System/Remote Assistance | -RA_Solicit | -remoteassistance.admx | -
| RemoteAssistance/UnsolicitedRemoteAssistance | -Configure Offer Remote Assistance | -RA_Unsolicit | -remoteassistance.admx | -|
| RemoteDesktopServices/AllowUsersToConnectRemotely | -Allow users to connect remotely by using Remote Desktop Services | -Windows Components/Remote Desktop Services/Remote Desktop Session Host/Connections | -TS_DISABLE_CONNECTIONS | -terminalserver.admx | -
| RemoteDesktopServices/ClientConnectionEncryptionLevel | -Set client connection encryption level | -Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security | -TS_ENCRYPTION_POLICY | -terminalserver.admx | -
| RemoteDesktopServices/DoNotAllowDriveRedirection | -Do not allow drive redirection | -Windows Components/Remote Desktop Services/Remote Desktop Session Host/Device and Resource Redirection | -TS_CLIENT_DRIVE_M | -terminalserver.admx | -
| RemoteDesktopServices/DoNotAllowPasswordSaving | -Do not allow passwords to be saved | -Windows Components/Remote Desktop Services/Remote Desktop Connection Client | -TS_CLIENT_DISABLE_PASSWORD_SAVING_2 | -terminalserver.admx | -
| RemoteDesktopServices/PromptForPasswordUponConnection | -Always prompt for password upon connection | -Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security | -TS_PASSWORD | -terminalserver.admx | -
| RemoteDesktopServices/RequireSecureRPCCommunication | -Require secure RPC communication | -Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security | -TS_RPC_ENCRYPTION | -terminalserver.admx | -
| RemoteProcedureCall/RPCEndpointMapperClientAuthentication | -Enable RPC Endpoint Mapper Client Authentication | -System/Remote Procedure Call | -RpcEnableAuthEpResolution | -rpc.admx | -
| RemoteProcedureCall/RestrictUnauthenticatedRPCClients | -Restrict Unauthenticated RPC clients | -System/Remote Procedure Call | -RpcRestrictRemoteClients | -rpc.admx | -
| Storage/EnhancedStorageDevices | -Do not allow Windows to activate Enhanced Storage devices | -System/Enhanced Storage Access | -TCGSecurityActivationDisabled | -enhancedstorage.admx | -
| System/BootStartDriverInitialization | -Boot-Start Driver Initialization Policy | -System/Early Launch Antimalware | -POL_DriverLoadPolicy_Name | -earlylauncham.admx | -
| System/DisableSystemRestore | -Turn off System Restore | -System/System Restore | -SR_DisableSR | -systemrestore.admx | -
| WindowsLogon/DisableLockScreenAppNotifications | -Turn off app notifications on the lock screen | -System/Logon | -DisableLockScreenAppNotifications | -logon.admx | -
| WindowsLogon/DontDisplayNetworkSelectionUI | -Do not display network selection UI | -System/Logon | -DontDisplayNetworkSelectionUI | -logon.admx | -
This policy setting determines which ActiveX installation sites standard users in your organization can use to install ActiveX controls on their computers. When this setting is enabled, the administrator can create a list of approved Activex Install sites specified by host URL.
- -If you enable this setting, the administrator can create a list of approved ActiveX Install sites specified by host URL. - -If you disable or do not configure this policy setting, ActiveX controls prompt the user for administrative credentials before installation.
- -Note: Wild card characters cannot be used when specifying the host URLs. -
- -**AppVirtualization/AllowAppVClient** - -This policy setting allows you to enable or disable Microsoft Application Virtualization (App-V) feature. Reboot is needed for disable to take effect.
- -**AppVirtualization/AllowDynamicVirtualization** - -Enables Dynamic Virtualization of supported shell extensions, browser helper objects, and ActiveX controls.
- -**AppVirtualization/AllowPackageCleanup** - -N/A
- -**AppVirtualization/AllowPackageScripts** - -Enables scripts defined in the package manifest of configuration files that should run.
- -**AppVirtualization/AllowPublishingRefreshUX** - -Enables a UX to display to the user when a publishing refresh is performed on the client.
- -**AppVirtualization/AllowReportingServer** - -Reporting Server URL: Displays the URL of reporting server.
- -Reporting Time: When the client data should be reported to the server. Acceptable range is 0~23, corresponding to the 24 hours in a day. A good practice is, don't set this time to a busy hour, e.g. 9AM. - - Delay reporting for the random minutes: The maximum minutes of random delay on top of the reporting time. For a busy system, the random delay will help reduce the server load. - - Repeat reporting for every (days): The periodical interval in days for sending the reporting data. - - Data Cache Limit: This value specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The default value is 20 MB. The size applies to the cache in memory. When the limit is reached, the log file will roll over. When a new record is to be added (bottom of the list), one or more of the oldest records (top of the list) will be deleted to make room. A warning will be logged to the Client log and the event log the first time this occurs, and will not be logged again until after the cache has been successfully cleared on transmission and the log has filled up again.
- -Data Block Size: This value specifies the maximum size in bytes to transmit to the server at once on a reporting upload, to avoid permanent transmission failures when the log has reached a significant size. The default value is 65536. When transmitting report data to the server, one block at a time of application records that is less than or equal to the block size in bytes of XML data will be removed from the cache and sent to the server. Each block will have the general Client data and global package list data prepended, and these will not factor into the block size calculations; the potential exists for an extremely large package list to result in transmission failures over low bandwidth or unreliable connections. -
- -**AppVirtualization/AllowRoamingFileExclusions** - -Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /FILEEXCLUSIONLIST='desktop;my pictures'.
- -**AppVirtualization/AllowRoamingRegistryExclusions** - -Specifies the registry paths that do not roam with a user profile. Example usage: /REGISTRYEXCLUSIONLIST=software\classes;software\clients.
- -**AppVirtualization/AllowStreamingAutoload** - -Specifies how new packages should be loaded automatically by App-V on a specific computer.
- -**AppVirtualization/ClientCoexistenceAllowMigrationmode** - -Migration mode allows the App-V client to modify shortcuts and FTA's for packages created using a previous version of App-V.
- -**AppVirtualization/IntegrationAllowRootGlobal** - -Specifies the location where symbolic links are created to the current version of a per-user published package. Shortcuts, file type associations, etc. are created pointing to this path. If empty, symbolic links are not used during publishing. Example: %localappdata%\Microsoft\AppV\Client\Integration.
- -**AppVirtualization/IntegrationAllowRootUser** - -Specifies the location where symbolic links are created to the current version of a globally published package. Shortcuts, file type associations, etc. are created pointing to this path. If empty, symbolic links are not used during publishing. Example: %allusersprofile%\Microsoft\AppV\Client\Integration.
- -**AppVirtualization/PublishingAllowServer1** - -Publishing Server Display Name: Displays the name of publishing server. - - Publishing Server URL: Displays the URL of publishing server. - - Global Publishing Refresh: Enables global publishing refresh (Boolean). - - Global Publishing Refresh On Logon: Triggers a global publishing refresh on logon (Boolean). - - Global Publishing Refresh Interval: Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0. - - Global Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31). - - User Publishing Refresh: Enables user publishing refresh (Boolean). - - User Publishing Refresh On Logon: Triggers a user publishing refresh on logon (Boolean). - - User Publishing Refresh Interval: Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. - - User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31). -
- -**AppVirtualization/PublishingAllowServer2** - -Publishing Server Display Name: Displays the name of publishing server. - - Publishing Server URL: Displays the URL of publishing server. - - Global Publishing Refresh: Enables global publishing refresh (Boolean). - - Global Publishing Refresh On Logon: Triggers a global publishing refresh on logon (Boolean). - - Global Publishing Refresh Interval: Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0. - - Global Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31). - - User Publishing Refresh: Enables user publishing refresh (Boolean). - - User Publishing Refresh On Logon: Triggers a user publishing refresh on logon (Boolean). - - User Publishing Refresh Interval: Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. - - User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31). -
- -**AppVirtualization/PublishingAllowServer3** - -Publishing Server Display Name: Displays the name of publishing server. - - Publishing Server URL: Displays the URL of publishing server. - - Global Publishing Refresh: Enables global publishing refresh (Boolean). - - Global Publishing Refresh On Logon: Triggers a global publishing refresh on logon (Boolean). - - Global Publishing Refresh Interval: Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0. - - Global Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31). - - User Publishing Refresh: Enables user publishing refresh (Boolean). - - User Publishing Refresh On Logon: Triggers a user publishing refresh on logon (Boolean). - - User Publishing Refresh Interval: Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. - - User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31). -
- -**AppVirtualization/PublishingAllowServer4** - -Publishing Server Display Name: Displays the name of publishing server. - - Publishing Server URL: Displays the URL of publishing server. - - Global Publishing Refresh: Enables global publishing refresh (Boolean). - - Global Publishing Refresh On Logon: Triggers a global publishing refresh on logon (Boolean). - - Global Publishing Refresh Interval: Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0. - - Global Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31). - - User Publishing Refresh: Enables user publishing refresh (Boolean). - - User Publishing Refresh On Logon: Triggers a user publishing refresh on logon (Boolean). - - User Publishing Refresh Interval: Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. - - User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31). -
- -**AppVirtualization/PublishingAllowServer5** - -Publishing Server Display Name: Displays the name of publishing server. - - Publishing Server URL: Displays the URL of publishing server. - - Global Publishing Refresh: Enables global publishing refresh (Boolean). - - Global Publishing Refresh On Logon: Triggers a global publishing refresh on logon (Boolean). - - Global Publishing Refresh Interval: Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0. - - Global Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31). - - User Publishing Refresh: Enables user publishing refresh (Boolean). - - User Publishing Refresh On Logon: Triggers a user publishing refresh on logon (Boolean). - - User Publishing Refresh Interval: Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. - - User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31). -
- -**AppVirtualization/StreamingAllowCertificateFilterForClient_SSL** - -Specifies the path to a valid certificate in the certificate store.
- -**AppVirtualization/StreamingAllowHighCostLaunch** - -This setting controls whether virtualized applications are launched on Windows 8 machines connected via a metered network connection (e.g. 4G).
- -**AppVirtualization/StreamingAllowLocationProvider** - -Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface.
- -**AppVirtualization/StreamingAllowPackageInstallationRoot** - -Specifies directory where all new applications and updates will be installed.
- -**AppVirtualization/StreamingAllowPackageSourceRoot** - -Overrides source location for downloading package content.
- -**AppVirtualization/StreamingAllowReestablishmentInterval** - -Specifies the number of seconds between attempts to reestablish a dropped session.
- -**AppVirtualization/StreamingAllowReestablishmentRetries** - -Specifies the number of times to retry a dropped session.
- -**AppVirtualization/StreamingSharedContentStoreMode** - -Specifies that streamed package contents will be not be saved to the local hard disk.
- -**AppVirtualization/StreamingSupportBranchCache** - -If enabled, the App-V client will support BrancheCache compatible HTTP streaming. If BranchCache support is not desired, this should be disabled. The client can then apply HTTP optimizations which are incompatible with BranchCache
- -**AppVirtualization/StreamingVerifyCertificateRevocationList** - -Verifies Server certificate revocation status before streaming using HTTPS.
- -**AppVirtualization/VirtualComponentsAllowList** - -Specifies a list of process paths (may contain wildcards) which are candidates for using virtual components (shell extensions, browser helper objects, etc). Only processes whose full path matches one of these items can use virtual components.
- -**AttachmentManager/DoNotPreserveZoneInformation** - -This policy setting allows you to manage whether Windows marks file attachments with information about their zone of origin (such as restricted, Internet, intranet, local). This requires NTFS in order to function correctly, and will fail without notice on FAT32. By not preserving the zone information, Windows cannot make proper risk assessments.
- -If you enable this policy setting, Windows does not mark file attachments with their zone information.
- -If you disable this policy setting, Windows marks file attachments with their zone information.
- -If you do not configure this policy setting, Windows marks file attachments with their zone information.
- -**AttachmentManager/HideZoneInfoMechanism** - -This policy setting allows you to manage whether users can manually remove the zone information from saved file attachments by clicking the Unblock button in the file's property sheet or by using a check box in the security warning dialog. Removing the zone information allows users to open potentially dangerous file attachments that Windows has blocked users from opening.
- -If you enable this policy setting, Windows hides the check box and Unblock button.
- -If you disable this policy setting, Windows shows the check box and Unblock button.
- -If you do not configure this policy setting, Windows hides the check box and Unblock button.
- -**AttachmentManager/NotifyAntivirusPrograms** - -This policy setting allows you to manage the behavior for notifying registered antivirus programs. If multiple programs are registered, they will all be notified. If the registered antivirus program already performs on-access checks or scans files as they arrive on the computer's email server, additional calls would be redundant.
- -If you enable this policy setting, Windows tells the registered antivirus program to scan the file when a user opens a file attachment. If the antivirus program fails, the attachment is blocked from being opened.
- -If you disable this policy setting, Windows does not call the registered antivirus programs when file attachments are opened.
- -If you do not configure this policy setting, Windows does not call the registered antivirus programs when file attachments are opened.
- -**Autoplay/DisallowAutoplayForNonVolumeDevices** - -This policy setting disallows AutoPlay for MTP devices like cameras or phones.
- -If you enable this policy setting, AutoPlay is not allowed for MTP devices like cameras or phones.
- -If you disable or do not configure this policy setting, AutoPlay is enabled for non-volume devices.
- -**Autoplay/SetDefaultAutoRunBehavior** - -This policy setting sets the default behavior for Autorun commands.
- -Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines.
- -Prior to Windows Vista, when media containing an autorun command is inserted, the system will automatically execute the program without user intervention.
- -This creates a major security concern as code may be executed without user's knowledge. The default behavior starting with Windows Vista is to prompt the user whether autorun command is to be run. The autorun command is represented as a handler in the Autoplay dialog.
- -If you enable this policy setting, an Administrator can change the default Windows Vista or later behavior for autorun to:
- -a) Completely disable autorun commands, or - b) Revert back to pre-Windows Vista behavior of automatically executing the autorun command.
- -If you disable or not configure this policy setting, Windows Vista or later will prompt the user whether autorun command is to be run.
- -**Autoplay/TurnOffAutoPlay** - -This policy setting allows you to turn off the Autoplay feature.
- -Autoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs and the music on audio media start immediately.
- -Prior to Windows XP SP2, Autoplay is disabled by default on removable drives, such as the floppy disk drive (but not the CD-ROM drive), and on network drives.
- -Starting with Windows XP SP2, Autoplay is enabled for removable drives as well, including Zip drives and some USB mass storage devices.
- -If you enable this policy setting, Autoplay is disabled on CD-ROM and removable media drives, or disabled on all drives.
- -This policy setting disables Autoplay on additional types of drives. You cannot use this setting to enable Autoplay on drives on which it is disabled by default.
- -If you disable or do not configure this policy setting, AutoPlay is enabled.
- -Note: This policy setting appears in both the Computer Configuration and User Configuration folders. If the policy settings conflict, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration.
- -**Connectivity/HardenedUNCPaths** - -This policy setting configures secure access to UNC paths.
- -If you enable this policy, Windows only allows access to the specified UNC paths after fulfilling additional security requirements. -
- -**CredentialProviders/AllowPINLogon** - -This policy setting allows you to control whether a domain user can sign in using a convenience PIN. In Windows 10, convenience PIN was replaced with Windows Hello PIN, which has stronger security properties. To configure Windows Hello for Business, use the policies under Computer configuration\Administrative Templates\Windows Components\Windows Hello for Business.
- -If you enable this policy setting, a domain user can set up and sign in with a convenience PIN.
- -If you disable or don't configure this policy setting, a domain user can't set up and use a convenience PIN.
- -Note that the user's domain password will be cached in the system vault when using this feature.
- -**CredentialProviders/BlockPicturePassword** - -This policy setting allows you to control whether a domain user can sign in using a picture password.
- -If you enable this policy setting, a domain user can't set up or sign in with a picture password.
- -If you disable or don't configure this policy setting, a domain user can set up and use a picture password.
- -Note that the user's domain password will be cached in the system vault when using this feature.
- -**CredentialsUI/DisablePasswordReveal** - -This policy setting allows you to configure the display of the password reveal button in password entry user experiences.
- -If you enable this policy setting, the password reveal button will not be displayed after a user types a password in the password entry text box.
- -If you disable or do not configure this policy setting, the password reveal button will be displayed after a user types a password in the password entry text box.
- -By default, the password reveal button is displayed after a user types a password in the password entry text box. To display the password, click the password reveal button.
- -The policy applies to all Windows components and applications that use the Windows system controls, including Internet Explorer.
- -**CredentialsUI/EnumerateAdministrators** - -This policy setting controls whether administrator accounts are displayed when a user attempts to elevate a running application. By default, administrator accounts are not displayed when the user attempts to elevate a running application.
- -If you enable this policy setting, all local administrator accounts on the PC will be displayed so the user can choose one and enter the correct password.
- -If you disable this policy setting, users will always be required to type a user name and password to elevate.
- -**DataUsage/SetCost3G** - -This policy setting configures the cost of 3G connections on the local machine.
- -If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all 3G connections on the local machine:
- -- Unrestricted: Use of this connection is unlimited and not restricted by usage charges and capacity constraints.
- -- Fixed: Use of this connection is not restricted by usage charges and capacity constraints up to a certain data limit.
- -- Variable: This connection is costed on a per byte basis.
- -If this policy setting is disabled or is not configured, the cost of 3G connections is Fixed by default. -
- -**DataUsage/SetCost4G** - -This policy setting configures the cost of 4G connections on the local machine.
- -If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all 4G connections on the local machine:
- -- Unrestricted: Use of this connection is unlimited and not restricted by usage charges and capacity constraints.
- -- Fixed: Use of this connection is not restricted by usage charges and capacity constraints up to a certain data limit.
- -- Variable: This connection is costed on a per byte basis.
- -If this policy setting is disabled or is not configured, the cost of 4G connections is Fixed by default. -
- -**DeviceInstallation/PreventInstallationOfMatchingDeviceIDs** - -This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device.
- -If you enable this policy setting, Windows is prevented from installing a device whose hardware ID or compatible ID appears in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
- -If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings.
- -**DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses** - -This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. - -If you enable this policy setting, Windows is prevented from installing or updating device drivers whose device setup class GUIDs appear in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
- -If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings.
- -**ErrorReporting/CustomizeConsentSettings** - -This policy setting determines the consent behavior of Windows Error Reporting for specific event types.
- -If you enable this policy setting, you can add specific event types to a list by clicking Show, and typing event types in the Value Name column of the Show Contents dialog box. Event types are those for generic, non-fatal errors: crash, no response, and kernel fault errors. For each specified event type, you can set a consent level of 0, 1, 2, 3, or 4.
- -- 0 (Disable): Windows Error Reporting sends no data to Microsoft for this event type.
- -- 1 (Always ask before sending data): Windows prompts the user for consent to send reports.
- -- 2 (Send parameters): Windows Error Reporting automatically sends the minimum data required to check for an existing solution, and Windows prompts the user for consent to send any additional data requested by Microsoft.
- -- 3 (Send parameters and safe additional data): Windows Error Reporting automatically sends the minimum data required to check for an existing solution, as well as data which Windows has determined (within a high probability) does not contain personally identifiable data, and prompts the user for consent to send any additional data requested by Microsoft.
- -- 4 (Send all data): Any data requested by Microsoft is sent automatically.
- -If you disable or do not configure this policy setting, then the default consent settings that are applied are those specified by the user in Control Panel, or in the Configure Default Consent policy setting.
- -**ErrorReporting/DisableWindowsErrorReporting** - -This policy setting turns off Windows Error Reporting, so that reports are not collected or sent to either Microsoft or internal servers within your organization when software unexpectedly stops working or fails.
- -If you enable this policy setting, Windows Error Reporting does not send any problem information to Microsoft. Additionally, solution information is not available in Security and Maintenance in Control Panel.
- -If you disable or do not configure this policy setting, the Turn off Windows Error Reporting policy setting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings takes precedence. If Turn off Windows Error Reporting is also either disabled or not configured, user settings in Control Panel for Windows Error Reporting are applied.
- -**ErrorReporting/DisplayErrorNotification** - -This policy setting controls whether users are shown an error dialog box that lets them report an error.
- -If you enable this policy setting, users are notified in a dialog box that an error has occurred, and can display more details about the error. If the Configure Error Reporting policy setting is also enabled, the user can also report the error.
- -If you disable this policy setting, users are not notified that errors have occurred. If the Configure Error Reporting policy setting is also enabled, errors are reported, but users receive no notification. Disabling this policy setting is useful for servers that do not have interactive users.
- -If you do not configure this policy setting, users can change this setting in Control Panel, which is set to enable notification by default on computers that are running Windows XP Personal Edition and Windows XP Professional Edition, and disable notification by default on computers that are running Windows Server.
- -See also the Configure Error Reporting policy setting.
- -**ErrorReporting/DoNotSendAdditionalData** - -This policy setting controls whether additional data in support of error reports can be sent to Microsoft automatically.
- -If you enable this policy setting, any additional data requests from Microsoft in response to a Windows Error Reporting report are automatically declined, without notification to the user.
- -If you disable or do not configure this policy setting, then consent policy settings in Computer Configuration/Administrative Templates/Windows Components/Windows Error Reporting/Consent take precedence.
- -**ErrorReporting/PreventCriticalErrorDisplay** - -This policy setting prevents the display of the user interface for critical errors.
- -If you enable this policy setting, Windows Error Reporting does not display any GUI-based error messages or dialog boxes for critical errors.
- -If you disable or do not configure this policy setting, Windows Error Reporting displays the user interface for critical errors.
- -**EventLogService/ControlEventLogBehavior** - -This policy setting controls Event Log behavior when the log file reaches its maximum size.
- -If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost.
- -If you disable or do not configure this policy setting and a log file reaches its maximum size, new events overwrite old events.
- -Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting.
- -**EventLogService/SpecifyMaximumFileSizeApplicationLog** - -This policy setting specifies the maximum size of the log file in kilobytes.
- -If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte increments.
- -If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog and it defaults to 20 megabytes.
- -**EventLogService/SpecifyMaximumFileSizeSecurityLog** - -This policy setting specifies the maximum size of the log file in kilobytes.
- -If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte increments.
- -If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog and it defaults to 20 megabytes.
- -**EventLogService/SpecifyMaximumFileSizeSystemLog** - -This policy setting specifies the maximum size of the log file in kilobytes.
- -If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte increments.
- -If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog and it defaults to 20 megabytes.
- -**InternetExplorer/AddSearchProvider** - -This policy setting allows you to add a specific list of search providers to the user's default list of search providers. Normally, search providers can be added from third-party toolbars or in Setup. The user can also add a search provider from the provider's website.
- -If you enable this policy setting, the user can add and remove search providers, but only from the set of search providers specified in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Note: This list can be created from a custom administrative template file. For information about creating this custom administrative template file, see the Internet Explorer documentation on search providers.
- -If you disable or do not configure this policy setting, the user can configure their list of search providers unless another policy setting restricts such configuration.
- -**InternetExplorer/AllowActiveXFiltering** - -This policy setting controls the ActiveX Filtering feature for websites that are running ActiveX controls. The user can choose to turn off ActiveX Filtering for specific websites so that ActiveX controls can run properly.
- -If you enable this policy setting, ActiveX Filtering is enabled by default for the user. The user cannot turn off ActiveX Filtering, although they may add per-site exceptions.
- -If you disable or do not configure this policy setting, ActiveX Filtering is not enabled by default for the user. The user can turn ActiveX Filtering on or off.
- -**InternetExplorer/AllowAddOnList** - -This policy setting allows you to manage a list of add-ons to be allowed or denied by Internet Explorer. Add-ons in this case are controls like ActiveX Controls, Toolbars, and Browser Helper Objects (BHOs) which are specifically written to extend or enhance the functionality of the browser or web pages.
- -This list can be used with the 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting, which defines whether add-ons not listed here are assumed to be denied.
- -If you enable this policy setting, you can enter a list of add-ons to be allowed or denied by Internet Explorer. For each entry that you add to the list, enter the following information:
- -Name of the Value - the CLSID (class identifier) for the add-on you wish to add to the list. The CLSID should be in brackets for example, {000000000-0000-0000-0000-0000000000000}'. The CLSID for an add-on can be obtained by reading the OBJECT tag from a Web page on which the add-on is referenced.
- -Value - A number indicating whether Internet Explorer should deny or allow the add-on to be loaded. To specify that an add-on should be denied enter a 0 (zero) into this field. To specify that an add-on should be allowed, enter a 1 (one) into this field. To specify that an add-on should be allowed and also permit the user to manage the add-on through Add-on Manager, enter a 2 (two) into this field.
- -If you disable this policy setting, the list is deleted. The 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting will still determine whether add-ons not in this list are assumed to be denied.
- -**InternetExplorer/AllowEnhancedProtectedMode** - -Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced Protected Mode also limits the locations Internet Explorer can read from in the registry and the file system.
- -If you enable this policy setting, Enhanced Protected Mode will be turned on. Any zone that has Protected Mode enabled will use Enhanced Protected Mode. Users will not be able to disable Enhanced Protected Mode.
- -If you disable this policy setting, Enhanced Protected Mode will be turned off. Any zone that has Protected Mode enabled will use the version of Protected Mode introduced in Internet Explorer 7 for Windows Vista.
- -If you do not configure this policy, users will be able to turn on or turn off Enhanced Protected Mode on the Advanced tab of the Internet Options dialog.
- -**InternetExplorer/AllowEnterpriseModeFromToolsMenu** - -This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the Tools menu.
- -If you turn this setting on, users can see and use the Enterprise Mode option from the Tools menu. If you turn this setting on, but don't specify a report location, Enterprise Mode will still be available to your users, but you won't get any reports.
- -If you disable or don't configure this policy setting, the menu option won't appear and users won't be able to run websites in Enterprise Mode.
- -**InternetExplorer/AllowEnterpriseModeSiteList** - -This policy setting lets you specify where to find the list of websites you want opened using Enterprise Mode IE, instead of Standard mode, because of compatibility issues. Users can't edit this list.
- -If you enable this policy setting, Internet Explorer downloads the website list from your location (HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\Main\EnterpriseMode), opening all listed websites using Enterprise Mode IE.
- -If you disable or don't configure this policy setting, Internet Explorer opens all websites using Standards mode.
- -**InternetExplorer/AllowInternetExplorer7PolicyList ** - -This policy setting allows you to add specific sites that must be viewed in Internet Explorer 7 Compatibility View.
- -If you enable this policy setting, the user can add and remove sites from the list, but the user cannot remove the entries that you specify.
- -If you disable or do not configure this policy setting, the user can add and remove sites from the list.
- -**InternetExplorer/AllowInternetExplorerStandardsMode** - -This policy setting controls how Internet Explorer displays local intranet content. Intranet content is defined as any webpage that belongs to the local intranet security zone.
- -If you enable this policy setting, Internet Explorer uses the current user agent string for local intranet content. Additionally, all local intranet Standards Mode pages appear in the Standards Mode available with the latest version of Internet Explorer. The user cannot change this behavior through the Compatibility View Settings dialog box.
- -If you disable this policy setting, Internet Explorer uses an Internet Explorer 7 user agent string (with an additional string appended) for local intranet content. Additionally, all local intranet Standards Mode pages appear in Internet Explorer 7 Standards Mode. The user cannot change this behavior through the Compatibility View Settings dialog box.
- -If you do not configure this policy setting, Internet Explorer uses an Internet Explorer 7 user agent string (with an additional string appended) for local intranet content. Additionally, all local intranet Standards Mode pages appear in Internet Explorer 7 Standards Mode. This option results in the greatest compatibility with existing webpages, but newer content written to common Internet standards may be displayed incorrectly. This option matches the default behavior of Internet Explorer.
- -**InternetExplorer/AllowInternetZoneTemplate** - -This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
- -If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
- -If you disable this template policy setting, no security level is configured.
- -If you do not configure this template policy setting, no security level is configured.
- -Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.
- -Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
- -**InternetExplorer/AllowIntranetZoneTemplate** - -This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
- -If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
- -If you disable this template policy setting, no security level is configured.
- -If you do not configure this template policy setting, no security level is configured.
- -Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.
- -Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
- -**InternetExplorer/AllowLocalMachineZoneTemplate** - -This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
- -If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
- -If you disable this template policy setting, no security level is configured.
- -If you do not configure this template policy setting, no security level is configured.
- -Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.
- -Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
- -**InternetExplorer/AllowLockedDownInternetZoneTemplate** - -This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
- -If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
- -If you disable this template policy setting, no security level is configured.
- -If you do not configure this template policy setting, no security level is configured.
- -Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.
- -Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
- -**InternetExplorer/AllowLockedDownIntranetZoneTemplate** - -This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
- -If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
- -If you disable this template policy setting, no security level is configured.
- -If you do not configure this template policy setting, no security level is configured.
- -Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.
- -Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
- -**InternetExplorer/AllowLockedDownLocalMachineZoneTemplate** - -This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
- -If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
- -If you disable this template policy setting, no security level is configured.
- -If you do not configure this template policy setting, no security level is configured.
- -Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.
- -Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
- -**InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate** - -This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
- -If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
- -If you disable this template policy setting, no security level is configured.
- -If you do not configure this template policy setting, no security level is configured.
- -Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.
- -Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
- -**InternetExplorer/AllowOneWordEntry** - -This policy allows the user to go directly to an intranet site for a one-word entry in the Address bar.
- -If you enable this policy setting, Internet Explorer goes directly to an intranet site for a one-word entry in the Address bar, if it is available.
- -If you disable or do not configure this policy setting, Internet Explorer does not go directly to an intranet site for a one-word entry in the Address bar.
- -**InternetExplorer/AllowSiteToZoneAssignmentList** - -This policy setting allows you to manage a list of sites that you want to associate with a particular security zone. These zone numbers have associated security settings that apply to all of the sites in the zone.
- -Internet Explorer has 4 security zones, numbered 1-4, and these are used by this policy setting to associate sites to zones. They are: (1) Intranet zone, (2) Trusted Sites zone, (3) Internet zone, and (4) Restricted Sites zone. Security settings can be set for each of these zones through other policy settings, and their default settings are: Trusted Sites zone (Low template), Intranet zone (Medium-Low template), Internet zone (Medium template), and Restricted Sites zone (High template). (The Local Machine zone and its locked down equivalent have special security settings that protect your local computer.)
- -If you enable this policy setting, you can enter a list of sites and their related zone numbers. The association of a site with a zone will ensure that the security settings for the specified zone are applied to the site. For each entry that you add to the list, enter the following information:
- -Valuename A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also includea specificprotocol. For example, if you enter http://www.contoso.comas the valuename, other protocols are not affected.If you enter just www.contoso.com,then all protocolsare affected for that site, including http, https, ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for www.contoso.com and www.contoso.com/mail would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict.
- -Value - A number indicating the zone with which this site should be associated for security settings. The Internet Explorer zones described above are 1-4.
- -If you disable or do not configure this policy, users may choose their own site-to-zone assignments.
- -**InternetExplorer/AllowSuggestedSites** - -This policy setting controls the Suggested Sites feature, which recommends websites based on the users browsing activity. Suggested Sites reports a users browsing history to Microsoft to suggest sites that the user might want to visit.
- -If you enable this policy setting, the user is not prompted to enable Suggested Sites. The users browsing history is sent to Microsoft to produce suggestions.
- -If you disable this policy setting, the entry points and functionality associated with this feature are turned off.
- -If you do not configure this policy setting, the user can turn on and turn off the Suggested Sites feature.
- -**InternetExplorer/AllowTrustedSitesZoneTemplate** - -This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
- -If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
- -If you disable this template policy setting, no security level is configured.
- -If you do not configure this template policy setting, no security level is configured.
- -Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.
- -Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
- -**InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate** - -This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
- -If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
- -If you disable this template policy setting, no security level is configured.
- -If you do not configure this template policy setting, no security level is configured.
- -Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.
- -Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
- -**InternetExplorer/AllowsRestrictedSitesZoneTemplate** - -This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
- -If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
- -If you disable this template policy setting, no security level is configured.
- -If you do not configure this template policy setting, no security level is configured.
- -Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.
- -Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
- -**InternetExplorer/DisableAdobeFlash** - -This policy setting turns off Adobe Flash in Internet Explorer and prevents applications from using Internet Explorer technology to instantiate Flash objects.
- -If you enable this policy setting, Flash is turned off for Internet Explorer, and applications cannot use Internet Explorer technology to instantiate Flash objects. In the Manage Add-ons dialog box, the Flash status will be 'Disabled', and users cannot enable Flash. If you enable this policy setting, Internet Explorer will ignore settings made for Adobe Flash through the "Add-on List" and "Deny all add-ons unless specifically allowed in the Add-on List" policy settings.
- -If you disable, or do not configure this policy setting, Flash is turned on for Internet Explorer, and applications can use Internet Explorer technology to instantiate Flash objects. Users can enable or disable Flash in the Manage Add-ons dialog box.
- -Note that Adobe Flash can still be disabled through the "Add-on List" and "Deny all add-ons unless specifically allowed in the Add-on List" policy settings, even if this policy setting is disabled, or not configured. However, if Adobe Flash is disabled through the "Add-on List" and "Deny all add-ons unless specifically allowed in the Add-on List" policy settings and not through this policy setting, all applications that use Internet Explorer technology to instantiate Flash object can still do so. For more information, see "Group Policy Settings in Internet Explorer 10" in the Internet Explorer TechNet library.
- -**InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation** - -This policy setting prevents the user from participating in the Customer Experience Improvement Program (CEIP).
- -If you enable this policy setting, the user cannot participate in the CEIP, and the Customer Feedback Options command does not appear on the Help menu.
- -If you disable this policy setting, the user must participate in the CEIP, and the Customer Feedback Options command does not appear on the Help menu.
- -If you do not configure this policy setting, the user can choose to participate in the CEIP.
- -**InternetExplorer/DisableEnclosureDownloading** - -This policy setting prevents the user from having enclosures (file attachments) downloaded from a feed to the user's computer.
- -If you enable this policy setting, the user cannot set the Feed Sync Engine to download an enclosure through the Feed property page. A developer cannot change the download setting through the Feed APIs.
- -If you disable or do not configure this policy setting, the user can set the Feed Sync Engine to download an enclosure through the Feed property page. A developer can change the download setting through the Feed APIs.
- -**InternetExplorer/DisableEncryptionSupport** - -This policy setting allows you to turn off support for Transport Layer Security (TLS) 1.0, TLS 1.1, TLS 1.2, Secure Sockets Layer (SSL) 2.0, or SSL 3.0 in the browser. TLS and SSL are protocols that help protect communication between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each others list of supported protocols and versions, and they select the most preferred match.
- -If you enable this policy setting, the browser negotiates or does not negotiate an encryption tunnel by using the encryption methods that you select from the drop-down list.
- -If you disable or do not configure this policy setting, the user can select which encryption method the browser supports.
- -Note: SSL 2.0 is off by default and is no longer supported starting with Windows 10 Version 1607. SSL 2.0 is an outdated security protocol, and enabling SSL 2.0 impairs the performance and functionality of TLS 1.0.
- -**InternetExplorer/DisableFirstRunWizard** - -This policy setting prevents Internet Explorer from running the First Run wizard the first time a user starts the browser after installing Internet Explorer or Windows.
- -If you enable this policy setting, you must make one of the following choices: - Skip the First Run wizard, and go directly to the user's home page. - Skip the First Run wizard, and go directly to the "Welcome to Internet Explorer" webpage.
- -Starting with Windows 8, the "Welcome to Internet Explorer" webpage is not available. The user's home page will display regardless of which option is chosen.
- -If you disable or do not configure this policy setting, Internet Explorer may run the First Run wizard the first time the browser is started after installation.
- -**InternetExplorer/DisableFlipAheadFeature** - -This policy setting determines whether a user can swipe across a screen or click Forward to go to the next pre-loaded page of a website.
- -Microsoft collects your browsing history to improve how flip ahead with page prediction works. This feature isn't available for Internet Explorer for the desktop.
- -If you enable this policy setting, flip ahead with page prediction is turned off and the next webpage isn't loaded into the background.
- -If you disable this policy setting, flip ahead with page prediction is turned on and the next webpage is loaded into the background.
- -If you don't configure this setting, users can turn this behavior on or off, using the Settings charm.
- -**InternetExplorer/DisableHomePageChange** - -The Home page specified on the General tab of the Internet Options dialog box is the default Web page that Internet Explorer loads whenever it is run.
- -If you enable this policy setting, a user cannot set a custom default home page. You must specify which default home page should load on the user machine. For machines with at least Internet Explorer 7, the home page can be set within this policy to override other home page policies.
- -If you disable or do not configure this policy setting, the Home page box is enabled and users can choose their own home page.
- -**InternetExplorer/DisableSearchProviderChange** - -This policy setting prevents the user from changing the default search provider for the Address bar and the toolbar Search box.
- -If you enable this policy setting, the user cannot change the default search provider.
- -If you disable or do not configure this policy setting, the user can change the default search provider.
- -**InternetExplorer/DisableSecondaryHomePageChange** - -Secondary home pages are the default Web pages that Internet Explorer loads in separate tabs from the home page whenever the browser is run. This policy setting allows you to set default secondary home pages.
- -If you enable this policy setting, you can specify which default home pages should load as secondary home pages. The user cannot set custom default secondary home pages.
- -If you disable or do not configure this policy setting, the user can add secondary home pages.
- -Note: If the Disable Changing Home Page Settings policy is enabled, the user cannot add secondary home pages.
- -**InternetExplorer/DoNotBlockOutdatedActiveXControls** - -This policy setting determines whether Internet Explorer blocks specific outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.
- -If you enable this policy setting, Internet Explorer stops blocking outdated ActiveX controls.
- -If you disable or don't configure this policy setting, Internet Explorer continues to block specific outdated ActiveX controls.
- -For more information, see "Outdated ActiveX Controls" in the Internet Explorer TechNet library.
- -**InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains** - -This policy setting allows you to manage a list of domains on which Internet Explorer will stop blocking outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.
- -If you enable this policy setting, you can enter a custom list of domains for which outdated ActiveX controls won't be blocked in Internet Explorer. Each domain entry must be formatted like one of the following:
- -1. "domain.name.TLD". For example, if you want to include *.contoso.com/*, use "contoso.com" -2. "hostname". For example, if you want to include http://example, use "example" -3. "file:///path/filename.htm". For example, use "file:///C:/Users/contoso/Desktop/index.htm"
- -If you disable or don't configure this policy setting, the list is deleted and Internet Explorer continues to block specific outdated ActiveX controls on all domains in the Internet Zone.
- -For more information, see "Outdated ActiveX Controls" in the Internet Explorer TechNet library.
- -**InternetExplorer/IncludeAllLocalSites** - -This policy setting controls whether local sites which are not explicitly mapped into any Security Zone are forced into the local Intranet security zone.
- -If you enable this policy setting, local sites which are not explicitly mapped into a zone are considered to be in the Intranet Zone.
- -If you disable this policy setting, local sites which are not explicitly mapped into a zone will not be considered to be in the Intranet Zone (so would typically be in the Internet Zone).
- -If you do not configure this policy setting, users choose whether to force local sites into the Intranet Zone.
- -**InternetExplorer/IncludeAllNetworkPaths** - -This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone.
- -If you enable this policy setting, all network paths are mapped into the Intranet Zone.
- -If you disable this policy setting, network paths are not necessarily mapped into the Intranet Zone (other rules might map one there).
- -If you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone.
- -**InternetExplorer/InternetZoneAllowAccessToDataSources** - -This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
- -If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -**InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls** - -This policy setting manages whether users will be automatically prompted for ActiveX control installations.
- -If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
- -If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -**InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads** - -This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
- -If you enable this setting, users will receive a file download dialog for automatic download attempts.
- -If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.
- -**InternetExplorer/InternetZoneAllowFontDownloads** - -This policy setting allows you to manage whether pages of the zone may download HTML fonts.
- -If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
- -If you disable this policy setting, HTML fonts are prevented from downloading.
- -If you do not configure this policy setting, HTML fonts can be downloaded automatically.
- -**InternetExplorer/InternetZoneAllowLessPrivilegedSites** - -This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.
- -If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
- -If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -If you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.
- -**InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents** - -This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
- -If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
- -If you disable this policy setting, Internet Explorer will not execute unsigned managed components.
- -If you do not configure this policy setting, Internet Explorer will execute unsigned managed components.
- -**InternetExplorer/InternetZoneAllowScriptlets** - -This policy setting allows you to manage whether the user can run scriptlets.
- -If you enable this policy setting, the user can run scriptlets.
- -If you disable this policy setting, the user cannot run scriptlets.
- -If you do not configure this policy setting, the user can enable or disable scriptlets.
- -**InternetExplorer/InternetZoneAllowSmartScreenIE** - -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
- -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
- -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
- -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
- -Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
- -**InternetExplorer/InternetZoneAllowUserDataPersistence** - -This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
- -If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -**InternetExplorer/InternetZoneInitializeAndScriptActiveXControls** - -This policy setting allows you to manage ActiveX controls not marked as safe.
- -If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
- -If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.
- -If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -**InternetExplorer/InternetZoneNavigateWindowsAndFrames** - -This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
- -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
- -If you disable this policy setting, users cannot open windows and frames to access applications from different domains.
- -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
- -**InternetExplorer/IntranetZoneAllowAccessToDataSources** - -This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
- -If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you do not configure this policy setting, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
- -**InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls** - -This policy setting manages whether users will be automatically prompted for ActiveX control installations.
- -If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
- -If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -If you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
- -**InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads** - -This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
- -If you enable this setting, users will receive a file download dialog for automatic download attempts.
- -If you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts.
- -**InternetExplorer/IntranetZoneAllowFontDownloads** - -This policy setting allows you to manage whether pages of the zone may download HTML fonts.
- -If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
- -If you disable this policy setting, HTML fonts are prevented from downloading.
- -If you do not configure this policy setting, HTML fonts can be downloaded automatically.
- -**InternetExplorer/IntranetZoneAllowLessPrivilegedSites** - -This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.
- -If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
- -If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -If you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.
- -**InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents** - -This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
- -If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
- -If you disable this policy setting, Internet Explorer will not execute unsigned managed components.
- -If you do not configure this policy setting, Internet Explorer will execute unsigned managed components.
- -**InternetExplorer/IntranetZoneAllowScriptlets** - -This policy setting allows you to manage whether the user can run scriptlets.
- -If you enable this policy setting, the user can run scriptlets.
- -If you disable this policy setting, the user cannot run scriptlets.
- -If you do not configure this policy setting, the user can enable or disable scriptlets.
- -**InternetExplorer/IntranetZoneAllowSmartScreenIE** - -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
- -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
- -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
- -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
- -Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
- -**InternetExplorer/IntranetZoneAllowUserDataPersistence** - -This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
- -If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -**InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls** - -This policy setting allows you to manage ActiveX controls not marked as safe.
- -If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
- -If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.
- -If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -**InternetExplorer/IntranetZoneNavigateWindowsAndFrames** - -This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
- -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
- -If you disable this policy setting, users cannot open windows and frames to access applications from different domains.
- -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
- -**InternetExplorer/LocalMachineZoneAllowAccessToDataSources** - -This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
- -If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -**InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls** - -This policy setting manages whether users will be automatically prompted for ActiveX control installations.
- -If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
- -If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -If you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
- -**InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads** - -This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
- -If you enable this setting, users will receive a file download dialog for automatic download attempts.
- -If you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts.
- -**InternetExplorer/LocalMachineZoneAllowFontDownloads** - -This policy setting allows you to manage whether pages of the zone may download HTML fonts.
- -If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
- -If you disable this policy setting, HTML fonts are prevented from downloading.
- -If you do not configure this policy setting, HTML fonts can be downloaded automatically.
- -**InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites** - -This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
- -If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
- -If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -**InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents** - -This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
- -If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
- -If you disable this policy setting, Internet Explorer will not execute unsigned managed components.
- -If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.
- -**InternetExplorer/LocalMachineZoneAllowScriptlets** - -This policy setting allows you to manage whether the user can run scriptlets.
- -If you enable this policy setting, the user can run scriptlets.
- -If you disable this policy setting, the user cannot run scriptlets.
- -If you do not configure this policy setting, the user can enable or disable scriptlets.
- -**InternetExplorer/LocalMachineZoneAllowSmartScreenIE** - -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
- -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
- -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
- -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
- -Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
- -**InternetExplorer/LocalMachineZoneAllowUserDataPersistence** - -This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
- -If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -**InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls** - -This policy setting allows you to manage ActiveX controls not marked as safe.
- -If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
- -If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.
- -If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -If you do not configure this policy setting, users are queried whether to allow the control to be loaded with parameters or scripted.
- -**InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames** - -This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
- -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
- -If you disable this policy setting, users cannot open windows and frames to access applications from different domains.
- -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
- -**InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources** - -This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
- -If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -**InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls** - -This policy setting manages whether users will be automatically prompted for ActiveX control installations.
- -If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
- -If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -**InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads** - -This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
- -If you enable this setting, users will receive a file download dialog for automatic download attempts.
- -If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.
- -**InternetExplorer/LockedDownInternetZoneAllowFontDownloads** - -This policy setting allows you to manage whether pages of the zone may download HTML fonts.
- -If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
- -If you disable this policy setting, HTML fonts are prevented from downloading.
- -If you do not configure this policy setting, HTML fonts can be downloaded automatically.
- -**InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites** - -This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
- -If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
- -If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -**InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents** - -This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
- -If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
- -If you disable this policy setting, Internet Explorer will not execute unsigned managed components.
- -If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.
- -**InternetExplorer/LockedDownInternetZoneAllowScriptlets** - -This policy setting allows you to manage whether the user can run scriptlets.
- -If you enable this policy setting, the user can run scriptlets.
- -If you disable this policy setting, the user cannot run scriptlets.
- -If you do not configure this policy setting, the user can enable or disable scriptlets.
- -**InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE** - -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
- -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
- -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
- -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
- -Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
- -**InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence** - -This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
- -If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -**InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls** - -This policy setting allows you to manage ActiveX controls not marked as safe.
- -If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
- -If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.
- -If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -**InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames** - -This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
- -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
- -If you disable this policy setting, users cannot open windows and frames to access applications from different domains.
- -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
- -**InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources** - -This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
- -If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you do not configure this policy setting, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
- -**InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls** - -This policy setting manages whether users will be automatically prompted for ActiveX control installations.
- -If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
- -If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -**InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads** - -This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
- -If you enable this setting, users will receive a file download dialog for automatic download attempts.
- -If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.
- -**InternetExplorer/LockedDownIntranetZoneAllowFontDownloads** - -This policy setting allows you to manage whether pages of the zone may download HTML fonts.
- -If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
- -If you disable this policy setting, HTML fonts are prevented from downloading.
- -If you do not configure this policy setting, HTML fonts can be downloaded automatically.
- -**InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites** - -This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
- -If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
- -If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -**InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents** - -This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
- -If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
- -If you disable this policy setting, Internet Explorer will not execute unsigned managed components.
- -If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.
- -**InternetExplorer/LockedDownIntranetZoneAllowScriptlets** - -This policy setting allows you to manage whether the user can run scriptlets.
- -If you enable this policy setting, the user can run scriptlets.
- -If you disable this policy setting, the user cannot run scriptlets.
- -If you do not configure this policy setting, the user can enable or disable scriptlets.
- -**InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE** - -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
- -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
- -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
- -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
- -Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
- -**InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence** - -This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
- -If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -**InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls** - -This policy setting allows you to manage ActiveX controls not marked as safe.
- -If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
- -If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.
- -If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -**InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames** - -This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
- -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
- -If you disable this policy setting, users cannot open windows and frames to access applications from different domains.
- -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
- -**InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources** - -This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
- -If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -**InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls** - -This policy setting manages whether users will be automatically prompted for ActiveX control installations.
- -If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
- -If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -**InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads** - -This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
- -If you enable this setting, users will receive a file download dialog for automatic download attempts.
- -If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.
- -**InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads** - -This policy setting allows you to manage whether pages of the zone may download HTML fonts.
- -If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
- -If you disable this policy setting, HTML fonts are prevented from downloading.
- -If you do not configure this policy setting, HTML fonts can be downloaded automatically.
- -**InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites** - -This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
- -If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
- -If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -**InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents** - -This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
- -If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
- -If you disable this policy setting, Internet Explorer will not execute unsigned managed components.
- -If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.
- -**InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets** - -This policy setting allows you to manage whether the user can run scriptlets.
- -If you enable this policy setting, the user can run scriptlets.
- -If you disable this policy setting, the user cannot run scriptlets.
- -If you do not configure this policy setting, the user can enable or disable scriptlets.
- -**InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE** - -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
- -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
- -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
- -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
- -Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
- -**InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence** - -This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
- -If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -**InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls** - -This policy setting allows you to manage ActiveX controls not marked as safe.
- -If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
- -If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.
- -If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -**InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames** - -This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
- -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
- -If you disable this policy setting, users cannot open windows and frames to access applications from different domains.
- -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
- -**InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources** - -This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
- -If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -**InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls** - -This policy setting manages whether users will be automatically prompted for ActiveX control installations.
- -If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
- -If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -**InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads** - -This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
- -If you enable this setting, users will receive a file download dialog for automatic download attempts.
- -If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.
- -**InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads** - -This policy setting allows you to manage whether pages of the zone may download HTML fonts.
- -If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
- -If you disable this policy setting, HTML fonts are prevented from downloading.
- -If you do not configure this policy setting, users are queried whether to allow HTML fonts to download.
- -**InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites** - -This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
- -If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
- -If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -**InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents** - -This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
- -If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
- -If you disable this policy setting, Internet Explorer will not execute unsigned managed components.
- -If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.
- -**InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets** - -This policy setting allows you to manage whether the user can run scriptlets.
- -If you enable this policy setting, the user can run scriptlets.
- -If you disable this policy setting, the user cannot run scriptlets.
- -If you do not configure this policy setting, the user can enable or disable scriptlets.
- -**InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE** - -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
- -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
- -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
- -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
- -Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
- -**InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence** - -This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
- -If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you do not configure this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -**InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls** - -This policy setting allows you to manage ActiveX controls not marked as safe.
- -If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
- -If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.
- -If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -**InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames** - -This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
- -If you enable this policy setting, users can open additional windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow additional windows and frames to access applications from other domains.
- -If you disable this policy setting, users cannot open other windows and frames from other domains or access applications from different domains.
- -If you do not configure this policy setting, users cannot open other windows and frames from different domains or access applications from different domains.
- -**InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources** - -This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
- -If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -**InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls** - -This policy setting manages whether users will be automatically prompted for ActiveX control installations.
- -If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
- -If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -**InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads** - -This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
- -If you enable this setting, users will receive a file download dialog for automatic download attempts.
- -If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.
- -**InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads** - -This policy setting allows you to manage whether pages of the zone may download HTML fonts.
- -If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
- -If you disable this policy setting, HTML fonts are prevented from downloading.
- -If you do not configure this policy setting, HTML fonts can be downloaded automatically.
- -**InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites** - -This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
- -If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
- -If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -**InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents** - -This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
- -If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
- -If you disable this policy setting, Internet Explorer will not execute unsigned managed components.
- -If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.
- -**InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets** - -This policy setting allows you to manage whether the user can run scriptlets.
- -If you enable this policy setting, the user can run scriptlets.
- -If you disable this policy setting, the user cannot run scriptlets.
- -If you do not configure this policy setting, the user can enable or disable scriptlets.
- -**InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE** - -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
- -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
- -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
- -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
- -Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
- -**InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence** - -This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
- -If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -**InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls** - -This policy setting allows you to manage ActiveX controls not marked as safe.
- -If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
- -If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.
- -If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -**InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames** - -This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
- -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
- -If you disable this policy setting, users cannot open windows and frames to access applications from different domains.
- -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
- -**InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources** - -This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
- -If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -**InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls** - -This policy setting manages whether users will be automatically prompted for ActiveX control installations.
- -If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
- -If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -**InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads** - -This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
- -If you enable this setting, users will receive a file download dialog for automatic download attempts.
- -If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.
- -**InternetExplorer/RestrictedSitesZoneAllowFontDownloads** - -This policy setting allows you to manage whether pages of the zone may download HTML fonts.
- -If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
- -If you disable this policy setting, HTML fonts are prevented from downloading.
- -If you do not configure this policy setting, users are queried whether to allow HTML fonts to download.
- -**InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites** - -This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
- -If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
- -If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -**InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents** - -This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
- -If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
- -If you disable this policy setting, Internet Explorer will not execute unsigned managed components.
- -If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.
- -**InternetExplorer/RestrictedSitesZoneAllowScriptlets** - -This policy setting allows you to manage whether the user can run scriptlets.
- -If you enable this policy setting, the user can run scriptlets.
- -If you disable this policy setting, the user cannot run scriptlets.
- -If you do not configure this policy setting, the user can enable or disable scriptlets.
- -**InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE** - -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
- -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
- -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
- -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
- -Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
- -**InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence** - -This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
- -If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you do not configure this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -**InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls** - -This policy setting allows you to manage ActiveX controls not marked as safe.
- -If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
- -If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.
- -If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -**InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames** - -This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
- -If you enable this policy setting, users can open additional windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow additional windows and frames to access applications from other domains.
- -If you disable this policy setting, users cannot open other windows and frames from other domains or access applications from different domains.
- -If you do not configure this policy setting, users cannot open other windows and frames from different domains or access applications from different domains.
- -**InternetExplorer/SearchProviderList** - -This policy setting allows you to restrict the search providers that appear in the Search box in Internet Explorer to those defined in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Normally, search providers can be added from third-party toolbars or in Setup, but the user can also add them from a search provider's website.
- -If you enable this policy setting, the user cannot configure the list of search providers on his or her computer, and any default providers installed do not appear (including providers installed from other applications). The only providers that appear are those in the list of policy keys for search providers. Note: This list can be created through a custom administrative template file. For information about creating this custom administrative template file, see the Internet Explorer documentation on search providers.
- -If you disable or do not configure this policy setting, the user can configure his or her list of search providers.
- -**InternetExplorer/TrustedSitesZoneAllowAccessToDataSources** - -This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
- -If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
- -**InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls** - -This policy setting manages whether users will be automatically prompted for ActiveX control installations.
- -If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
- -If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
- -If you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
- -**InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads** - -This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
- -If you enable this setting, users will receive a file download dialog for automatic download attempts.
- -If you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts.
- -**InternetExplorer/TrustedSitesZoneAllowFontDownloads** - -This policy setting allows you to manage whether pages of the zone may download HTML fonts.
- -If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
- -If you disable this policy setting, HTML fonts are prevented from downloading.
- -If you do not configure this policy setting, HTML fonts can be downloaded automatically.
- -**InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites** - -This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.
- -If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
- -If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
- -If you do not configure this policy setting, a warning is issued to the user that potentially risky navigation is about to occur.
- -**InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents** - -This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
- -If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
- -If you disable this policy setting, Internet Explorer will not execute unsigned managed components.
- -If you do not configure this policy setting, Internet Explorer will execute unsigned managed components.
- -**InternetExplorer/TrustedSitesZoneAllowScriptlets** - -This policy setting allows you to manage whether the user can run scriptlets.
- -If you enable this policy setting, the user can run scriptlets.
- -If you disable this policy setting, the user cannot run scriptlets.
- -If you do not configure this policy setting, the user can enable or disable scriptlets.
- -**InternetExplorer/TrustedSitesZoneAllowSmartScreenIE** - -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
- -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
- -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
- -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
- -Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
- -**InternetExplorer/TrustedSitesZoneAllowUserDataPersistence** - -This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
- -If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
- -**InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls** - -This policy setting allows you to manage ActiveX controls not marked as safe.
- -If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
- -If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.
- -If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
- -If you do not configure this policy setting, users are queried whether to allow the control to be loaded with parameters or scripted.
- -**InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames** - -This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
- -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
- -If you disable this policy setting, users cannot open windows and frames to access applications from different domains.
- -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
- -**Kerberos/AllowForestSearchOrder** - -This policy setting defines the list of trusting forests that the Kerberos client searches when attempting to resolve two-part service principal names (SPNs).
- -If you enable this policy setting, the Kerberos client searches the forests in this list, if it is unable to resolve a two-part SPN. If a match is found, the Kerberos client requests a referral ticket to the appropriate domain.
- -If you disable or do not configure this policy setting, the Kerberos client does not search the listed forests to resolve the SPN. If the Kerberos client is unable to resolve the SPN because the name is not found, NTLM authentication might be used.
- -**Kerberos/KerberosClientSupportsClaimsCompoundArmor** - -This policy setting controls whether a device will request claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication with domains that support these features. -If you enable this policy setting, the client computers will request claims, provide information required to create compounded authentication and armor Kerberos messages in domains which support claims and compound authentication for Dynamic Access Control and Kerberos armoring.
- -If you disable or do not configure this policy setting, the client devices will not request claims, provide information required to create compounded authentication and armor Kerberos messages. Services hosted on the device will not be able to retrieve claims for clients using Kerberos protocol transition. -
- -**Kerberos/RequireKerberosArmoring** - -This policy setting controls whether a computer requires that Kerberos message exchanges be armored when communicating with a domain controller.
- -Warning: When a domain does not support Kerberos armoring by enabling "Support Dynamic Access Control and Kerberos armoring", then all authentication for all its users will fail from computers with this policy setting enabled.
- -If you enable this policy setting, the client computers in the domain enforce the use of Kerberos armoring in only authentication service (AS) and ticket-granting service (TGS) message exchanges with the domain controllers.
- -Note: The Kerberos Group Policy "Kerberos client support for claims, compound authentication and Kerberos armoring" must also be enabled to support Kerberos armoring.
- -If you disable or do not configure this policy setting, the client computers in the domain enforce the use of Kerberos armoring when possible as supported by the target domain. -
- -**Kerberos/RequireStrictKDCValidation** - -This policy setting controls the Kerberos client's behavior in validating the KDC certificate for smart card and system certificate logon.
- -If you enable this policy setting, the Kerberos client requires that the KDC's X.509 certificate contains the KDC key purpose object identifier in the Extended Key Usage (EKU) extensions, and that the KDC's X.509 certificate contains a dNSName subjectAltName (SAN) extension that matches the DNS name of the domain. If the computer is joined to a domain, the Kerberos client requires that the KDC's X.509 certificate must be signed by a Certificate Authority (CA) in the NTAuth store. If the computer is not joined to a domain, the Kerberos client allows the root CA certificate on the smart card to be used in the path validation of the KDC's X.509 certificate.
- -If you disable or do not configure this policy setting, the Kerberos client requires only that the KDC certificate contain the Server Authentication purpose object identifier in the EKU extensions which can be issued to any server. -
- -**Kerberos/SetMaximumContextTokenSize** - -This policy setting allows you to set the value returned to applications which request the maximum size of the SSPI context token buffer size. - -The size of the context token buffer determines the maximum size of SSPI context tokens an application expects and allocates. Depending upon authentication request processing and group memberships, the buffer might be smaller than the actual size of the SSPI context token.
- -If you enable this policy setting, the Kerberos client or server uses the configured value, or the locally allowed maximum value, whichever is smaller.
- -If you disable or do not configure this policy setting, the Kerberos client or server uses the locally configured value or the default value.
- -Note: This policy setting configures the existing MaxTokenSize registry value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters, which was added in Windows XP and Windows Server 2003, with a default value of 12,000 bytes. Beginning with Windows 8 the default is 48,000 bytes. Due to HTTP's base64 encoding of authentication context tokens, it is not advised to set this value more than 48,000 bytes.
- - - -**Power/AllowStandbyWhenSleepingPluggedIn** - -This policy setting manages whether or not Windows is allowed to use standby states when putting the computer in a sleep state.
- -If you enable this policy setting, Windows uses standby states to put the computer in a sleep state.
- -If you disable or do not configure this policy setting, the only sleep state a computer may enter is hibernate.
- -**Power/RequirePasswordWhenComputerWakesOnBattery** - -This policy setting specifies whether or not the user is prompted for a password when the system resumes from sleep.
- -If you enable or do not configure this policy setting, the user is prompted for a password when the system resumes from sleep.
- -If you disable this policy setting, the user is not prompted for a password when the system resumes from sleep.
- -**Power/RequirePasswordWhenComputerWakesPluggedIn** - -This policy setting specifies whether or not the user is prompted for a password when the system resumes from sleep.
- -If you enable or do not configure this policy setting, the user is prompted for a password when the system resumes from sleep.
- -If you disable this policy setting, the user is not prompted for a password when the system resumes from sleep.
- -**Printers/PointAndPrintRestrictions** - -This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain.
- -If you enable this policy setting: - -Windows XP and later clients will only download print driver components from a list of explicitly named servers. If a compatible print driver is available on the client, a printer connection will be made. If a compatible print driver is not available on the client, no connection will be made. - -You can configure Windows Vista clients so that security warnings and elevated command prompts do not appear when users Point and Print, or when printer connection drivers need to be updated.
- -If you do not configure this policy setting: - -Windows Vista client computers can point and print to any server. - -Windows Vista computers will show a warning and an elevated command prompt when users create a printer connection to any server using Point and Print. - -Windows Vista computers will show a warning and an elevated command prompt when an existing printer connection driver needs to be updated. - -Windows Server 2003 and Windows XP client computers can create a printer connection to any server in their forest using Point and Print.
- -If you disable this policy setting: - -Windows Vista client computers can create a printer connection to any server using Point and Print. - -Windows Vista computers will not show a warning or an elevated command prompt when users create a printer connection to any server using Point and Print. - -Windows Vista computers will not show a warning or an elevated command prompt when an existing printer connection driver needs to be updated. - -Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print. - -The "Users can only point and print to computers in their forest" setting applies only to Windows Server 2003 and Windows XP SP1 (and later service packs).
- -**Printers/PointAndPrintRestrictions_User** - -This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain.
- -If you enable this policy setting: - -Windows XP and later clients will only download print driver components from a list of explicitly named servers. If a compatible print driver is available on the client, a printer connection will be made. If a compatible print driver is not available on the client, no connection will be made. - -You can configure Windows Vista clients so that security warnings and elevated command prompts do not appear when users Point and Print, or when printer connection drivers need to be updated.
- -If you do not configure this policy setting: - -Windows Vista client computers can point and print to any server. - -Windows Vista computers will show a warning and an elevated command prompt when users create a printer connection to any server using Point and Print. - -Windows Vista computers will show a warning and an elevated command prompt when an existing printer connection driver needs to be updated. - -Windows Server 2003 and Windows XP client computers can create a printer connection to any server in their forest using Point and Print.
- -If you disable this policy setting: - -Windows Vista client computers can create a printer connection to any server using Point and Print. - -Windows Vista computers will not show a warning or an elevated command prompt when users create a printer connection to any server using Point and Print. - -Windows Vista computers will not show a warning or an elevated command prompt when an existing printer connection driver needs to be updated. - -Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print. - -The "Users can only point and print to computers in their forest" setting applies only to Windows Server 2003 and Windows XP SP1 (and later service packs).
- -**Printers/PublishPrinters** - -Determines whether the computer's shared printers can be published in Active Directory.
- -If you enable this setting or do not configure it, users can use the "List in directory" option in the Printer's Properties' Sharing tab to publish shared printers in Active Directory.
- -If you disable this setting, this computer's shared printers cannot be published in Active Directory, and the "List in directory" option is not available.
- -Note: This settings takes priority over the setting "Automatically publish new printers in the Active Directory".
- -**RemoteAssistance/CustomizeWarningMessages** - -This policy setting lets you customize warning messages.
- -The "Display warning message before sharing control" policy setting allows you to specify a custom message to display before a user shares control of his or her computer.
- -The "Display warning message before connecting" policy setting allows you to specify a custom message to display before a user allows a connection to his or her computer.
- -If you enable this policy setting, the warning message you specify overrides the default message that is seen by the novice.
- -If you disable this policy setting, the user sees the default warning message.
- -If you do not configure this policy setting, the user sees the default warning message.
- -**RemoteAssistance/SessionLogging** - -This policy setting allows you to turn logging on or off. Log files are located in the user's Documents folder under Remote Assistance.
- -If you enable this policy setting, log files are generated.
- -If you disable this policy setting, log files are not generated.
- -If you do not configure this setting, application-based settings are used.
- -**RemoteAssistance/SolicitedRemoteAssistance** - -This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer.
- -If you enable this policy setting, users on this computer can use email or file transfer to ask someone for help. Also, users can use instant messaging programs to allow connections to this computer, and you can configure additional Remote Assistance settings.
- -If you disable this policy setting, users on this computer cannot use email or file transfer to ask someone for help. Also, users cannot use instant messaging programs to allow connections to this computer.
- -If you do not configure this policy setting, users can turn on or turn off Solicited (Ask for) Remote Assistance themselves in System Properties in Control Panel. Users can also configure Remote Assistance settings.
- -If you enable this policy setting, you have two ways to allow helpers to provide Remote Assistance: "Allow helpers to only view the computer" or "Allow helpers to remotely control the computer."
- -The "Maximum ticket time" policy setting sets a limit on the amount of time that a Remote Assistance invitation created by using email or file transfer can remain open.
- -The "Select the method for sending email invitations" setting specifies which email standard to use to send Remote Assistance invitations. Depending on your email program, you can use either the Mailto standard (the invitation recipient connects through an Internet link) or the SMAPI (Simple MAPI) standard (the invitation is attached to your email message). This policy setting is not available in Windows Vista since SMAPI is the only method supported.
- -If you enable this policy setting you should also enable appropriate firewall exceptions to allow Remote Assistance communications.
- -**RemoteAssistance/UnsolicitedRemoteAssistance** - -This policy setting allows you to turn on or turn off Offer (Unsolicited) Remote Assistance on this computer.
- -If you enable this policy setting, users on this computer can get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance.
- -If you disable this policy setting, users on this computer cannot get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance.
- -If you do not configure this policy setting, users on this computer cannot get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance.
- -If you enable this policy setting, you have two ways to allow helpers to provide Remote Assistance: "Allow helpers to only view the computer" or "Allow helpers to remotely control the computer." When you configure this policy setting, you also specify the list of users or user groups that are allowed to offer remote assistance.
- -To configure the list of helpers, click "Show." In the window that opens, you can enter the names of the helpers. Add each user or group one by one. When you enter the name of the helper user or user groups, use the following format:
- -If you enable this policy setting, you should also enable firewall exceptions to allow Remote Assistance communications. The firewall exceptions required for Offer (Unsolicited) Remote Assistance depend on the version of Windows you are running.
- -Windows Vista and later
- -Enable the Remote Assistance exception for the domain profile. The exception must contain: -Port 135:TCP -%WINDIR%\System32\msra.exe -%WINDIR%\System32\raserver.exe
- -Windows XP with Service Pack 2 (SP2) and Windows XP Professional x64 Edition with Service Pack 1 (SP1)
- -Port 135:TCP -%WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe -%WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe -%WINDIR%\System32\Sessmgr.exe
- -For computers running Windows Server 2003 with Service Pack 1 (SP1)
- -Port 135:TCP -%WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe -%WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe -Allow Remote Desktop Exception
- -**RemoteDesktopServices/AllowUsersToConnectRemotely** - -This policy setting allows you to configure remote access to computers by using Remote Desktop Services.
- -If you enable this policy setting, users who are members of the Remote Desktop Users group on the target computer can connect remotely to the target computer by using Remote Desktop Services.
- -If you disable this policy setting, users cannot connect remotely to the target computer by using Remote Desktop Services. The target computer will maintain any current connections, but will not accept any new incoming connections.
- -If you do not configure this policy setting, Remote Desktop Services uses the Remote Desktop setting on the target computer to determine whether the remote connection is allowed. This setting is found on the Remote tab in the System properties sheet. By default, remote connections are not allowed.
- -Note: You can limit which clients are able to connect remotely by using Remote Desktop Services by configuring the policy setting at Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security\Require user authentication for remote connections by using Network Level Authentication.
- -You can limit the number of users who can connect simultaneously by configuring the policy setting at Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Limit number of connections, or by configuring the policy setting Maximum Connections by using the Remote Desktop Session Host WMI Provider. -
- -**RemoteDesktopServices/ClientConnectionEncryptionLevel** - -Specifies whether to require the use of a specific encryption level to secure communications between client computers and RD Session Host servers during Remote Desktop Protocol (RDP) connections. This policy only applies when you are using native RDP encryption. However, native RDP encryption (as opposed to SSL encryption) is not recommended. This policy does not apply to SSL encryption.
- -If you enable this policy setting, all communications between clients and RD Session Host servers during remote connections must use the encryption method specified in this setting. By default, the encryption level is set to High. The following encryption methods are available:
- -* High: The High setting encrypts data sent from the client to the server and from the server to the client by using strong 128-bit encryption. Use this encryption level in environments that contain only 128-bit clients (for example, clients that run Remote Desktop Connection). Clients that do not support this encryption level cannot connect to RD Session Host servers.
- -* Client Compatible: The Client Compatible setting encrypts data sent between the client and the server at the maximum key strength supported by the client. Use this encryption level in environments that include clients that do not support 128-bit encryption.
- -* Low: The Low setting encrypts only data sent from the client to the server by using 56-bit encryption.
- -If you disable or do not configure this setting, the encryption level to be used for remote connections to RD Session Host servers is not enforced through Group Policy.
- -Important
- -FIPS compliance can be configured through the System cryptography. Use FIPS compliant algorithms for encryption, hashing, and signing settings in Group Policy (under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options.) The FIPS compliant setting encrypts and decrypts data sent from the client to the server and from the server to the client, with the Federal Information Processing Standard (FIPS) 140 encryption algorithms, by using Microsoft cryptographic modules. Use this encryption level when communications between clients and RD Session Host servers requires the highest level of encryption. -
- -**RemoteDesktopServices/DoNotAllowDriveRedirection** - -This policy setting specifies whether to prevent the mapping of client drives in a Remote Desktop Services session (drive redirection).
- -By default, an RD Session Host server maps client drives automatically upon connection. Mapped drives appear in the session folder tree in File Explorer or Computer in the format
If you enable this policy setting, client drive redirection is not allowed in Remote Desktop Services sessions, and Clipboard file copy redirection is not allowed on computers running Windows Server 2003, Windows 8, and Windows XP.
- -If you disable this policy setting, client drive redirection is always allowed. In addition, Clipboard file copy redirection is always allowed if Clipboard redirection is allowed.
- -If you do not configure this policy setting, client drive redirection and Clipboard file copy redirection are not specified at the Group Policy level. -
- -**RemoteDesktopServices/DoNotAllowPasswordSaving** - -Controls whether passwords can be saved on this computer from Remote Desktop Connection.
- -If you enable this setting the password saving checkbox in Remote Desktop Connection will be disabled and users will no longer be able to save passwords. When a user opens an RDP file using Remote Desktop Connection and saves his settings, any password that previously existed in the RDP file will be deleted.
- -If you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection.
- -**RemoteDesktopServices/PromptForPasswordUponConnection** - -This policy setting specifies whether Remote Desktop Services always prompts the client for a password upon connection.
- -You can use this setting to enforce a password prompt for users logging on to Remote Desktop Services, even if they already provided the password in the Remote Desktop Connection client.
- -By default, Remote Desktop Services allows users to automatically log on by entering a password in the Remote Desktop Connection client.
- -If you enable this policy setting, users cannot automatically log on to Remote Desktop Services by supplying their passwords in the Remote Desktop Connection client. They are prompted for a password to log on.
- -If you disable this policy setting, users can always log on to Remote Desktop Services automatically by supplying their passwords in the Remote Desktop Connection client.
- -If you do not configure this policy setting, automatic logon is not specified at the Group Policy level. -
- -**RemoteDesktopServices/RequireSecureRPCCommunication** - -Specifies whether a Remote Desktop Session Host server requires secure RPC communication with all clients or allows unsecured communication.
- -You can use this setting to strengthen the security of RPC communication with clients by allowing only authenticated and encrypted requests.
- -If the status is set to Enabled, Remote Desktop Services accepts requests from RPC clients that support secure requests, and does not allow unsecured communication with untrusted clients.
- -If the status is set to Disabled, Remote Desktop Services always requests security for all RPC traffic. However, unsecured communication is allowed for RPC clients that do not respond to the request.
- -If the status is set to Not Configured, unsecured communication is allowed.
- -Note: The RPC interface is used for administering and configuring Remote Desktop Services.
- -**RemoteProcedureCall/RPCEndpointMapperClientAuthentication** - -This policy setting controls whether RPC clients authenticate with the Endpoint Mapper Service when the call they are making contains authentication information. The Endpoint Mapper Service on computers running Windows NT4 (all service packs) cannot process authentication information supplied in this manner.
- -If you disable this policy setting, RPC clients will not authenticate to the Endpoint Mapper Service, but they will be able to communicate with the Endpoint Mapper Service on Windows NT4 Server.
- -If you enable this policy setting, RPC clients will authenticate to the Endpoint Mapper Service for calls that contain authentication information. Clients making such calls will not be able to communicate with the Windows NT4 Server Endpoint Mapper Service.
- -If you do not configure this policy setting, it remains disabled. RPC clients will not authenticate to the Endpoint Mapper Service, but they will be able to communicate with the Windows NT4 Server Endpoint Mapper Service.
- -Note: This policy will not be applied until the system is rebooted.
- -**RemoteProcedureCall/RestrictUnauthenticatedRPCClients** - -This policy setting controls how the RPC server runtime handles unauthenticated RPC clients connecting to RPC servers.
- -This policy setting impacts all RPC applications. In a domain environment this policy setting should be used with caution as it can impact a wide range of functionality including group policy processing itself. Reverting a change to this policy setting can require manual intervention on each affected machine. This policy setting should never be applied to a domain controller.
- -If you disable this policy setting, the RPC server runtime uses the value of "Authenticated" on Windows Client, and the value of "None" on Windows Server versions that support this policy setting.
- -If you do not configure this policy setting, it remains disabled. The RPC server runtime will behave as though it was enabled with the value of "Authenticated" used for Windows Client and the value of "None" used for Server SKUs that support this policy setting.
- -If you enable this policy setting, it directs the RPC server runtime to restrict unauthenticated RPC clients connecting to RPC servers running on a machine. A client will be considered an authenticated client if it uses a named pipe to communicate with the server or if it uses RPC Security. RPC Interfaces that have specifically requested to be accessible by unauthenticated clients may be exempt from this restriction, depending on the selected value for this policy setting.
- --- "None" allows all RPC clients to connect to RPC Servers running on the machine on which the policy setting is applied.
- --- "Authenticated" allows only authenticated RPC Clients (per the definition above) to connect to RPC Servers running on the machine on which the policy setting is applied. Exemptions are granted to interfaces that have requested them.
- --- "Authenticated without exceptions" allows only authenticated RPC Clients (per the definition above) to connect to RPC Servers running on the machine on which the policy setting is applied. No exceptions are allowed.
- -Note: This policy setting will not be applied until the system is rebooted.
- -**Storage/EnhancedStorageDevices** - -This policy setting configures whether or not Windows will activate an Enhanced Storage device.
- -If you enable this policy setting, Windows will not activate unactivated Enhanced Storage devices.
- -If you disable or do not configure this policy setting, Windows will activate unactivated Enhanced Storage devices.
- -**System/BootStartDriverInitialization** - -N/A
- -**System/DisableSystemRestore** - -Allows you to disable System Restore.
- -This policy setting allows you to turn off System Restore.
- -System Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files. By default, System Restore is turned on for the boot volume.
- -If you enable this policy setting, System Restore is turned off, and the System Restore Wizard cannot be accessed. The option to configure System Restore or create a restore point through System Protection is also disabled.
- -If you disable or do not configure this policy setting, users can perform System Restore and configure System Restore settings through System Protection.
- -Also, see the "Turn off System Restore configuration" policy setting. If the "Turn off System Restore" policy setting is disabled or not configured, the "Turn off System Restore configuration" policy setting is used to determine whether the option to configure System Restore is available.
- -**WindowsLogon/DisableLockScreenAppNotifications** - -This policy setting allows you to prevent app notifications from appearing on the lock screen.
- -If you enable this policy setting, no app notifications are displayed on the lock screen.
- -If you disable or do not configure this policy setting, users can choose which apps display notifications on the lock screen.
- -**WindowsLogon/DontDisplayNetworkSelectionUI** - -This policy setting allows you to control whether anyone can interact with available networks UI on the logon screen.
- -If you enable this policy setting, the PC's network connectivity state cannot be changed without signing into Windows.
- -If you disable or don't configure this policy setting, any user can disconnect the PC from the network or can connect the PC to other available networks without signing into Windows.
- - - - - - - diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 497278c57e..5b81c0026b 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1,15 +1,12 @@ --- title: Policy CSP description: Policy CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 4F3A1134-D401-44FC-A583-6EDD3070BA4F -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Policy CSP @@ -110,6 +107,9 @@ The following diagram shows the Policy configuration service provider in tree foSupported operations are Add and Get. Does not support Delete. +> [!Note] +> The policies supported in Windows 10 S is the same as in Windows 10 Pro, except that policies under AppliationsDefaults are not suppported in Windows 10 S. +
@@ -118,6 +118,29 @@ The following diagram shows the Policy configuration service provider in tree fo **AboveLock/AllowActionCenterNotifications** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **AboveLock/AllowCortanaAboveLock** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether or not the user can interact with Cortana using speech while the system is locked. If you enable or don’t configure this setting, the user can interact with Cortana using speech while the system is locked. If you disable this setting, the system will need to be unlocked for the user to interact with Cortana using speech. @@ -159,26 +190,34 @@ SKU Support: - 0 – Not allowed. - 1 (default) – Allowed. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **AboveLock/AllowToasts** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether to allow toast notifications above the device lock screen. @@ -189,26 +228,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Accounts/AllowAddingNonMicrosoftAccountsManually** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether user is allowed to add non-MSA email accounts. @@ -222,26 +269,34 @@ SKU Support: > [!NOTE] > This policy will only block UI/UX-based methods for adding non-Microsoft accounts. Even if this policy is enforced, you can still provision non-MSA accounts using the [EMAIL2 CSP](email2-csp.md). - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Accounts/AllowMicrosoftAccountConnection** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether the user is allowed to use an MSA account for non-email related connection authentication and services. @@ -252,26 +307,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Accounts/AllowMicrosoftAccountSignInAssistant** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. Allows IT Admins the ability to disable the "Microsoft Account Sign-In Assistant" (wlidsvc) NT service. @@ -280,27 +343,34 @@ SKU Support: - 0 – Disabled. - 1 (default) – Manual start. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Accounts/DomainNamesForEmailSync** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies a list of the domains that are allowed to sync email on the device. @@ -308,22 +378,7 @@ SKU Support:
The default value is an empty string, which allows all email accounts on the device to sync email. Otherwise, the string should contain a pipe-separated list of domains that are allowed to sync email on the device. For example, "contoso.com|fabrikam.net|woodgrove.gov". - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **ActiveXControls/ApprovedInstallationSites** @@ -337,9 +392,6 @@ If you disable or do not configure this policy setting, ActiveX controls prompt Note: Wild card characters cannot be used when specifying the host URLs. - - - ADMX Info: @@ -356,8 +408,6 @@ ADMX Info: This policy setting allows you to enable or disable Microsoft Application Virtualization (App-V) feature. Reboot is needed for disable to take effect. - - ADMX Info: @@ -374,8 +424,6 @@ ADMX Info: Enables Dynamic Virtualization of supported shell extensions, browser helper objects, and ActiveX controls. - - ADMX Info: @@ -392,8 +440,6 @@ ADMX Info: Enables automatic cleanup of appv packages that were added after Windows10 anniversary release. - - ADMX Info: @@ -410,8 +456,6 @@ ADMX Info: Enables scripts defined in the package manifest of configuration files that should run. - - ADMX Info: @@ -428,8 +472,6 @@ ADMX Info: Enables a UX to display to the user when a publishing refresh is performed on the client. - - ADMX Info: @@ -456,9 +498,6 @@ Data Cache Limit: This value specifies the maximum size in megabytes (MB) of the Data Block Size: This value specifies the maximum size in bytes to transmit to the server at once on a reporting upload, to avoid permanent transmission failures when the log has reached a significant size. The default value is 65536. When transmitting report data to the server, one block at a time of application records that is less than or equal to the block size in bytes of XML data will be removed from the cache and sent to the server. Each block will have the general Client data and global package list data prepended, and these will not factor into the block size calculations; the potential exists for an extremely large package list to result in transmission failures over low bandwidth or unreliable connections. - - - ADMX Info: @@ -475,8 +514,6 @@ ADMX Info: Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /FILEEXCLUSIONLIST='desktop;my pictures'. - - ADMX Info: @@ -493,8 +530,6 @@ ADMX Info: Specifies the registry paths that do not roam with a user profile. Example usage: /REGISTRYEXCLUSIONLIST=software\classes;software\clients. - - ADMX Info: @@ -511,8 +546,6 @@ ADMX Info: Specifies how new packages should be loaded automatically by App-V on a specific computer. - - ADMX Info: @@ -529,8 +562,6 @@ ADMX Info: Migration mode allows the App-V client to modify shortcuts and FTA's for packages created using a previous version of App-V. - - ADMX Info: @@ -547,8 +578,6 @@ ADMX Info: Specifies the location where symbolic links are created to the current version of a per-user published package. Shortcuts, file type associations, etc. are created pointing to this path. If empty, symbolic links are not used during publishing. Example: %localappdata%\Microsoft\AppV\Client\Integration. - - ADMX Info: @@ -565,8 +594,6 @@ ADMX Info: Specifies the location where symbolic links are created to the current version of a globally published package. Shortcuts, file type associations, etc. are created pointing to this path. If empty, symbolic links are not used during publishing. Example: %allusersprofile%\Microsoft\AppV\Client\Integration. - - ADMX Info: @@ -601,9 +628,6 @@ User Publishing Refresh Interval: Specifies the publishing refresh interval usin User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31). - - - ADMX Info: @@ -638,9 +662,6 @@ User Publishing Refresh Interval: Specifies the publishing refresh interval usin User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31). - - - ADMX Info: @@ -675,9 +696,6 @@ User Publishing Refresh Interval: Specifies the publishing refresh interval usin User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31). - - - ADMX Info: @@ -712,9 +730,6 @@ User Publishing Refresh Interval: Specifies the publishing refresh interval usin User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31). - - - ADMX Info: @@ -749,9 +764,6 @@ User Publishing Refresh Interval: Specifies the publishing refresh interval usin User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31). - - - ADMX Info: @@ -768,8 +780,6 @@ ADMX Info: Specifies the path to a valid certificate in the certificate store. - - ADMX Info: @@ -786,8 +796,6 @@ ADMX Info: This setting controls whether virtualized applications are launched on Windows 8 machines connected via a metered network connection (e.g. 4G). - - ADMX Info: @@ -804,8 +812,6 @@ ADMX Info: Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface. - - ADMX Info: @@ -822,8 +828,6 @@ ADMX Info: Specifies directory where all new applications and updates will be installed. - - ADMX Info: @@ -840,8 +844,6 @@ ADMX Info: Overrides source location for downloading package content. - - ADMX Info: @@ -858,8 +860,6 @@ ADMX Info: Specifies the number of seconds between attempts to reestablish a dropped session. - - ADMX Info: @@ -876,8 +876,6 @@ ADMX Info: Specifies the number of times to retry a dropped session. - - ADMX Info: @@ -894,8 +892,6 @@ ADMX Info: Specifies that streamed package contents will be not be saved to the local hard disk. - - ADMX Info: @@ -912,8 +908,6 @@ ADMX Info: If enabled, the App-V client will support BrancheCache compatible HTTP streaming. If BranchCache support is not desired, this should be disabled. The client can then apply HTTP optimizations which are incompatible with BranchCache - - ADMX Info: @@ -930,8 +924,6 @@ ADMX Info: Verifies Server certificate revocation status before streaming using HTTPS. - - ADMX Info: @@ -948,8 +940,6 @@ ADMX Info: Specifies a list of process paths (may contain wildcards) which are candidates for using virtual components (shell extensions, browser helper objects, etc). Only processes whose full path matches one of these items can use virtual components. - - ADMX Info: @@ -963,6 +953,29 @@ ADMX Info: **ApplicationDefaults/DefaultAssociationsConfiguration** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. This policy allows an administrator to set default file type and protocol associations. When set, default associations will be applied on sign-in to the PC. The association file can be created using the DISM tool (dism /online /export-defaultappassociations:appassoc.xml), and then needs to be base64 encoded before being added to SyncML. @@ -1020,27 +1033,34 @@ PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCjxEZWZhdWx0QXNzb2NpYXRpb25z ``` - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **ApplicationManagement/AllowAllTrustedApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether non Windows Store apps are allowed. @@ -1052,26 +1072,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **ApplicationManagement/AllowAppStoreAutoUpdate** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether automatic update of apps from Windows Store are allowed. @@ -1082,26 +1110,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **ApplicationManagement/AllowDeveloperUnlock** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether developer unlock is allowed. @@ -1113,26 +1149,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **ApplicationManagement/AllowGameDVR** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **ApplicationManagement/AllowSharedUserAppData** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether multiple users of the same app can share data. @@ -1176,26 +1228,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **ApplicationManagement/AllowStore** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether app store is allowed at the device. @@ -1206,26 +1266,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **ApplicationManagement/ApplicationRestrictions** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Value evaluation rule - The information for PolicyManager is opaque. There is no most restricted value evaluation. Whenever there is a change to the value, the device parses the node value and enforces specified policies. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **ApplicationManagement/DisableStoreOriginatedApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | 1 |
+ 1 |
+ |
+ |
+
Added in Windows 10, version 1607. Boolean value that disables the launch of all apps from Windows Store that came pre-installed or were downloaded. @@ -1279,26 +1355,34 @@ SKU Support: - 0 (default) – Enable launch of apps. - 1 – Disable launch of apps. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **ApplicationManagement/RequirePrivateStoreOnly** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows disabling of the retail catalog and only enables the Private store. @@ -1318,26 +1402,34 @@ SKU Support:
Most restricted value is 1. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **ApplicationManagement/RestrictAppDataToSystemVolume** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether application data is restricted to the system drive. @@ -1348,26 +1440,34 @@ SKU Support:
Most restricted value is 1. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **ApplicationManagement/RestrictAppToSystemVolume** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether the installation of applications is restricted to the system drive. @@ -1378,22 +1478,7 @@ SKU Support:
Most restricted value is 1. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **AttachmentManager/DoNotPreserveZoneInformation** @@ -1407,8 +1492,6 @@ If you disable this policy setting, Windows marks file attachments with their zo If you do not configure this policy setting, Windows marks file attachments with their zone information. - - ADMX Info: @@ -1431,8 +1514,6 @@ If you disable this policy setting, Windows shows the check box and Unblock butt If you do not configure this policy setting, Windows hides the check box and Unblock button. - - ADMX Info: @@ -1455,8 +1536,6 @@ If you disable this policy setting, Windows does not call the registered antivir If you do not configure this policy setting, Windows does not call the registered antivirus programs when file attachments are opened. - - ADMX Info: @@ -1470,6 +1549,29 @@ ADMX Info: **Authentication/AllowEAPCertSSO** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows EAP Fast Reconnect from being attempted for EAP Method TLS. @@ -1519,26 +1629,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Authentication/AllowSecondaryAuthenticationDevice** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Allows secondary authentication devices to work with Windows. @@ -1549,22 +1667,7 @@ SKU Support:
The default for this policy must be on for consumer devices (defined as local or Microsoft account connected device) and off for enterprise devices (such as cloud domain-joined, cloud domain-joined in an on-premise only environment, cloud domain-joined in a hybrid environment, and BYOD). - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Autoplay/DisallowAutoplayForNonVolumeDevices** @@ -1576,8 +1679,6 @@ If you enable this policy setting, AutoPlay is not allowed for MTP devices like If you disable or do not configure this policy setting, AutoPlay is enabled for non-volume devices. - - ADMX Info: @@ -1607,8 +1708,6 @@ b) Revert back to pre-Windows Vista behavior of automatically executing the auto If you disable or not configure this policy setting, Windows Vista or later will prompt the user whether autorun command is to be run. - - ADMX Info: @@ -1639,8 +1738,6 @@ If you disable or do not configure this policy setting, AutoPlay is enabled. Note: This policy setting appears in both the Computer Configuration and User Configuration folders. If the policy settings conflict, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration. - - ADMX Info: @@ -1654,6 +1751,29 @@ ADMX Info: **Bitlocker/EncryptionMethod** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies the BitLocker Drive Encryption method and cipher strength. @@ -1664,26 +1784,34 @@ ADMX Info: - 6 -XTS 128 - 7 - XTS 256 - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Bluetooth/AllowAdvertising** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether the device can send out Bluetooth advertisements. @@ -1696,26 +1824,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Bluetooth/AllowDiscoverableMode** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether other Bluetooth-enabled devices can discover the device. @@ -1728,26 +1864,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Bluetooth/AllowPrepairing** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Specifies whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device. @@ -1756,26 +1900,34 @@ SKU Support: - 0 – Not allowed. - 1 (default)– Allowed. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Bluetooth/LocalDeviceName** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Sets the local Bluetooth device name. @@ -1783,47 +1935,40 @@ SKU Support:
If this policy is not set or it is deleted, the default local radio name is used. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Bluetooth/ServicesAllowedList** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7CAA-436C-8BF0-78CD0FFBD4AF}.
The default value is an empty string. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Browser/AllowAddressBarDropdown** @@ -1841,14 +1986,34 @@ SKU Support:
Most restricted value is 0. - - - **Browser/AllowAutofill** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether autofill on websites is allowed. @@ -1866,26 +2031,34 @@ SKU Support: 3. Click **Settings** in the drop down list, and select **View Advanced Settings**. 4. Verify the setting **Save form entries** is greyed out. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Browser/AllowBrowser** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
When this policy is set to 0 (not allowed), the Microsoft Edge for Windows 10 Mobile tile will appear greyed out, and clicking on the tile will display a message indicating theat Internet browsing has been disabled by your administrator. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): Yes - - **Browser/AllowCookies** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether cookies are allowed. @@ -1939,25 +2120,34 @@ SKU Support: 3. Click **Settings** in the drop down list, and select **View Advanced Settings**. 4. Verify the setting **Cookies** is greyed out. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes - - **Browser/AllowDeveloperTools** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Browser/AllowDoNotTrack** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether Do Not Track headers are allowed. @@ -2009,26 +2207,34 @@ SKU Support: 3. Click **Settings** in the drop down list, and select **View Advanced Settings**. 4. Verify the setting **Send Do Not Track requests** is greyed out. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Browser/AllowExtensions** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
Added in Windows 10, version 1607. Specifies whether Microsoft Edge extensions are allowed. @@ -2037,26 +2243,34 @@ SKU Support: - 0 – Not allowed. - 1 (default) – Allowed. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Browser/AllowFlash** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Added in Windows 10. Specifies whether Adobe Flash can run in Microsoft Edge. @@ -2065,26 +2279,34 @@ SKU Support: - 0 – Not allowed. - 1 (default) – Allowed. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Browser/AllowFlashClickToRun** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ + | 2 |
+ 2 |
+ |
+ |
+
Added in Windows 10, version 1703. Specifies whether users must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. @@ -2093,26 +2315,34 @@ SKU Support: - 0 – Adobe Flash content is automatically loaded and run by Microsoft Edge. - 1 (default) – Users must click the content, click a Click-to-Run button, or have the site appear on an auto-allow list before Microsoft Edge loads and runs Adobe Flash content. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Browser/AllowInPrivate** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether InPrivate browsing is allowed on corporate networks. @@ -2123,22 +2353,7 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Browser/AllowMicrosoftCompatibilityList** @@ -2156,14 +2371,34 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
Most restricted value is 0. - - - **Browser/AllowPasswordManager** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether saving and managing passwords locally on the device is allowed. @@ -2181,26 +2416,34 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis 3. Click **Settings** in the drop down list, and select **View Advanced Settings**. 4. Verify the settings **Offer to save password** and **Manage my saved passwords** are greyed out. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Browser/AllowPopups** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether pop-up blocker is allowed or enabled. @@ -2218,22 +2461,7 @@ SKU Support: 3. Click **Settings** in the drop down list, and select **View Advanced Settings**. 4. Verify the setting **Block pop-ups** is greyed out. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Browser/AllowSearchEngineCustomization** @@ -2250,14 +2478,34 @@ SKU Support:
Most restricted value is 0. - - - **Browser/AllowSearchSuggestionsinAddressBar** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether search suggestions are allowed in the address bar. @@ -2268,26 +2516,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Browser/AllowSmartScreen** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether Windows Defender SmartScreen is allowed. @@ -2305,22 +2561,7 @@ SKU Support: 3. Click **Settings** in the drop down list, and select **View Advanced Settings**. 4. Verify the setting **Help protect me from malicious sites and download with SmartScreen Filter** is greyed out. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Browser/ClearBrowsingDataOnExit** @@ -2341,9 +2582,6 @@ SKU Support: 2. Close the Microsoft Edge window. 3. Open Microsoft Edge and start typing the same URL in address bar. Verify that it does not auto-complete from history. - - - @@ -2367,9 +2605,6 @@ Employees cannot remove these search engines, but they can set any one as the de
Most restricted value is 0. - - - @@ -2391,14 +2626,34 @@ Employees cannot remove these search engines, but they can set any one as the de
Most restricted value is 0. - - - **Browser/EnterpriseModeSiteList** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
The default value is an empty string. Otherwise, the string should contain the URL of the webpage users will see the first time Microsoft Edge is run. For example, “contoso.com”. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Browser/HomePages** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether users can access the about:flags page, which is used to change developer settings and to enable experimental features. @@ -2528,22 +2814,7 @@ SKU Support: - 0 (default) – Users can access the about:flags page in Microsoft Edge. - 1 – Users can't access the about:flags page in Microsoft Edge. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Browser/PreventFirstRunPage** @@ -2558,9 +2829,6 @@ SKU Support:
Most restricted value is 1. - - - @@ -2576,14 +2844,34 @@ SKU Support:
Most restricted value is 1. - - - **Browser/PreventSmartScreenPromptOverride** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether users can override the Windows Defender SmartScreen Filter warnings about potentially malicious websites. @@ -2594,26 +2882,34 @@ SKU Support:
Turning this setting on stops users from ignoring the Windows Defender SmartScreen Filter warnings and blocks them from going to the site. Turning this setting off, or not configuring it, lets users ignore the Windows Defender SmartScreen Filter warnings about potentially malicious websites and to continue to the site. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Browser/PreventSmartScreenPromptOverrideForFiles** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether users can override the Windows Defender SmartScreen Filter warnings about downloading unverified files. Turning this setting on stops users from ignoring the Windows Defender SmartScreen Filter warnings and blocks them from downloading unverified files. Turning this setting off, or not configuring it, lets users ignore the Windows Defender SmartScreen Filter warnings about unverified files and lets them continue the download process. @@ -2622,26 +2918,34 @@ SKU Support: - 0 (default) – Off. - 1 – On. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Browser/PreventUsingLocalHostIPAddressForWebRTC** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Browser/SetDefaultSearchEngine** @@ -2725,14 +3022,34 @@ SKU Support:
Most restricted value is 0. - - - **Browser/ShowMessageWhenOpeningSitesInInternetExplorer** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Browser/SyncFavoritesBetweenIEAndMicrosoftEdge** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
Added in Windows 10, version 1703. Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering. @@ -2788,27 +3113,34 @@ SKU Support:
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Disables or enables the camera. @@ -2819,26 +3151,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): Yes - - **Connectivity/AllowBluetooth** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows the user to enable Bluetooth or restrict access. @@ -2856,26 +3196,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): Yes - - **Connectivity/AllowCellularData** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows the cellular data channel on the device. Device reboot is not required to enforce the policy. @@ -2885,26 +3233,34 @@ SKU Support: - 1 (default) – Allow the cellular data channel. The user can turn it off. - 2 - Allow the cellular data channel. The user cannot turn it off. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Connectivity/AllowCellularDataRoaming** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows or disallows cellular data roaming on the device. Device reboot is not required to enforce the policy. @@ -2924,26 +3280,34 @@ SKU Support: 2. Click on the SIM (next to the signal strength icon) and select **Properties**. 3. On the Properties page, select **Data roaming options**. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): Yes - - **Connectivity/AllowConnectedDevices** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Connectivity/AllowUSBConnection** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): Yes - - **Connectivity/AllowVPNOverCellular** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies what type of underlying connections VPN is allowed to use. @@ -3056,26 +3443,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Connectivity/AllowVPNRoamingOverCellular** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Prevents the device from connecting to VPN when the device roams over cellular networks. @@ -3086,22 +3481,7 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Connectivity/HardenedUNCPaths** @@ -3111,9 +3491,6 @@ This policy setting configures secure access to UNC paths. If you enable this policy, Windows only allows access to the specified UNC paths after fulfilling additional security requirements. - - - ADMX Info: @@ -3138,8 +3515,6 @@ Note: The user's domain password will be cached in the system vault when using t To configure Windows Hello for Business, use the Administrative Template policies under Windows Hello for Business. - - ADMX Info: @@ -3162,8 +3537,6 @@ If you disable or don't configure this policy setting, a domain user can set up Note that the user's domain password will be cached in the system vault when using this feature. - - ADMX Info: @@ -3188,8 +3561,6 @@ By default, the password reveal button is displayed after a user types a passwor The policy applies to all Windows components and applications that use the Windows system controls, including Internet Explorer. - - ADMX Info: @@ -3210,8 +3581,6 @@ If you enable this policy setting, all local administrator accounts on the PC wi If you disable this policy setting, users will always be required to type a user name and password to elevate. - - ADMX Info: @@ -3225,6 +3594,29 @@ ADMX Info: **Cryptography/AllowFipsAlgorithmPolicy** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows or disallows the Federal Information Processing Standard (FIPS) policy. @@ -3233,49 +3625,65 @@ ADMX Info: - 0 (default) – Not allowed. - 1– Allowed. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Cryptography/TLSCipherSuites** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Lists the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DataProtection/AllowDirectMemoryAccess** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
This policy setting allows you to block direct memory access (DMA) for all hot pluggable PCI downstream ports until a user logs into Windows. Once a user logs in, Windows will enumerate the PCI devices connected to the host plug PCI ports. Every time the user locks the machine, DMA will be blocked on hot plug PCI ports with no children devices until the user logs in again. Devices which were already enumerated when the machine was unlocked will continue to function until unplugged. This policy setting is only enforced when BitLocker or device encryption is enabled. @@ -3286,26 +3694,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **DataProtection/LegacySelectiveWipeID** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
The default value is 50. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Defender/DaysToRetainCleanedMalware** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
The default value is 0, which keeps items in quarantine, and does not automatically remove them. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Defender/ExcludedExtensions** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
llows an administrator to specify a list of file type extensions to ignore during a scan. Each file type in the list must be separated by a **|**. For example, "lib|obj". - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Defender/ExcludedPaths** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows an administrator to specify a list of directory paths to ignore during a scan. Each path in the list must be separated by a **|**. For example, "C:\\Example|C:\\Example1". - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Defender/ExcludedProcesses** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Each file type must be separated by a **|**. For example, "C:\\Example.exe|C:\\Example1.exe". - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Defender/PUAProtection** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
The default value is 120 - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Defender/ScheduleScanDay** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
The default value is 120. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Defender/SignatureUpdateInterval** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
The default value is 8. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Defender/SubmitSamplesConsent** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
The default value is 10. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeliveryOptimization/DOAllowVPNPeerCaching** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
The default value is 0 (FALSE). - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeliveryOptimization/DODownloadMode** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
The default value is 259200 seconds (3 days). - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeliveryOptimization/DOMaxCacheSize** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
The default value is 20. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeliveryOptimization/DOMaxDownloadBandwidth** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeliveryOptimization/DOMaxUploadBandwidth** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
The default value is 0, which permits unlimited possible bandwidth (optimized for minimal usage of upload bandwidth). - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeliveryOptimization/DOMinBackgroundQos** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
The default value is 500. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
The default value is 0. The value 0 (zero) means "not limited" and the cloud service default value will be used. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeliveryOptimization/DOMinDiskSizeAllowedToPeer** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
The default value is 32 GB. - - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeliveryOptimization/DOMinFileSizeToCache** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
The default value is 100 MB. - - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeliveryOptimization/DOMinRAMAllowedToPeer** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
The default value is 4 GB. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeliveryOptimization/DOModifyCacheDrive** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
By default, %SystemDrive% is used to store the cache. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeliveryOptimization/DOMonthlyUploadDataCap** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
The default value is 20. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeliveryOptimization/DOPercentageMaxDownloadBandwidth** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Desktop/PreventUserRedirectionOfProfileFolders** @@ -4782,8 +5512,6 @@ By default, a user can change the location of their individual profile folders l If you enable this setting, users are unable to type a new location in the Target box. - - ADMX Info: @@ -4804,8 +5532,6 @@ If you enable this policy setting, Windows is prevented from installing a device If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings. - - ADMX Info: @@ -4826,8 +5552,6 @@ If you enable this policy setting, Windows is prevented from installing or updat If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings. - - ADMX Info: @@ -4841,6 +5565,29 @@ ADMX Info: **DeviceLock/AllowIdleReturnWithoutPassword** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether PINs or passwords such as "1111" or "1234" are allowed. For the desktop, it also controls the use of picture passwords. @@ -4931,26 +5693,34 @@ SKU Support:
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx). - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): Yes - - **DeviceLock/AlphanumericDevicePasswordRequired** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Determines the type of PIN or password required. This policy only applies if the **DeviceLock/DevicePasswordEnabled** policy is set to 0 (required). @@ -4973,25 +5743,34 @@ SKU Support: - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): Yes - - **DeviceLock/DevicePasswordEnabled** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether device lock is enabled. @@ -5040,26 +5819,34 @@ SKU Support: > - MaxDevicePasswordFailedAttempts > - MaxInactivityTimeDeviceLock - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): Yes - - **DeviceLock/DevicePasswordExpiration** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies when the password expires (in days). @@ -5076,26 +5863,34 @@ SKU Support:
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx). - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): Yes - - **DeviceLock/DevicePasswordHistory** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies how many passwords can be stored in the history that can’t be used. @@ -5114,26 +5909,34 @@ SKU Support:
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx). - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): Yes - - **DeviceLock/EnforceLockScreenAndLogonImage** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | 1 |
+ 1 |
+ |
+ |
+
Added in Windows 10, version 1607. Specifies the default lock screen and logon image shown when no user is signed in. It also sets the specified image for all users, which replaces the default image. The same image is used for both the lock and logon screens. Users will not be able to change this image. @@ -5143,26 +5946,34 @@ SKU Support:
Value type is a string, which is the full image filepath and filename. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeviceLock/EnforceLockScreenProvider** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Restricts lock screen image to a specific lock screen provider. Users will not be able change this provider. @@ -5172,26 +5983,34 @@ SKU Support:
Value type is a string, which is the AppID. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeviceLock/MaxDevicePasswordFailedAttempts** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx). - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): Yes - - **DeviceLock/MaxInactivityTimeDeviceLock** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. Users can select any existing timeout value less than the specified maximum time in the Settings app. Note the Lumia 950 and 950XL have a maximum timeout value of 5 minutes, regardless of the value set by this policy. @@ -5249,26 +6076,34 @@ SKU Support:
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx). - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): Yes - - **DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ 2 |
+ 2 |
+
Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked while connected to an external display. @@ -5281,27 +6116,34 @@ SKU Support: - An integer X where 0 <= X <= 999. - 0 (default) - No timeout is defined. The default of "0" is Windows Phone 7.5 parity and is interpreted by as "No timeout is defined." - - - - -SKU Support: -- Home: No -- Pro: No -- Business: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **DeviceLock/MinDevicePasswordComplexCharacters** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
The number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password. @@ -5376,26 +6218,34 @@ SKU Support:
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx) and [KB article](https://support.office.com/article/This-device-doesn-t-meet-the-security-requirements-set-by-your-email-administrator-87132fc7-2c7f-4a71-9de0-779ff81c86ca). - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): Yes - - **DeviceLock/MinDevicePasswordLength** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies the minimum number or characters required in the PIN or password. @@ -5415,22 +6265,7 @@ SKU Support:
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx) and [KB article](https://support.office.com/article/This-device-doesn-t-meet-the-security-requirements-set-by-your-email-administrator-87132fc7-2c7f-4a71-9de0-779ff81c86ca). - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): Yes - - **DeviceLock/PreventLockScreenSlideShow** @@ -5442,8 +6277,6 @@ By default, users can enable a slide show that will run after they lock the mach If you enable this setting, users will no longer be able to modify slide show settings in PC Settings, and no slide show will ever start. - - ADMX Info: @@ -5457,6 +6290,29 @@ ADMX Info: **DeviceLock/ScreenTimeoutWhileLocked** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No - - **Display/TurnOffGdiDPIScalingForApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware. @@ -5506,27 +6371,34 @@ SKU Support: 1. Configure the setting for an app which has GDI DPI scaling enabled via MDM or any other supported mechanisms. 2. Run the app and observe blurry text. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Display/TurnOnGdiDPIScalingForApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware. @@ -5543,191 +6415,217 @@ SKU Support: 1. Configure the setting for an app which uses GDI. 2. Run the app and observe crisp text. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **EnterpriseCloudPrint/CloudPrintOAuthAuthority** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. Specifies the authentication endpoint for acquiring OAuth tokens. This policy must target ./User, otherwise it fails. +
Added in Windows 10, version 1703. Specifies the authentication endpoint for acquiring OAuth tokens.
The datatype is a string.
The default value is an empty string. Otherwise, the value should contain the URL of an endpoint. For example, "https://azuretenant.contoso.com/adfs". - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **EnterpriseCloudPrint/CloudPrintOAuthClientId** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. Specifies the GUID of a client application authorized to retrieve OAuth tokens from the OAuthAuthority. This policy must target ./User, otherwise it fails. +
Added in Windows 10, version 1703. Specifies the GUID of a client application authorized to retrieve OAuth tokens from the OAuthAuthority.
The datatype is a string.
The default value is an empty string. Otherwise, the value should contain a GUID. For example, "E1CF1107-FF90-4228-93BF-26052DD2C714". - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **EnterpriseCloudPrint/CloudPrintResourceId** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the enterprise cloud print client during OAuth authentication. This policy must target ./User, otherwise it fails. +
Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the enterprise cloud print client during OAuth authentication.
The datatype is a string.
The default value is an empty string. Otherwise, the value should contain a URL. For example, "http://MicrosoftEnterpriseCloudPrint/CloudPrint". - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. Specifies the per-user end point for discovering cloud printers. This policy must target ./User, otherwise it fails. +
Added in Windows 10, version 1703. Specifies the per-user end point for discovering cloud printers.
The datatype is a string.
The default value is an empty string. Otherwise, the value should contain the URL of an endpoint. For example, "https://cloudprinterdiscovery.contoso.com". - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **EnterpriseCloudPrint/DiscoveryMaxPrinterLimit** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. Defines the maximum number of printers that should be queried from a discovery end point. This policy must target ./User, otherwise it fails. +
Added in Windows 10, version 1703. Defines the maximum number of printers that should be queried from a discovery end point.
The datatype is an integer.
For Windows Mobile, the default value is 20. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **EnterpriseCloudPrint/MopriaDiscoveryResourceId** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the Mopria discovery client during OAuth authentication. This policy must target ./User, otherwise it fails. +
Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the Mopria discovery client during OAuth authentication.
The datatype is a string.
The default value is an empty string. Otherwise, the value should contain a URL. For example, "http://MopriaDiscoveryService/CloudPrint". - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **ErrorReporting/CustomizeConsentSettings** @@ -5749,8 +6647,6 @@ If you enable this policy setting, you can add specific event types to a list by If you disable or do not configure this policy setting, then the default consent settings that are applied are those specified by the user in Control Panel, or in the Configure Default Consent policy setting. - - ADMX Info: @@ -5771,8 +6667,6 @@ If you enable this policy setting, Windows Error Reporting does not send any pro If you disable or do not configure this policy setting, the Turn off Windows Error Reporting policy setting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings takes precedence. If Turn off Windows Error Reporting is also either disabled or not configured, user settings in Control Panel for Windows Error Reporting are applied. - - ADMX Info: @@ -5797,8 +6691,6 @@ If you do not configure this policy setting, users can change this setting in Co See also the Configure Error Reporting policy setting. - - ADMX Info: @@ -5819,8 +6711,6 @@ If you enable this policy setting, any additional data requests from Microsoft i If you disable or do not configure this policy setting, then consent policy settings in Computer Configuration/Administrative Templates/Windows Components/Windows Error Reporting/Consent take precedence. - - ADMX Info: @@ -5841,8 +6731,6 @@ If you enable this policy setting, Windows Error Reporting does not display any If you disable or do not configure this policy setting, Windows Error Reporting displays the user interface for critical errors. - - ADMX Info: @@ -5865,8 +6753,6 @@ If you disable or do not configure this policy setting and a log file reaches it Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting. - - ADMX Info: @@ -5887,8 +6773,6 @@ If you enable this policy setting, you can configure the maximum log file size t If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog and it defaults to 20 megabytes. - - ADMX Info: @@ -5909,8 +6793,6 @@ If you enable this policy setting, you can configure the maximum log file size t If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog and it defaults to 20 megabytes. - - ADMX Info: @@ -5931,8 +6813,6 @@ If you enable this policy setting, you can configure the maximum log file size t If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog and it defaults to 20 megabytes. - - ADMX Info: @@ -5946,6 +6826,29 @@ ADMX Info: **Experience/AllowCopyPaste** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Experience/AllowCortana** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether Cortana is allowed on the device. If you enable or don’t configure this setting, Cortana is allowed on the device. If you disable this setting, Cortana is turned off. When Cortana is off, users will still be able to use search to find items on the device. @@ -5997,26 +6908,34 @@ SKU Support:
An enterprise employee customer is going through OOBE and enjoys Cortana’s help in this process. The customer is happy to learn during OOBE that Cortana can help them be more productive, and chooses to set up Cortana before OOBE finishes. When their setup is finished, they are immediately ready to engage with Cortana to help manage their schedule and more. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Experience/AllowDeviceDiscovery** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows users to turn on/off device discovery UX. @@ -6029,41 +6948,34 @@ SKU Support:
Most restricted value is 0. - - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - - - -**Experience/AllowFindMyDevice** - - -
Added in Windows 10, version 1703. This policy turns on Find My Device feature. - -
When Find My Device is on, the device and its location are registered in the cloud so that the device can be located when the user initiates a Find command from account.microsoft.com. - -
When Find My Device is off, the device and its location are not registered and the Find My Device feature will not work. - - - - **Experience/AllowManualMDMUnenrollment** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether to allow the user to delete the workplace account using the workplace control panel. @@ -6078,26 +6990,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Experience/AllowSIMErrorDialogPromptWhenNoSIM** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Experience/AllowSyncMySettings** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows or disallows all Windows sync settings on the device. For information about what settings are sync'ed, see [About sync setting on Windows 10 devices](http://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices). @@ -6172,22 +7108,7 @@ SKU Support: - 0 – Sync settings is not allowed. - 1 (default) – Sync settings allowed. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Experience/AllowTailoredExperiencesWithDiagnosticData** @@ -6209,14 +7130,34 @@ SKU Support:
Most restricted value is 0. - - - **Experience/AllowTaskSwitcher** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Experience/AllowWindowsConsumerFeatures** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Experience/AllowWindowsSpotlight** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | 1 |
+ 1 |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Experience/AllowWindowsSpotlightOnActionCenter** @@ -6403,9 +7361,6 @@ SKU Support:
Most restricted value is 0. - - - @@ -6425,14 +7380,34 @@ The Windows welcome experience feature introduces onboard users to Windows; for
Most restricted value is 0. - - - **Experience/AllowWindowsTips** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | 1 |
+ 1 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Prevents devices from showing feedback questions from Microsoft. @@ -6506,22 +7497,7 @@ SKU Support: - 0 (default) – Feedback notifications are not disabled. The actual state of feedback notifications on the device will then depend on what GP has configured or what the user has configured locally. - 1 – Feedback notifications are disabled. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Games/AllowAdvancedGamingServices** @@ -6529,9 +7505,6 @@ SKU Support:
Placeholder only. Currently not supported. - - - @@ -6544,8 +7517,6 @@ If you enable this policy setting, the user can add and remove search providers, If you disable or do not configure this policy setting, the user can configure their list of search providers unless another policy setting restricts such configuration. - - ADMX Info: @@ -6566,8 +7537,6 @@ If you enable this policy setting, ActiveX Filtering is enabled by default for t If you disable or do not configure this policy setting, ActiveX Filtering is not enabled by default for the user. The user can turn ActiveX Filtering on or off. - - ADMX Info: @@ -6594,8 +7563,6 @@ Value - A number indicating whether Internet Explorer should deny or allow the a If you disable this policy setting, the list is deleted. The 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting will still determine whether add-ons not in this list are assumed to be denied. - - ADMX Info: @@ -6618,8 +7585,6 @@ If you disable this policy setting, Enhanced Protected Mode will be turned off. If you do not configure this policy, users will be able to turn on or turn off Enhanced Protected Mode on the Advanced tab of the Internet Options dialog. - - ADMX Info: @@ -6640,8 +7605,6 @@ If you turn this setting on, users can see and use the Enterprise Mode option fr If you disable or don't configure this policy setting, the menu option won't appear and users won't be able to run websites in Enterprise Mode. - - ADMX Info: @@ -6662,8 +7625,6 @@ If you enable this policy setting, Internet Explorer downloads the website list If you disable or don't configure this policy setting, Internet Explorer opens all websites using Standards mode. - - ADMX Info: @@ -6684,8 +7645,6 @@ If you enable this policy setting, the user can add and remove sites from the li If you disable or do not configure this policy setting, the user can add and remove sites from the list. - - ADMX Info: @@ -6707,8 +7666,6 @@ If you disable this policy setting, Internet Explorer uses an Internet Explorer If you do not configure this policy setting, Internet Explorer uses an Internet Explorer 7 user agent string (with an additional string appended) for local intranet content. Additionally, all local intranet Standards Mode pages appear in Internet Explorer 7 Standards Mode. This option results in the greatest compatibility with existing webpages, but newer content written to common Internet standards may be displayed incorrectly. This option matches the default behavior of Internet Explorer. - - ADMX Info: @@ -6735,8 +7692,6 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. - - ADMX Info: @@ -6763,8 +7718,6 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. - - ADMX Info: @@ -6791,8 +7744,6 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. - - ADMX Info: @@ -6819,8 +7770,6 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. - - ADMX Info: @@ -6847,8 +7796,6 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. - - ADMX Info: @@ -6875,8 +7822,6 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. - - ADMX Info: @@ -6903,8 +7848,6 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. - - ADMX Info: @@ -6925,8 +7868,6 @@ If you enable this policy setting, Internet Explorer goes directly to an intrane If you disable or do not configure this policy setting, Internet Explorer does not go directly to an intranet site for a one-word entry in the Address bar. - - ADMX Info: @@ -6953,8 +7894,6 @@ Value - A number indicating the zone with which this site should be associated f If you disable or do not configure this policy, users may choose their own site-to-zone assignments. - - ADMX Info: @@ -6977,8 +7916,6 @@ If you disable this policy setting, the entry points and functionality associate If you do not configure this policy setting, the user can turn on and turn off the Suggested Sites feature. - - ADMX Info: @@ -7005,8 +7942,6 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. - - ADMX Info: @@ -7033,8 +7968,6 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. - - ADMX Info: @@ -7060,8 +7993,6 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. - - ADMX Info: @@ -7084,8 +8015,6 @@ If you disable, or do not configure this policy setting, Flash is turned on for Note that Adobe Flash can still be disabled through the "Add-on List" and "Deny all add-ons unless specifically allowed in the Add-on List" policy settings, even if this policy setting is disabled, or not configured. However, if Adobe Flash is disabled through the "Add-on List" and "Deny all add-ons unless specifically allowed in the Add-on List" policy settings and not through this policy setting, all applications that use Internet Explorer technology to instantiate Flash object can still do so. For more information, see "Group Policy Settings in Internet Explorer 10" in the Internet Explorer TechNet library. - - ADMX Info: @@ -7106,8 +8035,6 @@ If you enable this policy setting, SmartScreen Filter warnings block the user. If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings. - - ADMX Info: @@ -7128,8 +8055,6 @@ If you enable this policy setting, SmartScreen Filter warnings block the user. If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings. - - ADMX Info: @@ -7152,8 +8077,6 @@ If you disable this policy setting, the user must participate in the CEIP, and t If you do not configure this policy setting, the user can choose to participate in the CEIP. - - ADMX Info: @@ -7174,8 +8097,6 @@ If you enable this policy setting, the user cannot set the Feed Sync Engine to d If you disable or do not configure this policy setting, the user can set the Feed Sync Engine to download an enclosure through the Feed property page. A developer can change the download setting through the Feed APIs. - - ADMX Info: @@ -7198,8 +8119,6 @@ If you disable or do not configure this policy setting, the user can select whic Note: SSL 2.0 is off by default and is no longer supported starting with Windows 10 Version 1607. SSL 2.0 is an outdated security protocol, and enabling SSL 2.0 impairs the performance and functionality of TLS 1.0. - - ADMX Info: @@ -7224,8 +8143,6 @@ Starting with Windows 8, the "Welcome to Internet Explorer" webpage is not avail If you disable or do not configure this policy setting, Internet Explorer may run the First Run wizard the first time the browser is started after installation. - - ADMX Info: @@ -7250,8 +8167,6 @@ If you disable this policy setting, flip ahead with page prediction is turned on If you don't configure this setting, users can turn this behavior on or off, using the Settings charm. - - ADMX Info: @@ -7272,8 +8187,6 @@ If you enable this policy setting, a user cannot set a custom default home page. If you disable or do not configure this policy setting, the Home page box is enabled and users can choose their own home page. - - ADMX Info: @@ -7294,8 +8207,6 @@ If you enable this policy setting, the user will not be able to configure proxy If you disable or do not configure this policy setting, the user can configure proxy settings. - - ADMX Info: @@ -7316,8 +8227,6 @@ If you enable this policy setting, the user cannot change the default search pro If you disable or do not configure this policy setting, the user can change the default search provider. - - ADMX Info: @@ -7340,8 +8249,6 @@ If you disable or do not configure this policy setting, the user can add seconda Note: If the Disable Changing Home Page Settings policy is enabled, the user cannot add secondary home pages. - - ADMX Info: @@ -7364,8 +8271,6 @@ If you disable this policy or do not configure it, Internet Explorer checks ever This policy is intended to help the administrator maintain version control for Internet Explorer by preventing users from being notified about new versions of the browser. - - ADMX Info: @@ -7392,8 +8297,6 @@ Note: The "Disable the Security page" policy (located in \User Configuration\Ad Also, see the "Security zones: Use only machine settings" policy. - - ADMX Info: @@ -7420,8 +8323,6 @@ Note: The "Disable the Security page" policy (located in \User Configuration\Adm Also, see the "Security zones: Use only machine settings" policy. - - ADMX Info: @@ -7444,8 +8345,6 @@ If you disable or don't configure this policy setting, Internet Explorer continu For more information, see "Outdated ActiveX Controls" in the Internet Explorer TechNet library. - - ADMX Info: @@ -7472,8 +8371,6 @@ If you disable or don't configure this policy setting, the list is deleted and I For more information, see "Outdated ActiveX Controls" in the Internet Explorer TechNet library. - - ADMX Info: @@ -7496,8 +8393,6 @@ If you disable this policy setting, local sites which are not explicitly mapped If you do not configure this policy setting, users choose whether to force local sites into the Intranet Zone. - - ADMX Info: @@ -7520,8 +8415,6 @@ If you disable this policy setting, network paths are not necessarily mapped int If you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone. - - ADMX Info: @@ -7544,8 +8437,6 @@ If you disable this policy setting, users cannot load a page in the zone that us If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone. - - ADMX Info: @@ -7568,8 +8459,6 @@ If you disable this policy setting, ActiveX control installations will be blocke If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt. - - ADMX Info: @@ -7590,8 +8479,6 @@ If you enable this setting, users will receive a file download dialog for automa If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt. - - ADMX Info: @@ -7614,8 +8501,6 @@ If you disable this policy setting, HTML fonts are prevented from downloading. If you do not configure this policy setting, HTML fonts can be downloaded automatically. - - ADMX Info: @@ -7638,8 +8523,6 @@ If you disable this policy setting, the possibly harmful navigations are prevent If you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. - - ADMX Info: @@ -7662,8 +8545,6 @@ If you disable this policy setting, Internet Explorer will not execute unsigned If you do not configure this policy setting, Internet Explorer will execute unsigned managed components. - - ADMX Info: @@ -7686,8 +8567,6 @@ If you disable this policy setting, the user cannot run scriptlets. If you do not configure this policy setting, the user can enable or disable scriptlets. - - ADMX Info: @@ -7712,8 +8591,6 @@ If you do not configure this policy setting, the user can choose whether SmartSc Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. - - ADMX Info: @@ -7736,8 +8613,6 @@ If you disable this policy setting, users cannot preserve information in the bro If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. - - ADMX Info: @@ -7762,8 +8637,6 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. - - ADMX Info: @@ -7786,8 +8659,6 @@ If you disable this policy setting, users cannot open windows and frames to acce If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. - - ADMX Info: @@ -7810,8 +8681,6 @@ If you disable this policy setting, users cannot load a page in the zone that us If you do not configure this policy setting, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone. - - ADMX Info: @@ -7834,8 +8703,6 @@ If you disable this policy setting, ActiveX control installations will be blocke If you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed. - - ADMX Info: @@ -7856,8 +8723,6 @@ If you enable this setting, users will receive a file download dialog for automa If you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts. - - ADMX Info: @@ -7880,8 +8745,6 @@ If you disable this policy setting, HTML fonts are prevented from downloading. If you do not configure this policy setting, HTML fonts can be downloaded automatically. - - ADMX Info: @@ -7904,8 +8767,6 @@ If you disable this policy setting, the possibly harmful navigations are prevent If you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. - - ADMX Info: @@ -7928,8 +8789,6 @@ If you disable this policy setting, Internet Explorer will not execute unsigned If you do not configure this policy setting, Internet Explorer will execute unsigned managed components. - - ADMX Info: @@ -7952,8 +8811,6 @@ If you disable this policy setting, the user cannot run scriptlets. If you do not configure this policy setting, the user can enable or disable scriptlets. - - ADMX Info: @@ -7978,8 +8835,6 @@ If you do not configure this policy setting, the user can choose whether SmartSc Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. - - ADMX Info: @@ -8002,8 +8857,6 @@ If you disable this policy setting, users cannot preserve information in the bro If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. - - ADMX Info: @@ -8028,8 +8881,6 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. - - ADMX Info: @@ -8052,8 +8903,6 @@ If you disable this policy setting, users cannot open windows and frames to acce If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. - - ADMX Info: @@ -8076,8 +8925,6 @@ If you disable this policy setting, users cannot load a page in the zone that us If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. - - ADMX Info: @@ -8100,8 +8947,6 @@ If you disable this policy setting, ActiveX control installations will be blocke If you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed. - - ADMX Info: @@ -8122,8 +8967,6 @@ If you enable this setting, users will receive a file download dialog for automa If you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts. - - ADMX Info: @@ -8146,8 +8989,6 @@ If you disable this policy setting, HTML fonts are prevented from downloading. If you do not configure this policy setting, HTML fonts can be downloaded automatically. - - ADMX Info: @@ -8170,8 +9011,6 @@ If you disable this policy setting, the possibly harmful navigations are prevent If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. - - ADMX Info: @@ -8194,8 +9033,6 @@ If you disable this policy setting, Internet Explorer will not execute unsigned If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. - - ADMX Info: @@ -8218,8 +9055,6 @@ If you disable this policy setting, the user cannot run scriptlets. If you do not configure this policy setting, the user can enable or disable scriptlets. - - ADMX Info: @@ -8244,8 +9079,6 @@ If you do not configure this policy setting, the user can choose whether SmartSc Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. - - ADMX Info: @@ -8268,8 +9101,6 @@ If you disable this policy setting, users cannot preserve information in the bro If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. - - ADMX Info: @@ -8294,8 +9125,6 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar If you do not configure this policy setting, users are queried whether to allow the control to be loaded with parameters or scripted. - - ADMX Info: @@ -8318,8 +9147,6 @@ If you disable this policy setting, users cannot open windows and frames to acce If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. - - ADMX Info: @@ -8342,8 +9169,6 @@ If you disable this policy setting, users cannot load a page in the zone that us If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone. - - ADMX Info: @@ -8366,8 +9191,6 @@ If you disable this policy setting, ActiveX control installations will be blocke If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt. - - ADMX Info: @@ -8388,8 +9211,6 @@ If you enable this setting, users will receive a file download dialog for automa If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt. - - ADMX Info: @@ -8412,8 +9233,6 @@ If you disable this policy setting, HTML fonts are prevented from downloading. If you do not configure this policy setting, HTML fonts can be downloaded automatically. - - ADMX Info: @@ -8436,8 +9255,6 @@ If you disable this policy setting, the possibly harmful navigations are prevent If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. - - ADMX Info: @@ -8460,8 +9277,6 @@ If you disable this policy setting, Internet Explorer will not execute unsigned If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. - - ADMX Info: @@ -8484,8 +9299,6 @@ If you disable this policy setting, the user cannot run scriptlets. If you do not configure this policy setting, the user can enable or disable scriptlets. - - ADMX Info: @@ -8510,8 +9323,6 @@ If you do not configure this policy setting, the user can choose whether SmartSc Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. - - ADMX Info: @@ -8534,8 +9345,6 @@ If you disable this policy setting, users cannot preserve information in the bro If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. - - ADMX Info: @@ -8560,8 +9369,6 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. - - ADMX Info: @@ -8584,8 +9391,6 @@ If you disable this policy setting, users cannot open windows and frames to acce If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. - - ADMX Info: @@ -8608,8 +9413,6 @@ If you disable this policy setting, users cannot load a page in the zone that us If you do not configure this policy setting, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone. - - ADMX Info: @@ -8632,8 +9435,6 @@ If you disable this policy setting, ActiveX control installations will be blocke If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt. - - ADMX Info: @@ -8654,8 +9455,6 @@ If you enable this setting, users will receive a file download dialog for automa If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt. - - ADMX Info: @@ -8678,8 +9477,6 @@ If you disable this policy setting, HTML fonts are prevented from downloading. If you do not configure this policy setting, HTML fonts can be downloaded automatically. - - ADMX Info: @@ -8702,8 +9499,6 @@ If you disable this policy setting, the possibly harmful navigations are prevent If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. - - ADMX Info: @@ -8726,8 +9521,6 @@ If you disable this policy setting, Internet Explorer will not execute unsigned If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. - - ADMX Info: @@ -8750,8 +9543,6 @@ If you disable this policy setting, the user cannot run scriptlets. If you do not configure this policy setting, the user can enable or disable scriptlets. - - ADMX Info: @@ -8776,8 +9567,6 @@ If you do not configure this policy setting, the user can choose whether SmartSc Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. - - ADMX Info: @@ -8800,8 +9589,6 @@ If you disable this policy setting, users cannot preserve information in the bro If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. - - ADMX Info: @@ -8826,8 +9613,6 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. - - ADMX Info: @@ -8850,8 +9635,6 @@ If you disable this policy setting, users cannot open windows and frames to acce If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. - - ADMX Info: @@ -8874,8 +9657,6 @@ If you disable this policy setting, users cannot load a page in the zone that us If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. - - ADMX Info: @@ -8898,8 +9679,6 @@ If you disable this policy setting, ActiveX control installations will be blocke If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt. - - ADMX Info: @@ -8920,8 +9699,6 @@ If you enable this setting, users will receive a file download dialog for automa If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt. - - ADMX Info: @@ -8944,8 +9721,6 @@ If you disable this policy setting, HTML fonts are prevented from downloading. If you do not configure this policy setting, HTML fonts can be downloaded automatically. - - ADMX Info: @@ -8968,8 +9743,6 @@ If you disable this policy setting, the possibly harmful navigations are prevent If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. - - ADMX Info: @@ -8992,8 +9765,6 @@ If you disable this policy setting, Internet Explorer will not execute unsigned If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. - - ADMX Info: @@ -9016,8 +9787,6 @@ If you disable this policy setting, the user cannot run scriptlets. If you do not configure this policy setting, the user can enable or disable scriptlets. - - ADMX Info: @@ -9042,8 +9811,6 @@ If you do not configure this policy setting, the user can choose whether SmartSc Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. - - ADMX Info: @@ -9066,8 +9833,6 @@ If you disable this policy setting, users cannot preserve information in the bro If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. - - ADMX Info: @@ -9092,8 +9857,6 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. - - ADMX Info: @@ -9116,8 +9879,6 @@ If you disable this policy setting, users cannot open windows and frames to acce If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. - - ADMX Info: @@ -9140,8 +9901,6 @@ If you disable this policy setting, users cannot load a page in the zone that us If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone. - - ADMX Info: @@ -9164,8 +9923,6 @@ If you disable this policy setting, ActiveX control installations will be blocke If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt. - - ADMX Info: @@ -9186,8 +9943,6 @@ If you enable this setting, users will receive a file download dialog for automa If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt. - - ADMX Info: @@ -9210,8 +9965,6 @@ If you disable this policy setting, HTML fonts are prevented from downloading. If you do not configure this policy setting, users are queried whether to allow HTML fonts to download. - - ADMX Info: @@ -9234,8 +9987,6 @@ If you disable this policy setting, the possibly harmful navigations are prevent If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. - - ADMX Info: @@ -9258,8 +10009,6 @@ If you disable this policy setting, Internet Explorer will not execute unsigned If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. - - ADMX Info: @@ -9282,8 +10031,6 @@ If you disable this policy setting, the user cannot run scriptlets. If you do not configure this policy setting, the user can enable or disable scriptlets. - - ADMX Info: @@ -9308,8 +10055,6 @@ If you do not configure this policy setting, the user can choose whether SmartSc Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. - - ADMX Info: @@ -9332,8 +10077,6 @@ If you disable this policy setting, users cannot preserve information in the bro If you do not configure this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. - - ADMX Info: @@ -9358,8 +10101,6 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. - - ADMX Info: @@ -9382,8 +10123,6 @@ If you disable this policy setting, users cannot open other windows and frames f If you do not configure this policy setting, users cannot open other windows and frames from different domains or access applications from different domains. - - ADMX Info: @@ -9406,8 +10145,6 @@ If you disable this policy setting, users cannot load a page in the zone that us If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. - - ADMX Info: @@ -9430,8 +10167,6 @@ If you disable this policy setting, ActiveX control installations will be blocke If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt. - - ADMX Info: @@ -9452,8 +10187,6 @@ If you enable this setting, users will receive a file download dialog for automa If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt. - - ADMX Info: @@ -9476,8 +10209,6 @@ If you disable this policy setting, HTML fonts are prevented from downloading. If you do not configure this policy setting, HTML fonts can be downloaded automatically. - - ADMX Info: @@ -9500,8 +10231,6 @@ If you disable this policy setting, the possibly harmful navigations are prevent If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. - - ADMX Info: @@ -9524,8 +10253,6 @@ If you disable this policy setting, Internet Explorer will not execute unsigned If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. - - ADMX Info: @@ -9548,8 +10275,6 @@ If you disable this policy setting, the user cannot run scriptlets. If you do not configure this policy setting, the user can enable or disable scriptlets. - - ADMX Info: @@ -9574,8 +10299,6 @@ If you do not configure this policy setting, the user can choose whether SmartSc Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. - - ADMX Info: @@ -9598,8 +10321,6 @@ If you disable this policy setting, users cannot preserve information in the bro If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. - - ADMX Info: @@ -9624,8 +10345,6 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. - - ADMX Info: @@ -9648,8 +10367,6 @@ If you disable this policy setting, users cannot open windows and frames to acce If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. - - ADMX Info: @@ -9672,8 +10389,6 @@ If you disable this policy setting, users cannot load a page in the zone that us If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone. - - ADMX Info: @@ -9696,8 +10411,6 @@ If you disable this policy setting, ActiveX control installations will be blocke If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt. - - ADMX Info: @@ -9718,8 +10431,6 @@ If you enable this setting, users will receive a file download dialog for automa If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt. - - ADMX Info: @@ -9742,8 +10453,6 @@ If you disable this policy setting, HTML fonts are prevented from downloading. If you do not configure this policy setting, users are queried whether to allow HTML fonts to download. - - ADMX Info: @@ -9766,8 +10475,6 @@ If you disable this policy setting, the possibly harmful navigations are prevent If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. - - ADMX Info: @@ -9790,8 +10497,6 @@ If you disable this policy setting, Internet Explorer will not execute unsigned If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. - - ADMX Info: @@ -9814,8 +10519,6 @@ If you disable this policy setting, the user cannot run scriptlets. If you do not configure this policy setting, the user can enable or disable scriptlets. - - ADMX Info: @@ -9840,8 +10543,6 @@ If you do not configure this policy setting, the user can choose whether SmartSc Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. - - ADMX Info: @@ -9864,8 +10565,6 @@ If you disable this policy setting, users cannot preserve information in the bro If you do not configure this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. - - ADMX Info: @@ -9890,8 +10589,6 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. - - ADMX Info: @@ -9914,8 +10611,6 @@ If you disable this policy setting, users cannot open other windows and frames f If you do not configure this policy setting, users cannot open other windows and frames from different domains or access applications from different domains. - - ADMX Info: @@ -9936,8 +10631,6 @@ If you enable this policy setting, the user cannot configure the list of search If you disable or do not configure this policy setting, the user can configure his or her list of search providers. - - ADMX Info: @@ -9960,8 +10653,6 @@ If you disable this policy setting, users cannot load a page in the zone that us If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. - - ADMX Info: @@ -9984,8 +10675,6 @@ If you disable this policy setting, ActiveX control installations will be blocke If you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed. - - ADMX Info: @@ -10006,8 +10695,6 @@ If you enable this setting, users will receive a file download dialog for automa If you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts. - - ADMX Info: @@ -10030,8 +10717,6 @@ If you disable this policy setting, HTML fonts are prevented from downloading. If you do not configure this policy setting, HTML fonts can be downloaded automatically. - - ADMX Info: @@ -10054,8 +10739,6 @@ If you disable this policy setting, the possibly harmful navigations are prevent If you do not configure this policy setting, a warning is issued to the user that potentially risky navigation is about to occur. - - ADMX Info: @@ -10078,8 +10761,6 @@ If you disable this policy setting, Internet Explorer will not execute unsigned If you do not configure this policy setting, Internet Explorer will execute unsigned managed components. - - ADMX Info: @@ -10102,8 +10783,6 @@ If you disable this policy setting, the user cannot run scriptlets. If you do not configure this policy setting, the user can enable or disable scriptlets. - - ADMX Info: @@ -10128,8 +10807,6 @@ If you do not configure this policy setting, the user can choose whether SmartSc Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. - - ADMX Info: @@ -10152,8 +10829,6 @@ If you disable this policy setting, users cannot preserve information in the bro If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. - - ADMX Info: @@ -10178,8 +10853,6 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar If you do not configure this policy setting, users are queried whether to allow the control to be loaded with parameters or scripted. - - ADMX Info: @@ -10202,8 +10875,6 @@ If you disable this policy setting, users cannot open windows and frames to acce If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. - - ADMX Info: @@ -10224,8 +10895,6 @@ If you enable this policy setting, the Kerberos client searches the forests in t If you disable or do not configure this policy setting, the Kerberos client does not search the listed forests to resolve the SPN. If the Kerberos client is unable to resolve the SPN because the name is not found, NTLM authentication might be used. - - ADMX Info: @@ -10244,9 +10913,6 @@ If you enable this policy setting, the client computers will request claims, pro If you disable or do not configure this policy setting, the client devices will not request claims, provide information required to create compounded authentication and armor Kerberos messages. Services hosted on the device will not be able to retrieve claims for clients using Kerberos protocol transition. - - - ADMX Info: @@ -10271,9 +10937,6 @@ Note: The Kerberos Group Policy "Kerberos client support for claims, compound au If you disable or do not configure this policy setting, the client computers in the domain enforce the use of Kerberos armoring when possible as supported by the target domain. - - - ADMX Info: @@ -10294,9 +10957,6 @@ If you enable this policy setting, the Kerberos client requires that the KDC's X If you disable or do not configure this policy setting, the Kerberos client requires only that the KDC certificate contain the Server Authentication purpose object identifier in the EKU extensions which can be issued to any server. - - - ADMX Info: @@ -10321,10 +10981,6 @@ If you disable or do not configure this policy setting, the Kerberos client or s Note: This policy setting configures the existing MaxTokenSize registry value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters, which was added in Windows XP and Windows Server 2003, with a default value of 12,000 bytes. Beginning with Windows 8 the default is 48,000 bytes. Due to HTTP's base64 encoding of authentication context tokens, it is not advised to set this value more than 48,000 bytes. - - - - ADMX Info: @@ -10338,6 +10994,29 @@ ADMX Info: **Licensing/AllowWindowsEntitlementReactivation** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
Added in Windows 10, version 1607. Enables or Disable Windows license reactivation on managed devices. @@ -10346,26 +11025,34 @@ ADMX Info: - 0 – Disable Windows license reactivation on managed devices. - 1 (default) – Enable Windows license reactivation on managed devices. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Licensing/DisallowKMSClientOnlineAVSValidation** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
Added in Windows 10, version 1607. Enabling this setting prevents this computer from sending data to Microsoft regarding its activation state. @@ -10374,26 +11061,34 @@ SKU Support: - 0 (default) – Disabled. - 1 – Enabled. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Location/EnableLocation** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. Optional policy that allows for IT admin to preconfigure whether or not Location Service's Device Switch is enabled or disabled for the device. Setting this policy is not required for Location Services to function. This policy controls a device wide state that affects all users, apps, and services ability to find the device's latitude and longitude on a map. There is a separate user switch that defines whether the location service is allowed to retrieve a position for the current user. In order to retrieve a position for a specific user, both the Device Switch and the User Switch must be enabled. If either is disabled, positions cannot be retrieved for the user. The user can later change both the User Switch and the Device Switch through the user interface on the Settings -> Privacy -> Location page. @@ -10410,26 +11105,34 @@ SKU Support: 1. Verify that Settings -> Privacy -> Location -> Location for this device is On/Off as expected. 2. Use Windows Maps Application (or similar) to see if a location can or cannot be obtained. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes - - **LockDown/AllowEdgeSwipe** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch. @@ -10440,26 +11143,34 @@ SKU Support:
The easiest way to verify the policy is to restart the explorer process or to reboot after the policy is applied. And then try to swipe from the right edge of the screen. The desired result is for Action Center to not be invoked by the swipe. You can also enter tablet mode and attempt to swipe from the top of the screen to rearrange. That will also be disabled. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Maps/AllowOfflineMapsDownloadOverMeteredConnection** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Allows the download and update of map data over metered connections. @@ -10471,26 +11182,34 @@ SKU Support:
After the policy is applied, you can verify the settings in the user interface in **System** > **Offline Maps**. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Maps/EnableOfflineMapsAutoUpdate** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Disables the automatic download and update of map data. @@ -10502,22 +11221,7 @@ SKU Support:
After the policy is applied, you can verify the settings in the user interface in **System** > **Offline Maps**. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Messaging/AllowMMS** @@ -10533,14 +11237,34 @@ SKU Support: - 0 - Disabled. - 1 (default) - Enabled. - - - **Messaging/AllowMessageSync** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Enables text message back up and restore and Messaging Everywhere. This policy allows an organization to disable these features to avoid information being stored on servers outside of their control. @@ -10549,22 +11273,7 @@ SKU Support: - 0 - message sync is not allowed and cannot be changed by the user. - 1 - message sync is allowed. The user can change this setting. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Messaging/AllowRCS** @@ -10580,37 +11289,65 @@ SKU Support: - 0 - Disabled. - 1 (default) - Enabled. - - - **NetworkIsolation/EnterpriseCloudResources** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Contains a list of Enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the **EnterpriseInternalProxyServers** policy. This domain list is a pipe-separated list of cloud resources. Each cloud resource can also be paired optionally with an internal proxy server by using a trailing comma followed by the proxy address. For example, **<*cloudresource*>|<*cloudresource*>|<*cloudresource*>,<*proxy*>|<*cloudresource*>|<*cloudresource*>,<*proxy*>|**. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **NetworkIsolation/EnterpriseIPRange** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of IPv4 and IPv6 ranges. For example: @@ -10623,72 +11360,96 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff ``` - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **NetworkIsolation/EnterpriseIPRangesAreAuthoritative** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **NetworkIsolation/EnterpriseInternalProxyServers** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
This is the comma-separated list of internal proxy servers. For example "157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59". These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the **EnterpriseCloudResources** policy to force traffic to the matched cloud resources through these proxies. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **NetworkIsolation/EnterpriseNetworkDomainNames** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of domains, for example "contoso.sharepoint.com, Fabrikam.com". @@ -10702,95 +11463,127 @@ SKU Support: 2. Call [IdnToAscii](https://msdn.microsoft.com/library/windows/desktop/dd318149.aspx) with IDN\_USE\_STD3\_ASCII\_RULES as the flags. 3. Call [IdnToUnicode](https://msdn.microsoft.com/library/windows/desktop/dd318151.aspx) with no flags set (dwFlags = 0). - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **NetworkIsolation/EnterpriseProxyServers** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
This is a comma-separated list of proxy servers. Any server on this list is considered non-enterprise. For example "157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59". - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **NetworkIsolation/EnterpriseProxyServersAreAuthoritative** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **NetworkIsolation/NeutralResources** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
List of domain names that can used for work or personal resource. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Notifications/DisallowNotificationMirroring** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Boolean value that turns off notification mirroring. @@ -10803,22 +11596,7 @@ SKU Support: - 0 (default)– enable notification mirroring. - 1 – disable notification mirroring. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Power/AllowStandbyWhenSleepingPluggedIn** @@ -10830,8 +11608,6 @@ If you enable or do not configure this policy setting, Windows uses standby stat If you disable this policy setting, standby states (S1-S3) are not allowed. - - ADMX Info: @@ -10852,8 +11628,6 @@ If you enable or do not configure this policy setting, the user is prompted for If you disable this policy setting, the user is not prompted for a password when the system resumes from sleep. - - ADMX Info: @@ -10874,8 +11648,6 @@ If you enable or do not configure this policy setting, the user is prompted for If you disable this policy setting, the user is not prompted for a password when the system resumes from sleep. - - ADMX Info: @@ -10909,8 +11681,6 @@ If you disable this policy setting: -Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print. -The "Users can only point and print to computers in their forest" setting applies only to Windows Server 2003 and Windows XP SP1 (and later service packs). - - ADMX Info: @@ -10944,8 +11714,6 @@ If you disable this policy setting: -Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print. -The "Users can only point and print to computers in their forest" setting applies only to Windows Server 2003 and Windows XP SP1 (and later service packs). - - ADMX Info: @@ -10967,8 +11735,6 @@ If you disable this setting, this computer's shared printers cannot be published Note: This settings takes priority over the setting "Automatically publish new printers in the Active Directory". - - ADMX Info: @@ -10982,6 +11748,29 @@ ADMX Info: **Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
Allows or disallows the automatic acceptance of the pairing and privacy user consent dialog when launching apps. @@ -10992,26 +11781,34 @@ ADMX Info:
Most restricted value is 0. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/AllowInputPersonalization** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Updated in the next major update of Windows 10. Allows the usage of cloud based speech services for Cortana, dictation, or Store applications. Setting this policy to 1, lets Microsoft use the user's voice data to improve cloud speech services for all users. @@ -11023,25 +11820,34 @@ SKU Support:
Most restricted value is 0. - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/DisableAdvertisingId** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Enables or disables the Advertising ID. @@ -11053,26 +11859,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessAccountInfo** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access account information. @@ -11084,95 +11898,127 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the account information privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessCalendar** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access the calendar. @@ -11184,95 +12030,127 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessCalendar_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessCalendar_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the calendar privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessCallHistory** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access call history. @@ -11284,95 +12162,127 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the call history privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessCamera** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access the camera. @@ -11384,95 +12294,127 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessCamera_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessCamera_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessCamera_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessContacts** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access contacts. @@ -11484,95 +12426,127 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessContacts_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessContacts_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessContacts_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessEmail** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access email. @@ -11584,95 +12558,127 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessEmail_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessEmail_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessEmail_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessLocation** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access location. @@ -11684,95 +12690,127 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessLocation_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessLocation_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessLocation_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessMessaging** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether Windows apps can read or send messages (text or MMS). @@ -11784,95 +12822,127 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessMessaging_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessMessaging_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessMicrophone** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access the microphone. @@ -11884,95 +12954,127 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessMotion** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access motion data. @@ -11984,95 +13086,127 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessMotion_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessMotion_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessMotion_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessNotifications** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access notifications. @@ -12084,95 +13218,127 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessNotifications_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessNotifications_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessPhone** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether Windows apps can make phone calls. @@ -12184,95 +13350,127 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessPhone_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessPhone_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessPhone_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessRadios** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether Windows apps have access to control radios. @@ -12284,187 +13482,251 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessRadios_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessRadios_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessRadios_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessTasks** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1703. Specifies whether Windows apps can access tasks. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessTasks_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessTasks_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessTasks_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessTrustedDevices** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access trusted devices. @@ -12476,95 +13738,127 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsGetDiagnosticInfo** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 2 |
+ 2 |
+ + | 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. Force allow, force deny or give user control of apps that can get diagnostic information about other running apps. @@ -12576,95 +13870,127 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 2 |
+ 2 |
+ + | 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 2 |
+ 2 |
+ + | 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 2 |
+ 2 |
+ + | 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'get diagnostic info' privacy setting for the listed apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsRunInBackground** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 2 |
+ 2 |
+ + | 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. Specifies whether Windows apps can run in the background. @@ -12678,95 +14004,127 @@ SKU Support: > [!WARNING] > Be careful when determining which apps should have their background activity disabled. Communication apps normally update tiles and notifications through background processes. Turning off background activity for these types of apps could cause text message, email, and voicemail notifications to not function. This could also cause background email syncing to not function properly. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsRunInBackground_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 2 |
+ 2 |
+ + | 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are able to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsRunInBackground_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 2 |
+ 2 |
+ + | 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied the ability to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsRunInBackground_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 2 |
+ 2 |
+ + | 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the background apps privacy setting for the listed apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsSyncWithDevices** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether Windows apps can sync with devices. @@ -12778,91 +14136,100 @@ SKU Support:
Most restricted value is 2. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'sync with devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **RemoteAssistance/CustomizeWarningMessages** @@ -12880,8 +14247,6 @@ If you disable this policy setting, the user sees the default warning message. If you do not configure this policy setting, the user sees the default warning message. - - ADMX Info: @@ -12904,8 +14269,6 @@ If you disable this policy setting, log files are not generated. If you do not configure this setting, application-based settings are used. - - ADMX Info: @@ -12936,8 +14299,6 @@ The "Select the method for sending email invitations" setting specifies which em If you enable this policy setting you should also enable appropriate firewall exceptions to allow Remote Assistance communications. - - ADMX Info: @@ -12991,8 +14352,6 @@ Port 135:TCP %WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe Allow Remote Desktop Exception - - ADMX Info: @@ -13018,9 +14377,6 @@ Note: You can limit which clients are able to connect remotely by using Remote D You can limit the number of users who can connect simultaneously by configuring the policy setting at Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Limit number of connections, or by configuring the policy setting Maximum Connections by using the Remote Desktop Session Host WMI Provider. - - - ADMX Info: @@ -13051,9 +14407,6 @@ Important FIPS compliance can be configured through the System cryptography. Use FIPS compliant algorithms for encryption, hashing, and signing settings in Group Policy (under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options.) The FIPS compliant setting encrypts and decrypts data sent from the client to the server and from the server to the client, with the Federal Information Processing Standard (FIPS) 140 encryption algorithms, by using Microsoft cryptographic modules. Use this encryption level when communications between clients and RD Session Host servers requires the highest level of encryption. - - - ADMX Info: @@ -13078,9 +14431,6 @@ If you disable this policy setting, client drive redirection is always allowed. If you do not configure this policy setting, client drive redirection and Clipboard file copy redirection are not specified at the Group Policy level. - - - ADMX Info: @@ -13101,8 +14451,6 @@ If you enable this setting the password saving checkbox in Remote Desktop Connec If you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection. - - ADMX Info: @@ -13129,9 +14477,6 @@ If you disable this policy setting, users can always log on to Remote Desktop Se If you do not configure this policy setting, automatic logon is not specified at the Group Policy level. - - - ADMX Info: @@ -13158,8 +14503,6 @@ If the status is set to Not Configured, unsecured communication is allowed. Note: The RPC interface is used for administering and configuring Remote Desktop Services. - - ADMX Info: @@ -13184,8 +14527,6 @@ If you do not configure this policy setting, it remains disabled. RPC clients w Note: This policy will not be applied until the system is rebooted. - - ADMX Info: @@ -13218,8 +14559,6 @@ If you enable this policy setting, it directs the RPC server runtime to restrict Note: This policy setting will not be applied until the system is rebooted. - - ADMX Info: @@ -13233,6 +14572,29 @@ ADMX Info: **Search/AllowIndexingEncryptedStoresOrItems** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows or disallows the indexing of items. This switch is for the Windows Search Indexer, which controls whether it will index items that are encrypted, such as the Windows Information Protection (WIP) protected files. @@ -13247,26 +14609,34 @@ ADMX Info:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Search/AllowSearchToUseLocation** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether search can leverage location information. @@ -13277,26 +14647,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): Yes - - **Search/AllowUsingDiacritics** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows the use of diacritics. @@ -13307,26 +14685,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Search/AlwaysUseAutoLangDetection** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether to always use automatic language detection when indexing content and properties. @@ -13337,26 +14723,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Search/DisableBackoff** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
If enabled, the search indexer backoff feature will be disabled. Indexing will continue at full speed even when system activity is high. If disabled, backoff logic will be used to throttle back indexing activity when system activity is high. Default is disabled. @@ -13365,26 +14759,34 @@ SKU Support: - 0 (default) – Disable. - 1 – Enable. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Search/DisableRemovableDriveIndexing** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
This policy setting configures whether or not locations on removable drives can be added to libraries. @@ -13397,26 +14799,34 @@ SKU Support: - 0 (default) – Disable. - 1 – Enable. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Search/PreventIndexingLowDiskSpaceMB** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Enabling this policy prevents indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location. Select between 0 and 2147483647 MB. @@ -13429,26 +14839,34 @@ SKU Support: - 0 – Disable. - 1 (default) – Enable. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Search/PreventRemoteQueries** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
If enabled, clients will be unable to query this computer's index remotely. Thus, when they are browsing network shares that are stored on this computer, they will not search them using the index. If disabled, client search requests will use this computer's index.. @@ -13457,26 +14875,34 @@ SKU Support: - 0 – Disable. - 1 (default) – Enable. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Search/SafeSearchPermissions** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Security/AllowAddProvisioningPackage** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether to allow the runtime configuration agent to install provisioning packages. @@ -13519,26 +14953,34 @@ SKU Support: - 0 – Not allowed. - 1 (default) – Allowed. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Security/AllowRemoveProvisioningPackage** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether to allow the runtime configuration agent to remove provisioning packages. @@ -13618,26 +15076,34 @@ SKU Support: - 0 – Not allowed. - 1 (default) – Allowed. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Security/AntiTheftMode** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether provisioning packages must have a certificate signed by a device trusted authority. @@ -13749,26 +15238,34 @@ SKU Support: - 0 (default) – Not required. - 1 – Required. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Security/RequireRetrieveHealthCertificateOnBoot** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service (HAS) when a device boots or reboots. @@ -13788,26 +15285,34 @@ SKU Support:
Most restricted value is 1. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Settings/AllowAutoPlay** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows the user to change Data Sense settings. @@ -13852,26 +15364,34 @@ SKU Support: - 0 – Not allowed. - 1 (default) – Allowed. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Settings/AllowDateTime** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows the user to change date and time settings. @@ -13880,26 +15400,34 @@ SKU Support: - 0 – Not allowed. - 1 (default) – Allowed. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Settings/AllowEditDeviceName** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ 1 |
+ 1 |
+
Allows editing of the device name. @@ -13908,26 +15436,34 @@ SKU Support: - 0 – Not allowed. - 1 (default) – Allowed. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: No -- Education: No -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Settings/AllowLanguage** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows the user to change VPN settings. @@ -14064,26 +15632,34 @@ SKU Support: - 0 – Not allowed. - 1 (default) – Allowed. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Settings/AllowWorkplace** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows user to change account settings. @@ -14124,26 +15708,34 @@ SKU Support: - 0 – Not allowed. - 1 (default) – Allowed. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Settings/ConfigureTaskbarCalendar** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
Added in Windows 10, version 1703. Allows IT Admins to configure the default setting for showing additional calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout. In this version of Windows 10, supported additional calendars are: Simplified or Traditional Chinese lunar calendar. Turning on one of these calendars will display Chinese lunar dates below the default calendar for the locale. Select "Don't show additional calendars" to prevent showing other calendars besides the default calendar for the locale. @@ -14154,27 +15746,34 @@ SKU Support: - 2 - Simplified Chinese (Lunar). - 3 - Traditional Chinese (Lunar). - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Settings/PageVisibilityList** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. Allows IT Admins to either prevent specific pages in the System Settings app from being visible or accessible, or to do so for all pages except those specified. The mode will be specified by the policy string beginning with either the string "showonly:" or "hide:". Pages are identified by a shortened version of their already published URIs, which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:foo", the page identifier used in the policy will be just "foo". Multiple page identifiers are separated by semicolons. @@ -14208,27 +15807,34 @@ SKU Support: 2. Configure the policy with the following string: "hide:about". 3. Open System Settings again and verify that the About page is no longer accessible. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **SmartScreen/EnableAppInstallControl** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
Added in Windows 10, version 1703. Allows IT Admins to control whether users are allowed to install apps from places other than the Store. @@ -14237,27 +15843,34 @@ SKU Support: - 0 – Turns off Application Installation Control, allowing users to download and install files from anywhere on the web. - 1 – Turns on Application Installation Control, allowing users to only install apps from the Store. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **SmartScreen/EnableSmartScreenInShell** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
Added in Windows 10, version 1703. Allows IT Admins to configure SmartScreen for Windows. @@ -14266,27 +15879,34 @@ SKU Support: - 0 – Turns off SmartScreen in Windows. - 1 – Turns on SmartScreen in Windows. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **SmartScreen/PreventOverrideForFilesInShell** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
Added in Windows 10, version 1703. Allows IT Admins to control whether users can can ignore SmartScreen warnings and run malicious files. @@ -14295,27 +15915,34 @@ SKU Support: - 0 – Employees can ignore SmartScreen warnings and run malicious files. - 1 – Employees cannot ignore SmartScreen warnings and run malicious files. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Speech/AllowSpeechModelUpdate** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
| 1 |
+ 1 |
+ + | 1 |
+ 1 |
+ 1 |
+ 1 |
+
Added in Windows 10, version 1607. Specifies whether the device will receive updates to the speech recognition and speech synthesis models. A speech model contains data used by the speech engine to convert audio to text (or vice-versa). The models are periodically updated to improve accuracy and performance. Models are non-executable data files. If enabled, the device will periodically check for updated speech models and then download them from a Microsoft service using the Background Internet Transfer Service (BITS). @@ -14324,26 +15951,34 @@ SKU Support: - 0 – Not allowed. - 1 (default) – Allowed. - - - - -SKU Support: -- Home: Yes -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Start/ForceStartSize** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
If there is policy configuration conflict, the latest configuration request is applied to the device. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Start/HideAppList** @@ -14399,9 +16019,6 @@ SKU Support: - 2b - If set to '2': Verify that the all apps list is collapsed, and that the Settings toggle is grayed out. - 2c - If set to '3': Verify that there is no way of opening the all apps list from Start, and that the Settings toggle is grayed out. - - - @@ -14420,9 +16037,6 @@ SKU Support: 1. Enable policy. 2. Open Start, click on the user tile, and verify that "Change account settings" is not available. - - - @@ -14448,9 +16062,6 @@ SKU Support: 5. Check that "Show most used apps" Settings toggle is grayed out. 6. Check that most used apps do not appear in Start. - - - @@ -14472,9 +16083,6 @@ SKU Support: > [!NOTE] > This policy can only be verified on laptops as "Hibernate" does not appear on regular PC's. - - - @@ -14493,9 +16101,6 @@ SKU Support: 1. Enable policy. 2. Open Start, click on the user tile, and verify "Lock" is not available. - - - @@ -14517,9 +16122,6 @@ SKU Support: 1. Enable policy. 2. Open Start, and verify the power button is not available. - - - @@ -14548,9 +16150,6 @@ SKU Support: 8. Repeat Step 2. 9. Right Click pinned photos app and verify that there is no jumplist of recent items. - - - @@ -14576,9 +16175,6 @@ SKU Support: 5. Check that "Show recently added apps" Settings toggle is grayed out. 6. Check that recently added apps do not appear in Start. - - - @@ -14597,9 +16193,6 @@ SKU Support: 1. Enable policy. 2. Open Start, click on the Power button, and verify "Restart" and "Update and restart" are not available. - - - @@ -14618,9 +16211,6 @@ SKU Support: 1. Enable policy. 2. Open Start, click on the Power button, and verify "Shut down" and "Update and shut down" are not available. - - - @@ -14639,9 +16229,6 @@ SKU Support: 1. Enable policy. 2. Open Start, click on the user tile, and verify "Sign out" is not available. - - - @@ -14660,9 +16247,6 @@ SKU Support: 1. Enable policy. 2. Open Start, click on the Power button, and verify that "Sleep" is not available. - - - @@ -14681,9 +16265,6 @@ SKU Support: 1. Enable policy. 2. Open Start, click on the user tile, and verify that "Switch account" is not available. - - - @@ -14706,9 +16287,6 @@ SKU Support: 2. Log off. 3. Log in, and verify that the user tile is gone from Start. - - - @@ -14732,9 +16310,6 @@ SKU Support: 3. Sign out/in. 4. Verify that all Edge assets defined in XML show up in %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState path. - - - @@ -14756,14 +16331,34 @@ SKU Support: 4. Open Start and right click on one of the app list icons. 5. Verify that More->Pin to taskbar menu does not show. - - - **Start/StartLayout** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
This policy is described in [Start/StartLayout Examples](#startlayout-examples) later in this topic. - - - - -SKU Support: -- Home: No -- Pro: No -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Storage/EnhancedStorageDevices** @@ -14807,8 +16387,6 @@ If you enable this policy setting, Windows will not activate unactivated Enhance If you disable or do not configure this policy setting, Windows will activate unactivated Enhanced Storage devices. - - ADMX Info: @@ -14822,6 +16400,29 @@ ADMX Info: **System/AllowBuildPreview** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether set general purpose device to be in embedded mode. @@ -14867,25 +16476,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes - - **System/AllowExperimentation** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **System/AllowFontProviders** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. Boolean policy setting that determines whether Windows is allowed to download fonts and font catalog data from an online font provider. If you enable this setting, Windows periodically queries an online font provider to determine whether a new font catalog is available. Windows may also download font data if needed to format or render text. If you disable this policy setting, Windows does not connect to an online font provider and only enumerates locally-installed fonts. @@ -14939,26 +16565,34 @@ SKU Support: - After a client machine is rebooted, check whether there is any network traffic from client machine to fs.microsoft.com. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes - - **System/AllowLocation** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether to allow app access to the Location service. @@ -14976,26 +16610,34 @@ SKU Support:
For example, an app's original Location setting is Off. The administrator then sets the **AllowLocation** policy to 2 (Force Location On.) The Location service starts working for that app, overriding the original setting. Later, if the administrator switches the **AllowLocation** policy back to 1 (User Control), the app will revert to using its original setting of Off. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **System/AllowStorageCard** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Controls whether the user is allowed to use the storage card for device storage. This setting prevents programmatic access to the storage card. @@ -15006,26 +16648,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): Yes - - **System/AllowTelemetry** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allow the device to send diagnostic and usage telemetry data, such as Watson. @@ -15091,26 +16741,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **System/AllowUserToResetPhone** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Specifies whether to allow the user to factory reset the phone by using control panel and hardware key combination. @@ -15121,22 +16779,7 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **System/BootStartDriverInitialization** @@ -15144,8 +16787,6 @@ SKU Support: N/A - - ADMX Info: @@ -15159,6 +16800,29 @@ ADMX Info: **System/DisableOneDriveFileSync** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
Added in Windows 10, version 1703. Allows IT Admins to prevent apps and features from working with files on OneDrive. If you enable this policy setting: @@ -15181,23 +16845,7 @@ ADMX Info: 2. Restart machine. 3. Verify that OneDrive.exe is not running in Task Manager. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **System/DisableSystemRestore** @@ -15215,8 +16863,6 @@ If you disable or do not configure this policy setting, users can perform System Also, see the "Turn off System Restore configuration" policy setting. If the "Turn off System Restore" policy setting is disabled or not configured, the "Turn off System Restore configuration" policy setting is used to determine whether the option to configure System Restore is available. - - ADMX Info: @@ -15230,31 +16876,62 @@ ADMX Info: **System/TelemetryProxy** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allows you to specify the fully qualified domain name (FQDN) or IP address of a proxy server to forward Connected User Experiences and Telemetry requests. The format for this setting is *<server>:<port>*. The connection is made over a Secure Sockets Layer (SSL) connection. If the named proxy fails, or if there is no proxy specified when this policy is enabled, the Connected User Experiences and Telemetry data will not be transmitted and will remain on the local device.
If you disable or do not configure this policy setting, Connected User Experiences and Telemetry will go to Microsoft using the default proxy configuration. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): Yes - - **TextInput/AllowIMELogging** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **TextInput/AllowIMENetworkAccess** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **TextInput/AllowInputPanel** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **TextInput/AllowJapaneseIMESurrogatePairCharacters** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **TextInput/AllowJapaneseIVSCharacters** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **TextInput/AllowJapaneseNonPublishingStandardGlyph** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **TextInput/AllowJapaneseUserDictionary** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **TextInput/AllowKeyboardTextSuggestions** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ |
+
This policy has been deprecated. - - - **TextInput/AllowLanguageFeaturesUninstall** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **TextInput/ExcludeJapaneseIMEExceptJIS0208** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ 1 |
+
The default is 17 (5 PM). - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Update/ActiveHoursMaxRange** @@ -15735,14 +17486,34 @@ SKU Support:
The default value is 18 (hours). - - - **Update/ActiveHoursStart** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ 1 |
+
The default value is 8 (8 AM). - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Update/AllowAutoUpdate** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
If the policy is not configured, end-users get the default behavior (Auto install and restart). - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Update/AllowMUUpdateService** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
This policy is specific to desktop and local publishing via WSUS for 3rd party updates (binaries and updates not hosted on Microsoft Update) and allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Update/AllowUpdateService** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
The default value is 15 (minutes). - - - @@ -15960,14 +17744,34 @@ SKU Support: - 1 (default) – Auto Dismissal. - 2 – User Dismissal. - - - **Update/BranchReadinessLevel** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ 1 |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ 1 |
+
Supported values are 0-30. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Update/DeferUpdatePeriod** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Update/DetectionFrequency** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ 2 |
+
Added in Windows 10, version 1703. Specifies the scan frequency from every 1 - 22 hours. Default is 22 hours. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Update/EngagedRestartDeadline** @@ -16225,9 +18052,6 @@ SKU Support:
The default value is 0 days (not specified). - - - @@ -16244,9 +18068,6 @@ SKU Support:
The default value is 3 days. - - - @@ -16263,14 +18084,34 @@ SKU Support:
The default value is 7 days. - - - **Update/ExcludeWUDriversInQualityUpdate** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ |
+ 2 |
+ 2 |
+ |
+ |
+
Added in the April service release of Windows 10, version 1607. Allows Windows Update Agent to determine the download URL when it is missing from the metadata. This scenario will occur when intranet update service stores the metadata files but the download contents are stored in the ISV file cache (specified as the alternate download URL). @@ -16315,27 +18163,34 @@ SKU Support: - 0 (default) – Disabled. - 1 – Enabled. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: No -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Update/IgnoreMOAppDownloadLimit** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ 2 |
+
Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. @@ -16357,28 +18212,34 @@ SKU Support: 3. Verify that any downloads that are above the download size limit will complete without being paused. - - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Update/IgnoreMOUpdateDownloadLimit** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ 2 |
+
Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. @@ -16398,28 +18259,34 @@ SKU Support: 3. Verify that any downloads that are above the download size limit will complete without being paused. - - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Update/PauseDeferrals** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Update/PauseFeatureUpdates** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ + | 2 |
+ 2 |
+ |
+ 2 |
+
Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Feature Updates.
Value type is string. Supported operations are Add, Get, Delete, and Replace. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Update/PauseQualityUpdates** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ 1 |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ + | 2 |
+ 2 |
+ |
+ 2 |
+
Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Quality Updates.
Value type is string. Supported operations are Add, Get, Delete, and Replace. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Update/RequireDeferUpgrade** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
The default value is 15 (minutes). - - - @@ -16675,14 +18572,34 @@ SKU Support:
The default value is 4 (hours). - - - **Update/ScheduledInstallDay** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
The default value is 3. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Update/SetAutoRestartNotificationDisable** @@ -16772,14 +18682,34 @@ SKU Support: - 0 (default) – Enabled - 1 – Disabled - - - **Update/SetEDURestart** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ |
+ 2 |
+
Added in Windows 10, version 1703. For devices in a cart, this policy skips the check for battery level to ensure that the reboot will happen at ScheduledInstallTime. @@ -16788,27 +18718,34 @@ SKU Support: - 0 - not configured - 1 - configured - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Update/UpdateServiceUrl** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
This policy has been deprecated. - - - **Wifi/AllowAutoConnectToWiFiSenseHotspots** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allow or disallow the device to automatically connect to Wi-Fi hotspots. @@ -16920,26 +18870,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Wifi/AllowInternetSharing** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allow or disallow internet sharing. @@ -16950,26 +18908,34 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): Yes - - **Wifi/AllowManualWiFiConfiguration** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks. @@ -16983,27 +18949,34 @@ SKU Support: > [!NOTE] > Setting this policy deletes any previously installed user-configured and Wi-Fi sense Wi-Fi profiles from the device. Certain Wi-Fi profiles that are not user configured nor Wi-Fi sense might not be deleted. In addition, not all non-MDM profiles are completely deleted. - - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **Wifi/AllowWiFi** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
Allow or disallow WiFi connection. @@ -17014,53 +18987,68 @@ SKU Support:
Most restricted value is 0. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): Yes - - **Wifi/AllowWiFiDirect** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. Allow WiFi Direct connection.. - 0 - WiFi Direct connection is not allowed. - 1 - WiFi Direct connection is allowed. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **Wifi/WLANScanMode** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ + | |
+ |
+ |
+ |
+
Allow an enterprise to control the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected. @@ -17070,26 +19058,34 @@ SKU Support:
Supported operations are Add, Delete, Get, and Replace. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
Added in Windows 10, version 1607. Show recommended app suggestions in the ink workspace. @@ -17098,26 +19094,34 @@ SKU Support: - 0 - app suggestions are not allowed. - 1 (default) -allow app suggestions. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **WindowsInkWorkspace/AllowWindowsInkWorkspace** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
Added in Windows 10, version 1607. Specifies whether to allow the user to access the ink workspace. @@ -17127,22 +19131,7 @@ SKU Support: - 1 - ink workspace is enabled (feature is turned on), but the user cannot access it above the lock screen. - 2 (default) - ink workspace is enabled (feature is turned on), and the user is allowed to use it above the lock screen. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **WindowsLogon/DisableLockScreenAppNotifications** @@ -17154,8 +19143,6 @@ If you enable this policy setting, no app notifications are displayed on the loc If you disable or do not configure this policy setting, users can choose which apps display notifications on the lock screen. - - ADMX Info: @@ -17176,8 +19163,6 @@ If you enable this policy setting, the PC's network connectivity state cannot be If you disable or don't configure this policy setting, any user can disconnect the PC from the network or can connect the PC to other available networks without signing into Windows. - - ADMX Info: @@ -17191,6 +19176,29 @@ ADMX Info: **WindowsLogon/HideFastUserSwitching** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ + | 2 |
+ 2 |
+ |
+ |
+
Added in Windows 10, version 1703. This policy setting allows you to hide the Switch account button on the sign-in screen, Start, and the Task Manager. If you enable this policy setting, the Switch account button is hidden from the user who is attempting to sign-in or is signed in to the computer that has this policy applied. If you disable or do not configure this policy setting, the Switch account button is accessible to the user in the three locations. @@ -17204,80 +19212,102 @@ ADMX Info: 1. Enable policy. 2. Verify that the Switch account button in Start is hidden. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **WirelessDisplay/AllowProjectionFromPC** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. This policy allows you to turn off projection from a PC. - 0 - your PC cannot discover or project to other devices. - 1 - your PC can discover and project to other devices - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **WirelessDisplay/AllowProjectionFromPCOverInfrastructure** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. This policy allows you to turn off projection from a PC over infrastructure. - 0 - your PC cannot discover or project to other infrastructure devices, although it is possible to discover and project over WiFi Direct. - 1 - your PC can discover and project to other devices over infrastructure. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **WirelessDisplay/AllowProjectionToPC** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
Added in Windows 10, version 1607. Allow or disallow turning off the projection to a PC. @@ -17288,49 +19318,41 @@ SKU Support: - 0 - projection to PC is not allowed. Always off and the user cannot enable it. - 1 (default) - projection to PC is allowed. Enabled only above the lock screen. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - - **WirelessDisplay/AllowProjectionToPCOverInfrastructure** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. This policy setting allows you to turn off projection to a PC over infrastructure. - 0 - your PC is not discoverable and other devices cannot project to it over infrastructure, although it is possible to project to it over WiFi Direct. - 1 - your PC is discoverable and other devices can project to it over infrastructure. - - - - -SKU Support: -- Home: No -- Pro: Yes -- Business: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: Yes -- Mobile Enterprise: Yes -- IoT Core: Yes -- Can be set using Exchange Active Sync (EAS): No - - **WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver** @@ -17338,19 +19360,34 @@ SKU Support:
Added in Windows 10, version 1703. - - - - -SKU Support: -- Can be set using Exchange Active Sync (EAS): No - - **WirelessDisplay/RequirePinForPairing** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
|---|---|---|---|---|---|---|
|
+ 1 |
+ + | 1 |
+ 1 |
+ |
+ |
+
Added in Windows 10, version 1607. Allow or disallow requirement for a PIN for pairing. @@ -17361,25 +19398,91 @@ SKU Support: - 0 (default) - PIN is not required. - 1 - PIN is required. - - - -SKU Support: -- Home: No -- Pro: Yes -- Enterprise: Yes -- Education: Yes -- Mobile: No -- Mobile Enterprise: No -- IoT Core: No -- Can be set using Exchange Active Sync (EAS): No - -
+ +Footnote: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. + + +## IoT Core Support + +[ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) +[Authentication/AllowFastReconnect](#authentication-allowfastreconnect) +[Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) +[Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) +[Bluetooth/LocalDeviceName](#bluetooth-localdevicename) +[Bluetooth/ServicesAllowedList](#bluetooth-servicesallowedlist) +[Browser/AllowAutofill](#browser-allowautofill) +[Browser/AllowBrowser](#browser-allowbrowser) +[Browser/AllowCookies](#browser-allowcookies) +[Browser/AllowDoNotTrack](#browser-allowdonottrack) +[Browser/AllowInPrivate](#browser-allowinprivate) +[Browser/AllowPasswordManager](#browser-allowpasswordmanager) +[Browser/AllowPopups](#browser-allowpopups) +[Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) +[Browser/EnterpriseModeSiteList](#browser-enterprisemodesitelist) +[Browser/EnterpriseSiteListServiceUrl](#browser-enterprisesitelistserviceurl) +[Browser/SendIntranetTraffictoInternetExplorer](#browser-sendintranettraffictointernetexplorer) +[Camera/AllowCamera](#camera-allowcamera) +[Connectivity/AllowBluetooth](#connectivity-allowbluetooth) +[Connectivity/AllowCellularDataRoaming](#connectivity-allowcellulardataroaming) +[Connectivity/AllowNFC](#connectivity-allownfc) +[Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) +[Connectivity/AllowVPNOverCellular](#connectivity-allowvpnovercellular) +[Connectivity/AllowVPNRoamingOverCellular](#connectivity-allowvpnroamingovercellular) +[DataProtection/AllowDirectMemoryAccess](#dataprotection-allowdirectmemoryaccess) +[Security/AllowAddProvisioningPackage](#security-allowaddprovisioningpackage) +[Security/AllowRemoveProvisioningPackage](#security-allowremoveprovisioningpackage) +[Security/RequireDeviceEncryption](#security-requiredeviceencryption) +[Security/RequireProvisioningPackageSignature](#security-requireprovisioningpackagesignature) +[System/AllowEmbeddedMode](#system-allowembeddedmode) +[System/AllowStorageCard](#system-allowstoragecard) +[System/TelemetryProxy](#system-telemetryproxy) +[Update/AllowNonMicrosoftSignedUpdate](#update-allownonmicrosoftsignedupdate) +[Update/AllowUpdateService](#update-allowupdateservice) +[Update/PauseDeferrals](#update-pausedeferrals) +[Update/RequireDeferUpgrade](#update-requiredeferupgrade) +[Update/RequireUpdateApproval](#update-requireupdateapproval) +[Update/ScheduledInstallDay](#update-scheduledinstallday) +[Update/ScheduledInstallTime](#update-scheduledinstalltime) +[Update/UpdateServiceUrl](#update-updateserviceurl) +[Wifi/AllowAutoConnectToWiFiSenseHotspots](#wifi-allowautoconnecttowifisensehotspots) +[Wifi/AllowInternetSharing](#wifi-allowinternetsharing) +[Wifi/AllowWiFi](#wifi-allowwifi) +[Wifi/WLANScanMode](#wifi-wlanscanmode) + + + +## Can be set using Exchange Active Sync (EAS) + +[Browser/AllowBrowser](#browser-allowbrowser) +[Camera/AllowCamera](#camera-allowcamera) +[Connectivity/AllowBluetooth](#connectivity-allowbluetooth) +[Connectivity/AllowCellularDataRoaming](#connectivity-allowcellulardataroaming) +[Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) +[DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) +[DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) +[DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) +[DeviceLock/DevicePasswordExpiration](#devicelock-devicepasswordexpiration) +[DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) +[DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) +[DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) +[DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) +[DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) +[Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) +[Security/RequireDeviceEncryption](#security-requiredeviceencryption) +[System/AllowStorageCard](#system-allowstoragecard) +[System/TelemetryProxy](#system-telemetryproxy) +[Wifi/AllowInternetSharing](#wifi-allowinternetsharing) +[Wifi/AllowWiFi](#wifi-allowwifi) + + ## Examples diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index 3edb63ebe7..3a2d11e3db 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -1,15 +1,12 @@ --- title: Policy DDF file description: Policy DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: D90791B5-A772-4AF8-B058-5D566865AF8D -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Policy DDF file diff --git a/windows/client-management/mdm/policymanager-csp.md b/windows/client-management/mdm/policymanager-csp.md index c20fa69027..8124940a17 100644 --- a/windows/client-management/mdm/policymanager-csp.md +++ b/windows/client-management/mdm/policymanager-csp.md @@ -1,15 +1,12 @@ --- title: PolicyManager CSP description: PolicyManager CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 048427b1-6024-4660-8660-bd91c583f7f9 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # PolicyManager CSP diff --git a/windows/client-management/mdm/provisioning-csp.md b/windows/client-management/mdm/provisioning-csp.md index 9d7fe6b775..9ae10f0f2c 100644 --- a/windows/client-management/mdm/provisioning-csp.md +++ b/windows/client-management/mdm/provisioning-csp.md @@ -1,15 +1,12 @@ --- title: Provisioning CSP description: The Provisioning configuration service provider is used for bulk user enrollment to an MDM service. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 5D6C17BE-727A-4AFA-9F30-B34C1EA1D2AE -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Provisioning CSP diff --git a/windows/client-management/mdm/proxy-csp.md b/windows/client-management/mdm/proxy-csp.md index 2c69cb99be..65e4ceb727 100644 --- a/windows/client-management/mdm/proxy-csp.md +++ b/windows/client-management/mdm/proxy-csp.md @@ -1,15 +1,12 @@ --- title: PROXY CSP description: PROXY CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 9904d44c-4a1e-4ae7-a6c7-5dba06cb16ce -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # PROXY CSP diff --git a/windows/client-management/mdm/push-notification-windows-mdm.md b/windows/client-management/mdm/push-notification-windows-mdm.md index ae58089129..e34d5f94f2 100644 --- a/windows/client-management/mdm/push-notification-windows-mdm.md +++ b/windows/client-management/mdm/push-notification-windows-mdm.md @@ -4,15 +4,12 @@ description: The DMClient CSP supports the ability to configure push-initiated d MS-HAID: - 'p\_phdevicemgmt.push\_notification\_support\_for\_device\_management' - 'p\_phDeviceMgmt.push\_notification\_windows\_mdm' -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 9031C4FE-212A-4481-A1B0-4C3190B388AE -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- diff --git a/windows/client-management/mdm/pxlogical-csp.md b/windows/client-management/mdm/pxlogical-csp.md index 16e33e0a5e..d3391b6066 100644 --- a/windows/client-management/mdm/pxlogical-csp.md +++ b/windows/client-management/mdm/pxlogical-csp.md @@ -1,15 +1,12 @@ --- title: PXLOGICAL configuration service provider description: PXLOGICAL configuration service provider -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: b5fc84d4-aa32-4edd-95f1-a6a9c0feb459 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # PXLOGICAL configuration service provider diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md index 8b7546365e..6180829e89 100644 --- a/windows/client-management/mdm/reboot-csp.md +++ b/windows/client-management/mdm/reboot-csp.md @@ -1,15 +1,12 @@ --- title: Reboot CSP description: Reboot CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 4E3F1225-BBAD-40F5-A1AB-FF221B6BAF48 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Reboot CSP diff --git a/windows/client-management/mdm/reboot-ddf-file.md b/windows/client-management/mdm/reboot-ddf-file.md index 1854905947..714d7255ec 100644 --- a/windows/client-management/mdm/reboot-ddf-file.md +++ b/windows/client-management/mdm/reboot-ddf-file.md @@ -1,15 +1,12 @@ --- title: Reboot DDF file description: This topic shows the OMA DM device description framework (DDF) for the Reboot configuration service provider. DDF files are used only with OMA DM provisioning XML. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: ABBD850C-E744-462C-88E7-CA3F43D80DB1 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Reboot DDF file diff --git a/windows/client-management/mdm/reclaim-seat-from-user.md b/windows/client-management/mdm/reclaim-seat-from-user.md index 8f29cf0f62..ee5bc80e60 100644 --- a/windows/client-management/mdm/reclaim-seat-from-user.md +++ b/windows/client-management/mdm/reclaim-seat-from-user.md @@ -1,15 +1,12 @@ --- title: Reclaim seat from user description: The Reclaim seat from user operation returns reclaimed seats for a user in the Windows Store for Business. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: E2C3C899-D0AD-469A-A319-31A420472A4C -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Reclaim seat from user diff --git a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md index 0b4b04eb62..344a2176e6 100644 --- a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md +++ b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md @@ -1,15 +1,12 @@ --- title: Register your free Azure Active Directory subscription description: If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services, you have a free subscription to Azure AD. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 97DCD303-BB11-4AFF-84FE-B7F14CDF64F7 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Register your free Azure Active Directory subscription diff --git a/windows/client-management/mdm/registry-csp.md b/windows/client-management/mdm/registry-csp.md index fdd8e867f6..3874d0f2d7 100644 --- a/windows/client-management/mdm/registry-csp.md +++ b/windows/client-management/mdm/registry-csp.md @@ -1,15 +1,12 @@ --- title: Registry CSP description: Registry CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 2307e3fd-7b61-4f00-94e1-a639571f2c9d -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Registry CSP diff --git a/windows/client-management/mdm/registry-ddf-file.md b/windows/client-management/mdm/registry-ddf-file.md index 179ce9f272..5ee429e5ca 100644 --- a/windows/client-management/mdm/registry-ddf-file.md +++ b/windows/client-management/mdm/registry-ddf-file.md @@ -1,15 +1,12 @@ --- title: Registry DDF file description: Registry DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 29b5cc07-f349-4567-8a77-387d816a9d15 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Registry DDF file diff --git a/windows/client-management/mdm/remotefind-csp.md b/windows/client-management/mdm/remotefind-csp.md index f11afd65e5..29447d3ed2 100644 --- a/windows/client-management/mdm/remotefind-csp.md +++ b/windows/client-management/mdm/remotefind-csp.md @@ -1,15 +1,12 @@ --- title: RemoteFind CSP description: The RemoteFind configuration service provider retrieves the location information for a particular device. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 2EB02824-65BF-4B40-A338-672D219AF5A0 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # RemoteFind CSP diff --git a/windows/client-management/mdm/remotefind-ddf-file.md b/windows/client-management/mdm/remotefind-ddf-file.md index 746dc26f77..c30856f87d 100644 --- a/windows/client-management/mdm/remotefind-ddf-file.md +++ b/windows/client-management/mdm/remotefind-ddf-file.md @@ -1,15 +1,12 @@ --- title: RemoteFind DDF file description: This topic shows the OMA DM device description framework (DDF) for the RemoteFind configuration service provider. DDF files are used only with OMA DM provisioning XML. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 5864CBB8-2030-459E-BCF6-9ACB69206FEA -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # RemoteFind DDF file diff --git a/windows/client-management/mdm/remotelock-csp.md b/windows/client-management/mdm/remotelock-csp.md index 6afa9644ad..1ac58b24af 100644 --- a/windows/client-management/mdm/remotelock-csp.md +++ b/windows/client-management/mdm/remotelock-csp.md @@ -1,15 +1,12 @@ --- title: RemoteLock CSP description: RemoteLock CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: c7889331-5aa3-4efe-9a7e-20d3f433659b -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # RemoteLock CSP diff --git a/windows/client-management/mdm/remotelock-ddf-file.md b/windows/client-management/mdm/remotelock-ddf-file.md index 186a01cf7e..1f09e6508c 100644 --- a/windows/client-management/mdm/remotelock-ddf-file.md +++ b/windows/client-management/mdm/remotelock-ddf-file.md @@ -1,15 +1,12 @@ --- title: RemoteLock DDF file description: RemoteLock DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: A301AE26-1BF1-4328-99AB-1ABBA4960797 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # RemoteLock DDF file diff --git a/windows/client-management/mdm/remotering-csp.md b/windows/client-management/mdm/remotering-csp.md index 9e472ec2d6..4f16070cb7 100644 --- a/windows/client-management/mdm/remotering-csp.md +++ b/windows/client-management/mdm/remotering-csp.md @@ -1,15 +1,12 @@ --- title: RemoteRing CSP description: RemoteRing CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 70015243-c07f-46cb-a0f9-4b4ad13a5609 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # RemoteRing CSP diff --git a/windows/client-management/mdm/remotering-ddf-file.md b/windows/client-management/mdm/remotering-ddf-file.md index 388027a75e..8d690e645e 100644 --- a/windows/client-management/mdm/remotering-ddf-file.md +++ b/windows/client-management/mdm/remotering-ddf-file.md @@ -1,15 +1,12 @@ --- title: RemoteRing DDF file description: This topic shows the OMA DM device description framework (DDF) for the RemoteRing configuration service provider. DDF files are used only with OMA DM provisioning XML. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 6815267F-212B-4370-8B72-A457E8000F7B -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # RemoteRing DDF file diff --git a/windows/client-management/mdm/remotewipe-csp.md b/windows/client-management/mdm/remotewipe-csp.md index 5d39d7b7b5..81a742eab8 100644 --- a/windows/client-management/mdm/remotewipe-csp.md +++ b/windows/client-management/mdm/remotewipe-csp.md @@ -1,15 +1,12 @@ --- title: RemoteWipe CSP description: RemoteWipe CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 6e89bd37-7680-4940-8a67-11ed062ffb70 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # RemoteWipe CSP diff --git a/windows/client-management/mdm/remotewipe-ddf-file.md b/windows/client-management/mdm/remotewipe-ddf-file.md index 8bcac9fb38..fa91cdb835 100644 --- a/windows/client-management/mdm/remotewipe-ddf-file.md +++ b/windows/client-management/mdm/remotewipe-ddf-file.md @@ -1,15 +1,12 @@ --- title: RemoteWipe DDF file description: RemoteWipe DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 10ec4fb7-f911-4d0c-9a8f-e96bf5faea0c -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # RemoteWipe DDF file diff --git a/windows/client-management/mdm/reporting-csp.md b/windows/client-management/mdm/reporting-csp.md index 498de35717..83d3d3f5b5 100644 --- a/windows/client-management/mdm/reporting-csp.md +++ b/windows/client-management/mdm/reporting-csp.md @@ -1,15 +1,12 @@ --- title: Reporting CSP description: The Reporting configuration service provider is used to retrieve Windows Information Protection (formerly known as Enterprise Data Protection) and security auditing logs. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 148441A6-D9E1-43D8-ADEE-FB62E85A39F7 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Reporting CSP diff --git a/windows/client-management/mdm/reporting-ddf-file.md b/windows/client-management/mdm/reporting-ddf-file.md index 97a063b1d3..ff3de3aab3 100644 --- a/windows/client-management/mdm/reporting-ddf-file.md +++ b/windows/client-management/mdm/reporting-ddf-file.md @@ -1,15 +1,12 @@ --- title: Reporting DDF file description: This topic shows the OMA DM device description framework (DDF) for the Reporting configuration service provider. This CSP was added in Windows 10, version 1511. Support for desktop security auditing was added for the desktop in Windows 10, version 1607. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 7A5B79DB-9571-4F7C-ABED-D79CD08C1E35 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Reporting DDF file diff --git a/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md b/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md index 7f7b8824d9..87ad349555 100644 --- a/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md +++ b/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md @@ -4,15 +4,12 @@ description: REST API reference for Windows Store for Business MS-HAID: - 'p\_phdevicemgmt.business\_store\_portal\_management\_rest\_api\_reference' - 'p\_phDeviceMgmt.rest\_api\_reference\_windows\_store\_for\_Business' -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 8C48A879-525A-471F-B0FD-506E743A7D2F -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # REST API reference for Windows Store for Business diff --git a/windows/client-management/mdm/rootcacertificates-csp.md b/windows/client-management/mdm/rootcacertificates-csp.md index 669dbc6dab..ae0852dd78 100644 --- a/windows/client-management/mdm/rootcacertificates-csp.md +++ b/windows/client-management/mdm/rootcacertificates-csp.md @@ -1,15 +1,12 @@ --- title: RootCATrustedCertificates CSP description: RootCATrustedCertificates CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: F2F25DEB-9DB3-40FB-BC3C-B816CE470D61 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # RootCATrustedCertificates CSP diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md index b9af3d73bd..e825e38ead 100644 --- a/windows/client-management/mdm/rootcacertificates-ddf-file.md +++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md @@ -1,15 +1,12 @@ --- title: RootCATrustedCertificates DDF file description: RootCATrustedCertificates DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 06D8787B-D3E1-4D4B-8A21-8045A8F85C1C -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # RootCATrustedCertificates DDF file diff --git a/windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md b/windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md index 8af994de2c..8ab213e4cf 100644 --- a/windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md +++ b/windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md @@ -1,15 +1,12 @@ --- title: Samples for writing a custom configuration service provider description: Samples for writing a custom configuration service provider -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: ccda4d62-7ce1-483b-912f-25d50c974270 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Samples for writing a custom configuration service provider diff --git a/windows/client-management/mdm/secureassessment-csp.md b/windows/client-management/mdm/secureassessment-csp.md index e94006221c..8f671e0d21 100644 --- a/windows/client-management/mdm/secureassessment-csp.md +++ b/windows/client-management/mdm/secureassessment-csp.md @@ -1,15 +1,12 @@ --- title: SecureAssessment CSP description: SecureAssessment CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 6808BE4B-961E-4638-BF15-FD7841D1C00A -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # SecureAssessment CSP diff --git a/windows/client-management/mdm/secureassessment-ddf-file.md b/windows/client-management/mdm/secureassessment-ddf-file.md index fa93e99ad4..57601f53e0 100644 --- a/windows/client-management/mdm/secureassessment-ddf-file.md +++ b/windows/client-management/mdm/secureassessment-ddf-file.md @@ -1,15 +1,12 @@ --- title: SecureAssessment DDF file description: This topic shows the OMA DM device description framework (DDF) for the SecureAssessment configuration service provider. DDF files are used only with OMA DM provisioning XML. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 68D17F2A-FAEA-4608-8727-DBEC1D7BE48A -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # SecureAssessment DDF file diff --git a/windows/client-management/mdm/securitypolicy-csp.md b/windows/client-management/mdm/securitypolicy-csp.md index 6fc15e30bb..28e87b7c43 100644 --- a/windows/client-management/mdm/securitypolicy-csp.md +++ b/windows/client-management/mdm/securitypolicy-csp.md @@ -1,15 +1,12 @@ --- title: SecurityPolicy CSP description: SecurityPolicy CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 6014f8fe-f91b-49f3-a357-bdf625545bc9 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # SecurityPolicy CSP diff --git a/windows/client-management/mdm/server-requirements-windows-mdm.md b/windows/client-management/mdm/server-requirements-windows-mdm.md index bc372c4f37..0ced05ef07 100644 --- a/windows/client-management/mdm/server-requirements-windows-mdm.md +++ b/windows/client-management/mdm/server-requirements-windows-mdm.md @@ -4,15 +4,12 @@ description: Server requirements for using OMA DM to manage Windows devices MS-HAID: - 'p\_phDeviceMgmt.server\_requirements\_for\_oma\_dm' - 'p\_phDeviceMgmt.server\_requirements\_windows\_mdm' -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 5b90b631-62a6-4949-b53a-01275fd304b2 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Server requirements for using OMA DM to manage Windows devices diff --git a/windows/client-management/mdm/sharedpc-csp.md b/windows/client-management/mdm/sharedpc-csp.md index fd508bddc8..e8b16b4a18 100644 --- a/windows/client-management/mdm/sharedpc-csp.md +++ b/windows/client-management/mdm/sharedpc-csp.md @@ -1,15 +1,12 @@ --- title: SharedPC CSP description: SharedPC CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 31273166-1A1E-4F96-B176-CB42ECB80957 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # SharedPC CSP diff --git a/windows/client-management/mdm/sharedpc-ddf-file.md b/windows/client-management/mdm/sharedpc-ddf-file.md index fe6259624e..e666ac45e9 100644 --- a/windows/client-management/mdm/sharedpc-ddf-file.md +++ b/windows/client-management/mdm/sharedpc-ddf-file.md @@ -1,15 +1,12 @@ --- title: SharedPC DDF file description: SharedPC DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 70234197-07D4-478E-97BB-F6C651C0B970 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # SharedPC DDF file diff --git a/windows/client-management/mdm/storage-csp.md b/windows/client-management/mdm/storage-csp.md index 53b364243d..e383685013 100644 --- a/windows/client-management/mdm/storage-csp.md +++ b/windows/client-management/mdm/storage-csp.md @@ -1,15 +1,12 @@ --- title: Storage CSP description: Storage CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: b19bdb54-53ed-42ce-a5a1-269379013f57 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Storage CSP diff --git a/windows/client-management/mdm/storage-ddf-file.md b/windows/client-management/mdm/storage-ddf-file.md index 087e36a61f..2cf0a17551 100644 --- a/windows/client-management/mdm/storage-ddf-file.md +++ b/windows/client-management/mdm/storage-ddf-file.md @@ -1,15 +1,12 @@ --- title: Storage DDF file description: Storage DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 247062A3-4DFB-4B14-A3D1-68D02C27703C -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Storage DDF file diff --git a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md index c8e61157a6..031e69f53b 100644 --- a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md +++ b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md @@ -1,15 +1,12 @@ --- title: Structure of OMA DM provisioning files description: Structure of OMA DM provisioning files -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 7bd3ef57-c76c-459b-b63f-c5a333ddc2bc -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Structure of OMA DM provisioning files diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md index 25acb22d8e..150ca95701 100644 --- a/windows/client-management/mdm/supl-csp.md +++ b/windows/client-management/mdm/supl-csp.md @@ -1,15 +1,12 @@ --- title: SUPL CSP description: SUPL CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: afad0120-1126-4fc5-8e7a-64b9f2a5eae1 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # SUPL CSP diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index eedb7f2b31..266c2dcaf6 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -1,15 +1,12 @@ --- title: SUPL DDF file description: This topic shows the OMA DM device description framework (DDF) for the SUPL configuration service provider. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 514B7854-80DC-4ED9-9805-F5276BF38034 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # SUPL DDF file diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index aa210d64d8..f751e53b34 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -1,15 +1,12 @@ --- title: SurfaceHub CSP description: The SurfaceHub configuration service provider (CSP) is used to configure Microsoft Surface Hub settings. This CSP was added in Windows 10, version 1511. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 36FBBC32-AD6A-41F1-86BF-B384891AA693 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # SurfaceHub CSP diff --git a/windows/client-management/mdm/surfacehub-ddf-file.md b/windows/client-management/mdm/surfacehub-ddf-file.md index d47a546466..590539f3bb 100644 --- a/windows/client-management/mdm/surfacehub-ddf-file.md +++ b/windows/client-management/mdm/surfacehub-ddf-file.md @@ -1,15 +1,12 @@ --- title: SurfaceHub DDF file description: This topic shows the OMA DM device description framework (DDF) for the SurfaceHub configuration service provider. This CSP was added in Windows 10, version 1511. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: D34DA1C2-09A2-4BA3-BE99-AC483C278436 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # SurfaceHub DDF file diff --git a/windows/client-management/mdm/understanding-admx-backed-policies.md b/windows/client-management/mdm/understanding-admx-backed-policies.md index 6844ac7526..a308149484 100644 --- a/windows/client-management/mdm/understanding-admx-backed-policies.md +++ b/windows/client-management/mdm/understanding-admx-backed-policies.md @@ -1,11 +1,11 @@ --- title: Understanding ADMX-backed policies description: Starting in Windows 10, version 1703, you can use ADMX-backed policies for Windows 10 mobile device management (MDM) across Windows 10 devices. -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Understanding ADMX-backed policies diff --git a/windows/client-management/mdm/unifiedwritefilter-csp.md b/windows/client-management/mdm/unifiedwritefilter-csp.md index a63264b46d..8ef347d5c5 100644 --- a/windows/client-management/mdm/unifiedwritefilter-csp.md +++ b/windows/client-management/mdm/unifiedwritefilter-csp.md @@ -1,15 +1,12 @@ --- title: UnifiedWriteFilter CSP description: The UnifiedWriteFilter (UWF) configuration service provider enables the IT administrator to remotely manage the UWF to help protect physical storage media including any writable storage type. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: F4716AC6-0AA5-4A67-AECE-E0F200BA95EB -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # UnifiedWriteFilter CSP diff --git a/windows/client-management/mdm/unifiedwritefilter-ddf.md b/windows/client-management/mdm/unifiedwritefilter-ddf.md index 5e72b27c72..ae3e8f02e5 100644 --- a/windows/client-management/mdm/unifiedwritefilter-ddf.md +++ b/windows/client-management/mdm/unifiedwritefilter-ddf.md @@ -1,15 +1,12 @@ --- title: UnifiedWriteFilter DDF File description: UnifiedWriteFilter DDF File -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 23A7316E-A298-43F7-9407-A65155C8CEA6 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # UnifiedWriteFilter DDF File diff --git a/windows/client-management/mdm/update-csp.md b/windows/client-management/mdm/update-csp.md index 0d4d052ca3..61923798e2 100644 --- a/windows/client-management/mdm/update-csp.md +++ b/windows/client-management/mdm/update-csp.md @@ -1,15 +1,12 @@ --- title: Update CSP description: Update CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: F1627B57-0749-47F6-A066-677FDD3D7359 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Update CSP diff --git a/windows/client-management/mdm/update-ddf-file.md b/windows/client-management/mdm/update-ddf-file.md index 564b1a164c..a7617b44d2 100644 --- a/windows/client-management/mdm/update-ddf-file.md +++ b/windows/client-management/mdm/update-ddf-file.md @@ -1,15 +1,12 @@ --- title: Update DDF file description: Update DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: E236E468-88F3-402A-BA7A-834ED38DD388 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Update DDF file diff --git a/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md b/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md index 779ba4eec8..8eda2844e1 100644 --- a/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md +++ b/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md @@ -1,15 +1,12 @@ --- title: Using PowerShell scripting with the WMI Bridge Provider description: This topic covers using PowerShell Cmdlet scripts to configure per-user and per-device policy settings, as well as how to invoke methods through the WMI Bridge Provider. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 238D45AD-3FD8-46F9-B7FB-6AEE42BE4C08 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Using PowerShell scripting with the WMI Bridge Provider diff --git a/windows/client-management/mdm/vpn-csp.md b/windows/client-management/mdm/vpn-csp.md index d087514fd2..7310156f21 100644 --- a/windows/client-management/mdm/vpn-csp.md +++ b/windows/client-management/mdm/vpn-csp.md @@ -1,15 +1,12 @@ --- title: VPN CSP description: VPN CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 05ca946a-1c0b-4e11-8d7e-854e14740707 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # VPN CSP diff --git a/windows/client-management/mdm/vpn-ddf-file.md b/windows/client-management/mdm/vpn-ddf-file.md index f742ca010e..d5e1303442 100644 --- a/windows/client-management/mdm/vpn-ddf-file.md +++ b/windows/client-management/mdm/vpn-ddf-file.md @@ -1,15 +1,12 @@ --- title: VPN DDF file description: VPN DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 728FCD9C-0B8E-413B-B54A-CD72C9F2B9EE -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # VPN DDF file diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md index 5aaa8632b7..5b48d34a09 100644 --- a/windows/client-management/mdm/vpnv2-csp.md +++ b/windows/client-management/mdm/vpnv2-csp.md @@ -1,15 +1,12 @@ --- title: VPNv2 CSP description: VPNv2 CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 51ADA62E-1EE5-4F15-B2AD-52867F5B2AD2 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # VPNv2 CSP diff --git a/windows/client-management/mdm/vpnv2-ddf-file.md b/windows/client-management/mdm/vpnv2-ddf-file.md index 88ce8c7589..b91f59555f 100644 --- a/windows/client-management/mdm/vpnv2-ddf-file.md +++ b/windows/client-management/mdm/vpnv2-ddf-file.md @@ -1,15 +1,12 @@ --- title: VPNv2 DDF file description: This topic shows the OMA DM device description framework (DDF) for the VPNv2 configuration service provider. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 4E2F36B7-D2EE-4F48-AD1A-6BDE7E72CC94 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # VPNv2 DDF file diff --git a/windows/client-management/mdm/vpnv2-profile-xsd.md b/windows/client-management/mdm/vpnv2-profile-xsd.md index 96e6d32e57..8099da7143 100644 --- a/windows/client-management/mdm/vpnv2-profile-xsd.md +++ b/windows/client-management/mdm/vpnv2-profile-xsd.md @@ -1,15 +1,12 @@ --- title: ProfileXML XSD description: Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some profile examples. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 2F32E14B-F9B9-4760-AE94-E57F1D4DFDB3 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # ProfileXML XSD diff --git a/windows/client-management/mdm/w4-application-csp.md b/windows/client-management/mdm/w4-application-csp.md index 82856c77c2..1559b6350d 100644 --- a/windows/client-management/mdm/w4-application-csp.md +++ b/windows/client-management/mdm/w4-application-csp.md @@ -1,15 +1,12 @@ --- title: w4 APPLICATION CSP description: w4 APPLICATION CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: ef42b82a-1f04-49e4-8a48-bd4e439fc43a -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # w4 APPLICATION CSP diff --git a/windows/client-management/mdm/w7-application-csp.md b/windows/client-management/mdm/w7-application-csp.md index 71bb224ad9..cc931c7f9a 100644 --- a/windows/client-management/mdm/w7-application-csp.md +++ b/windows/client-management/mdm/w7-application-csp.md @@ -1,15 +1,12 @@ --- title: w7 APPLICATION CSP description: w7 APPLICATION CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 10f8aa16-5c89-455d-adcd-d7fb45d4e768 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # w7 APPLICATION CSP diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index a93b8c9e3f..d1ed9593eb 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -1,15 +1,12 @@ --- title: WiFi CSP description: WiFi CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: f927cb5f-9555-4029-838b-03fb68937f06 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # WiFi CSP diff --git a/windows/client-management/mdm/wifi-ddf-file.md b/windows/client-management/mdm/wifi-ddf-file.md index c8ca454737..4443fab25f 100644 --- a/windows/client-management/mdm/wifi-ddf-file.md +++ b/windows/client-management/mdm/wifi-ddf-file.md @@ -1,15 +1,12 @@ --- title: WiFi DDF file description: WiFi DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 00DE1DA7-23DE-4871-B3F0-28EB29A62D61 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # WiFi DDF file diff --git a/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md b/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md index 4fdd9516e1..17d48bf9fe 100644 --- a/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md +++ b/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md @@ -1,11 +1,11 @@ --- title: Win32 and Desktop Bridge app policy configuration description: Starting in Windows 10, version 1703, you can import ADMX files and set those ADMX-backed policies for Win32 and Desktop Bridge apps. -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Win32 and Desktop Bridge app policy configuration diff --git a/windows/client-management/mdm/win32appinventory-csp.md b/windows/client-management/mdm/win32appinventory-csp.md index 67ef056dbe..935df946c0 100644 --- a/windows/client-management/mdm/win32appinventory-csp.md +++ b/windows/client-management/mdm/win32appinventory-csp.md @@ -1,15 +1,12 @@ --- title: Win32AppInventory CSP description: Win32AppInventory CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: C0DEDD51-4EAD-4F8E-AEE2-CBE9658BCA22 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Win32AppInventory CSP diff --git a/windows/client-management/mdm/win32appinventory-ddf-file.md b/windows/client-management/mdm/win32appinventory-ddf-file.md index 893b52b222..97eafeb66c 100644 --- a/windows/client-management/mdm/win32appinventory-ddf-file.md +++ b/windows/client-management/mdm/win32appinventory-ddf-file.md @@ -1,15 +1,12 @@ --- title: Win32AppInventory DDF file description: Win32AppInventory DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: F6BCC10B-BFE4-40AB-AEEE-34679A4E15B0 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Win32AppInventory DDF file diff --git a/windows/client-management/mdm/windows-mdm-enterprise-settings.md b/windows/client-management/mdm/windows-mdm-enterprise-settings.md index f50b20ad5e..51943be64f 100644 --- a/windows/client-management/mdm/windows-mdm-enterprise-settings.md +++ b/windows/client-management/mdm/windows-mdm-enterprise-settings.md @@ -4,15 +4,12 @@ description: The actual management interaction between the device and server is MS-HAID: - 'p\_phdevicemgmt.enterprise\_settings\_\_policies\_\_and\_app\_management' - 'p\_phDeviceMgmt.windows\_mdm\_enterprise\_settings' -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 92711D65-3022-4789-924B-602BE3187E23 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # Enterprise settings, policies, and app management diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md index ba5104057e..bced249094 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md @@ -1,15 +1,12 @@ --- title: WindowsAdvancedThreatProtection CSP description: WindowsAdvancedThreatProtection CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 6C3054CA-9890-4C08-9DB6-FBEEB74699A8 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # WindowsAdvancedThreatProtection CSP diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md index 06cf87d740..135648a616 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md @@ -1,15 +1,12 @@ --- title: WindowsAdvancedThreatProtection DDF file description: WindowsAdvancedThreatProtection DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 0C62A790-4351-48AF-89FD-7D46C42D13E0 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # WindowsAdvancedThreatProtection DDF file diff --git a/windows/client-management/mdm/windowslicensing-csp.md b/windows/client-management/mdm/windowslicensing-csp.md index edff8cdb64..bdc1b02533 100644 --- a/windows/client-management/mdm/windowslicensing-csp.md +++ b/windows/client-management/mdm/windowslicensing-csp.md @@ -1,15 +1,12 @@ --- title: WindowsLicensing CSP description: WindowsLicensing CSP -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: E6BC6B0D-1F16-48A5-9AC4-76D69A7EDDA6 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # WindowsLicensing CSP diff --git a/windows/client-management/mdm/windowslicensing-ddf-file.md b/windows/client-management/mdm/windowslicensing-ddf-file.md index 68cec1698d..5ac78fc98d 100644 --- a/windows/client-management/mdm/windowslicensing-ddf-file.md +++ b/windows/client-management/mdm/windowslicensing-ddf-file.md @@ -1,15 +1,12 @@ --- title: WindowsLicensing DDF file description: WindowsLicensing DDF file -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 2A24C922-A167-4CEE-8F74-08E7453800D2 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # WindowsLicensing DDF file diff --git a/windows/client-management/mdm/windowssecurityauditing-csp.md b/windows/client-management/mdm/windowssecurityauditing-csp.md index 231a3c0329..686a058d93 100644 --- a/windows/client-management/mdm/windowssecurityauditing-csp.md +++ b/windows/client-management/mdm/windowssecurityauditing-csp.md @@ -1,15 +1,12 @@ --- title: WindowsSecurityAuditing CSP description: The WindowsSecurityAuditing configuration service provider (CSP) is used to enable logging of security audit events. This CSP was added in Windows 10, version 1511. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 611DF7FF-21CE-476C-AAB5-3D09C1CDF08A -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # WindowsSecurityAuditing CSP diff --git a/windows/client-management/mdm/windowssecurityauditing-ddf-file.md b/windows/client-management/mdm/windowssecurityauditing-ddf-file.md index ec06383f5d..cd9ef72d61 100644 --- a/windows/client-management/mdm/windowssecurityauditing-ddf-file.md +++ b/windows/client-management/mdm/windowssecurityauditing-ddf-file.md @@ -1,15 +1,12 @@ --- title: WindowsSecurityAuditing DDF file description: This topic shows the OMA DM device description framework (DDF) for the WindowsSecurityAuditing configuration service provider. This CSP was added in Windows 10, version 1511. -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: B1F9A5FA-185B-48C6-A7F4-0F0F23B971F0 -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # WindowsSecurityAuditing DDF file diff --git a/windows/client-management/mdm/wmi-providers-supported-in-windows.md b/windows/client-management/mdm/wmi-providers-supported-in-windows.md index 45bb1e69fe..ade8ecd858 100644 --- a/windows/client-management/mdm/wmi-providers-supported-in-windows.md +++ b/windows/client-management/mdm/wmi-providers-supported-in-windows.md @@ -4,15 +4,12 @@ description: WMI providers supported in Windows 10 MS-HAID: - 'p\_phdevicemgmt.wmi\_providers\_supported\_in\_windows\_10\_technical\_preview' - 'p\_phDeviceMgmt.wmi\_providers\_supported\_in\_windows' -MSHAttr: -- 'PreferredSiteName:MSDN' -- 'PreferredLib:/library/windows/hardware' ms.assetid: 7D533044-AAD7-4B8F-B71B-9D52C15A168A -ms.author: windows-hardware-design-content -ms.date: 05/02/2017 +ms.author: maricia ms.topic: article -ms.prod: windows-hardware -ms.technology: windows-oem +ms.prod: w10 +ms.technology: windows +author: nickbrower --- # WMI providers supported in Windows 10 diff --git a/windows/configuration/docfx.json b/windows/configuration/docfx.json index 07ca5a5dc2..9e4397cd87 100644 --- a/windows/configuration/docfx.json +++ b/windows/configuration/docfx.json @@ -32,7 +32,8 @@ "externalReference": [], "globalMetadata": { "uhfHeaderId": "MSDocsHeader-WindowsIT", - "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json" + "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "ms.technology": "windows" }, "fileMetadata": {}, "template": [], diff --git a/windows/configuration/mobile-devices/mobile-lockdown-designer.md b/windows/configuration/mobile-devices/mobile-lockdown-designer.md index 33a512ae37..4c7a24ae08 100644 --- a/windows/configuration/mobile-devices/mobile-lockdown-designer.md +++ b/windows/configuration/mobile-devices/mobile-lockdown-designer.md @@ -15,7 +15,7 @@ author: jdeckerms Windows 10 Mobile allows enterprises to lock down a device, define multiple user roles, and configure custom layouts on a device. For example, the enterprise can lock down a device so that only applications and settings in an allow list are available. This is accomplished using Lockdown XML, an XML file that contains settings for Windows 10 Mobile. -When you deploy the lockdown XML file to a device, it is saved on the device as **wehlockdown.xml**. When the device boots, it looks for wehlockdown.xml and applies any settings configured in the file. +When you deploy the lockdown XML file to a device, it is saved on the device as **wehlockdown.xml**. When the device boots, it looks for wehlockdown.xml and applies any settings configured in the file. You can deploy the lockdown XML file by [adding it to a provisioning package](lockdown-xml.md#add-lockdown-xml-to-a-provisioning-package) or [by using mobile device management (MDM)](lockdown-xml.md#push-lockdown-xml-using-mdm). The Lockdown Designer app helps you configure and create a lockdown XML file that you can apply to devices running Windows 10 Mobile, version 1703, and includes a remote simulation to help you determine the layout for tiles on the Start screen. Lockdown Designer also validates the XML. Using Lockdown Designer is easier than [manually creating a lockdown XML file](lockdown-xml.md). diff --git a/windows/configuration/windows-10-start-layout-options-and-policies.md b/windows/configuration/windows-10-start-layout-options-and-policies.md index 1f432594f7..5fc6d0a993 100644 --- a/windows/configuration/windows-10-start-layout-options-and-policies.md +++ b/windows/configuration/windows-10-start-layout-options-and-policies.md @@ -64,7 +64,7 @@ There are three categories of apps that might be pinned to a taskbar: * Apps pinned by the enterprise, such as in an unattended Windows setup >[!NOTE] - >The earlier method of using [TaskbarLinks](https://go.microsoft.com/fwlink/p/?LinkId=761230) in an unattended Windows setup file is deprecated in Windows 10, version 1607. + >We recommend using [the layoutmodification.xml method](configure-windows-10-taskbar.md) to configure taskbar options, rather than the earlier method of using [TaskbarLinks](https://go.microsoft.com/fwlink/p/?LinkId=761230) in an unattended Windows setup file. The following example shows how apps will be pinned - Windows default apps to the left (blue circle), apps pinned by the user in the center (orange triangle), and apps that you pin using XML to the right (green square). @@ -97,7 +97,7 @@ The new taskbar layout for upgrades to Windows 10, version 1607 or later, will a * If the user didn't pin the app and the app is in the updated layout file, the app will be pinned to the right. * New apps specified in updated layout file are pinned to right of user's pinned apps. -[Learn how to onfigure Windows 10 taskbar](configure-windows-10-taskbar.md). +[Learn how to configure Windows 10 taskbar](configure-windows-10-taskbar.md). ## Related topics diff --git a/windows/deployment/docfx.json b/windows/deployment/docfx.json index 652028bf85..3c58607382 100644 --- a/windows/deployment/docfx.json +++ b/windows/deployment/docfx.json @@ -32,7 +32,8 @@ "externalReference": [], "globalMetadata": { "uhfHeaderId": "MSDocsHeader-WindowsIT", - "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json" + "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "ms.technology": "windows" }, "fileMetadata": {}, "template": [], diff --git a/windows/deployment/index.md b/windows/deployment/index.md index b24224172e..95945c8749 100644 --- a/windows/deployment/index.md +++ b/windows/deployment/index.md @@ -9,15 +9,6 @@ localizationpriority: high author: greg-lindsay --- - -
 |
- A wide-spread ransomware attack, known as "WannaCrypt," targets Windows systems that do not yet have the latest updates. Given the severity of this threat, immediately update your Windows systems. [Learn more](https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/). | -
 |
- A wide-spread ransomware attack, known as "WannaCrypt," targets Windows systems that do not yet have the latest updates. Given the severity of this threat, immediately update your Windows systems. [Learn more](https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/). | -
| Service | Endpoint - |
| Connected User Experience and Telemetry component | v10.vortex-win.data.microsoft.com
- settings-win.data.microsoft.com - |
| Windows Error Reporting | watson.telemetry.microsoft.com - |
| Online Crash Analysis | oca.telemetry.microsoft.com - |
| Service | Endpoint + |
| Connected User Experience and Telemetry component | v10.vortex-win.data.microsoft.com
+ settings-win.data.microsoft.com + |
| Windows Error Reporting | watson.telemetry.microsoft.com + |
| Online Crash Analysis | oca.telemetry.microsoft.com + |
