deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 13:27:23 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

ADMX_LanmanWorkstation policy review

Browse Source
This commit is contained in:
Nick White 2023-01-03 15:47:49 -05:00
parent 1396181688
commit ce00286aaf
1 changed files with 166 additions and 145 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

311
windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md
View File

@ -1,218 +1,239 @@
--- ---
title: Policy CSP - ADMX_LanmanWorkstation title: ADMX_LanmanWorkstation Policy CSP
description: Learn about the Policy CSP - ADMX_LanmanWorkstation. description: Learn more about the ADMX_LanmanWorkstation Area in Policy CSP
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa ms.author: vinpa
ms.date: 01/03/2023
ms.localizationpriority: medium ms.localizationpriority: medium
ms.topic: article
ms.prod: windows-client ms.prod: windows-client
ms.technology: itpro-manage ms.technology: itpro-manage
author: vinaypamnani-msft ms.topic: reference
ms.date: 12/08/2020
ms.reviewer:
manager: aaroncz
--- ---
<!-- Auto-Generated CSP Document -->
<!-- ADMX_LanmanWorkstation-Begin -->
# Policy CSP - ADMX_LanmanWorkstation # Policy CSP - ADMX_LanmanWorkstation
>[!TIP] > [!TIP]
> These are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](../understanding-admx-backed-policies.md). > Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
> >
> You must specify the data type in the SyncML as &lt;Format&gt;chr&lt;/Format&gt;. For an example SyncML, refer to [Enabling a policy](../understanding-admx-backed-policies.md#enabling-a-policy). > You must specify the data type in the SyncML as &lt;Format&gt;chr&lt;/Format&gt;. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
> >
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<hr/> <!-- ADMX_LanmanWorkstation-Editable-Begin -->
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
<!-- ADMX_LanmanWorkstation-Editable-End -->
<!--Policies--> <!-- Pol_CipherSuiteOrder-Begin -->
## ADMX_LanmanWorkstation policies ## Pol_CipherSuiteOrder
<dl> <!-- Pol_CipherSuiteOrder-Applicability-Begin -->
<dd> | Scope | Editions | Applicable OS |
<a href="#admx-lanmanworkstation-pol-ciphersuiteorder">ADMX_LanmanWorkstation/Pol_CipherSuiteOrder</a> |:--|:--|:--|
</dd> | :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later <br> :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later <br> :heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
<dd> <!-- Pol_CipherSuiteOrder-Applicability-End -->
<a href="#admx-lanmanworkstation-pol-enablehandlecachingforcafiles">ADMX_LanmanWorkstation/Pol_EnableHandleCachingForCAFiles</a>
</dd>
<dd>
<a href="#admx-lanmanworkstation-pol-enableofflinefilesforcashares">ADMX_LanmanWorkstation/Pol_EnableOfflineFilesforCAShares</a>
</dd>
</dl>
<!-- Pol_CipherSuiteOrder-OmaUri-Begin -->
```Device
./Device/Vendor/MSFT/Policy/Config/ADMX_LanmanWorkstation/Pol_CipherSuiteOrder
```
<!-- Pol_CipherSuiteOrder-OmaUri-End -->
<hr/> <!-- Pol_CipherSuiteOrder-Description-Begin -->
<!-- Description-Source-ADMX -->
<!--Policy-->
<a href="" id="admx-lanmanworkstation-pol-ciphersuiteorder"></a>**ADMX_LanmanWorkstation/Pol_CipherSuiteOrder**
<!--SupportedSKUs-->
|Edition|Windows 10|Windows 11|
|--- |--- |--- |
|Home|No|No|
|Pro|Yes|Yes|
|Windows SE|No|Yes|
|Business|Yes|Yes|
|Enterprise|Yes|Yes|
|Education|Yes|Yes|
<!--/SupportedSKUs-->
<hr/>
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
> * Device
<hr/>
<!--/Scope-->
<!--Description-->
This policy setting determines the cipher suites used by the SMB client. This policy setting determines the cipher suites used by the SMB client.
If you enable this policy setting, cipher suites are prioritized in the order specified. If you enable this policy setting, cipher suites are prioritized in the order specified.
If you enable this policy setting and don't specify at least one supported cipher suite, or if you disable or don't configure this policy setting, the default cipher suite order is used. If you enable this policy setting and do not specify at least one supported cipher suite, or if you disable or do not configure this policy setting, the default cipher suite order is used.
SMB 3.11 cipher suites: SMB 3.11 cipher suites:
- AES_128_GCM AES_128_GCM
- AES_128_CCM AES_128_CCM
- AES_256_GCM AES_256_GCM
- AES_256_CCM AES_256_CCM
> [!NOTE]
> AES_256 is not supported on Windows 10 version 20H2 and lower. If you enter only AES_256 crypto lines, the older clients will not be able to connect anymore.
SMB 3.0 and 3.02 cipher suites: SMB 3.0 and 3.02 cipher suites:
- AES_128_CCM AES_128_CCM
How to modify this setting: How to modify this setting:
Arrange the desired cipher suites in the edit box, one cipher suite per line, in order from most to least preferred, with the most preferred cipher suite at the top. Remove any cipher suites you don't want to use. Arrange the desired cipher suites in the edit box, one cipher suite per line, in order from most to least preferred, with the most preferred cipher suite at the top. Remove any cipher suites you don't want to use.
> [!NOTE] Note: When configuring this security setting, changes will not take effect until you restart Windows.
> When configuring this security setting, changes will not take effect until you restart Windows. <!-- Pol_CipherSuiteOrder-Description-End -->
<!--/Description--> <!-- Pol_CipherSuiteOrder-Editable-Begin -->
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->[!NOTE]
AES_256 is not supported on Windows 10 version 20H2 and lower. If you enter only AES_256 crypto lines, the older clients will not be able to connect anymore.
<!-- Pol_CipherSuiteOrder-Editable-End -->
<!-- Pol_CipherSuiteOrder-DFProperties-Begin -->
**Description framework properties**:
<!--ADMXBacked--> | Property name | Property value |
ADMX Info: |:--|:--|
- GP Friendly name: *Cipher suite order* | Format | chr (string) |
- GP name: *Pol_CipherSuiteOrder* | Access Type | Add, Delete, Get, Replace |
- GP path: *Network\Lanman Workstation* <!-- Pol_CipherSuiteOrder-DFProperties-End -->
- GP ADMX file name: *LanmanWorkstation.admx*
<!--/ADMXBacked--> <!-- Pol_CipherSuiteOrder-AdmxBacked-Begin -->
<!--/Policy--> > [!TIP]
<hr/> > This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
<!--Policy--> **ADMX mapping**:
<a href="" id="admx-lanmanworkstation-pol-enablehandlecachingforcafiles"></a>**ADMX_LanmanWorkstation/Pol_EnableHandleCachingForCAFiles**
<!--SupportedSKUs--> | Name | Value |
|:--|:--|
| Name | Pol_CipherSuiteOrder_Name |
| Friendly Name | Cipher suite order |
| Location | Computer Configuration |
| Path | Network > Lanman Workstation |
| Registry Key Name | Software\Policies\Microsoft\Windows\LanmanWorkstation |
| ADMX File Name | LanmanWorkstation.admx |
<!-- Pol_CipherSuiteOrder-AdmxBacked-End -->
|Edition|Windows 10|Windows 11| <!-- Pol_CipherSuiteOrder-Examples-Begin -->
|--- |--- |--- | <!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|Home|No|No| <!-- Pol_CipherSuiteOrder-Examples-End -->
|Pro|Yes|Yes|
|Windows SE|No|Yes|
|Business|Yes|Yes|
|Enterprise|Yes|Yes|
|Education|Yes|Yes|
<!--/SupportedSKUs--> <!-- Pol_CipherSuiteOrder-End -->
<hr/>
<!--Scope--> <!-- Pol_EnableHandleCachingForCAFiles-Begin -->
[Scope](./policy-configuration-service-provider.md#policy-scope): ## Pol_EnableHandleCachingForCAFiles
> [!div class = "checklist"] <!-- Pol_EnableHandleCachingForCAFiles-Applicability-Begin -->
> * Device | Scope | Editions | Applicable OS |
|:--|:--|:--|
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later <br> :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later <br> :heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
<!-- Pol_EnableHandleCachingForCAFiles-Applicability-End -->
<hr/> <!-- Pol_EnableHandleCachingForCAFiles-OmaUri-Begin -->
```Device
./Device/Vendor/MSFT/Policy/Config/ADMX_LanmanWorkstation/Pol_EnableHandleCachingForCAFiles
```
<!-- Pol_EnableHandleCachingForCAFiles-OmaUri-End -->
<!--/Scope--> <!-- Pol_EnableHandleCachingForCAFiles-Description-Begin -->
<!--Description--> <!-- Description-Source-ADMX -->
This policy setting determines the behavior of SMB handle caching for clients connecting to an SMB share where the Continuous Availability (CA) flag is enabled. This policy setting determines the behavior of SMB handle caching for clients connecting to an SMB share where the Continuous Availability (CA) flag is enabled.
If you enable this policy setting, the SMB client will allow cached handles to files on CA shares. This provision may lead to better performance when repeatedly accessing a large number of unstructured data files on CA shares running in Microsoft Azure Files. If you enable this policy setting, the SMB client will allow cached handles to files on CA shares. This may lead to better performance when repeatedly accessing a large number of unstructured data files on CA shares running in Microsoft Azure Files.
If you disable or don't configure this policy setting, Windows will prevent use of cached handles to files opened through CA shares. If you disable or do not configure this policy setting, Windows will prevent use of cached handles to files opened through CA shares.
> [!NOTE] Note: This policy has no effect when connecting Scale-out File Server shares provided by a Windows Server. Microsoft does not recommend enabling this policy for clients that routinely connect to files hosted on a Windows Failover Cluster with the File Server for General Use role, as it can lead to adverse failover times and increased memory and CPU usage.
> This policy has no effect when connecting Scale-out File Server shares provided by a Windows Server. Microsoft doesn't recommend enabling this policy for clients that routinely connect to files hosted on a Windows Failover Cluster with the File Server for General Use role, as it can lead to adverse failover times and increased memory and CPU usage. <!-- Pol_EnableHandleCachingForCAFiles-Description-End -->
<!--/Description--> <!-- Pol_EnableHandleCachingForCAFiles-Editable-Begin -->
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
<!-- Pol_EnableHandleCachingForCAFiles-Editable-End -->
<!-- Pol_EnableHandleCachingForCAFiles-DFProperties-Begin -->
**Description framework properties**:
<!--ADMXBacked--> | Property name | Property value |
ADMX Info: |:--|:--|
- GP Friendly name: *Handle Caching on Continuous Availability Shares* | Format | chr (string) |
- GP name: *Pol_EnableHandleCachingForCAFiles* | Access Type | Add, Delete, Get, Replace |
- GP path: *Network\Lanman Workstation* <!-- Pol_EnableHandleCachingForCAFiles-DFProperties-End -->
- GP ADMX file name: *LanmanWorkstation.admx*
<!--/ADMXBacked--> <!-- Pol_EnableHandleCachingForCAFiles-AdmxBacked-Begin -->
<!--/Policy--> > [!TIP]
<hr/> > This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
<!--Policy--> **ADMX mapping**:
<a href="" id="admx-lanmanworkstation-pol-enableofflinefilesforcashares"></a>**ADMX_LanmanWorkstation/Pol_EnableOfflineFilesforCAShares**
<!--SupportedSKUs--> | Name | Value |
|:--|:--|
| Name | Pol_EnableHandleCachingForCAFiles_Name |
| Friendly Name | Handle Caching on Continuous Availability Shares |
| Location | Computer Configuration |
| Path | Network > Lanman Workstation |
| Registry Key Name | Software\Policies\Microsoft\Windows\LanmanWorkstation |
| Registry Value Name | EnableHandleCachingForCAFiles |
| ADMX File Name | LanmanWorkstation.admx |
<!-- Pol_EnableHandleCachingForCAFiles-AdmxBacked-End -->
|Edition|Windows 10|Windows 11| <!-- Pol_EnableHandleCachingForCAFiles-Examples-Begin -->
|--- |--- |--- | <!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|Home|No|No| <!-- Pol_EnableHandleCachingForCAFiles-Examples-End -->
|Pro|Yes|Yes|
|Windows SE|No|Yes|
|Business|Yes|Yes|
|Enterprise|Yes|Yes|
|Education|Yes|Yes|
<!--/SupportedSKUs--> <!-- Pol_EnableHandleCachingForCAFiles-End -->
<hr/>
<!--Scope--> <!-- Pol_EnableOfflineFilesforCAShares-Begin -->
[Scope](./policy-configuration-service-provider.md#policy-scope): ## Pol_EnableOfflineFilesforCAShares
> [!div class = "checklist"] <!-- Pol_EnableOfflineFilesforCAShares-Applicability-Begin -->
> * Device | Scope | Editions | Applicable OS |
|:--|:--|:--|
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later <br> :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later <br> :heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
<!-- Pol_EnableOfflineFilesforCAShares-Applicability-End -->
<hr/> <!-- Pol_EnableOfflineFilesforCAShares-OmaUri-Begin -->
```Device
./Device/Vendor/MSFT/Policy/Config/ADMX_LanmanWorkstation/Pol_EnableOfflineFilesforCAShares
```
<!-- Pol_EnableOfflineFilesforCAShares-OmaUri-End -->
<!--/Scope--> <!-- Pol_EnableOfflineFilesforCAShares-Description-Begin -->
<!--Description--> <!-- Description-Source-ADMX -->
This policy setting determines the behavior of Offline Files on clients connecting to an SMB share where the Continuous Availability (CA) flag is enabled. This policy setting determines the behavior of Offline Files on clients connecting to an SMB share where the Continuous Availability (CA) flag is enabled.
If you enable this policy setting, the "Always Available offline" option will appear in the File Explorer menu on a Windows computer when connecting to a CA-enabled share. Pinning of files on CA-enabled shares using client-side caching will also be possible. If you enable this policy setting, the "Always Available offline" option will appear in the File Explorer menu on a Windows computer when connecting to a CA-enabled share. Pinning of files on CA-enabled shares using client-side caching will also be possible.
If you disable or don't configure this policy setting, Windows will prevent use of Offline Files with CA-enabled shares. If you disable or do not configure this policy setting, Windows will prevent use of Offline Files with CA-enabled shares.
> [!NOTE] Note: Microsoft does not recommend enabling this group policy. Use of CA with Offline Files will lead to very long transition times between the online and offline states.
> Microsoft doesn't recommend enabling this group policy. Use of CA with Offline Files will lead to very long transition times between the online and offline states. <!-- Pol_EnableOfflineFilesforCAShares-Description-End -->
<!--/Description--> <!-- Pol_EnableOfflineFilesforCAShares-Editable-Begin -->
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
<!-- Pol_EnableOfflineFilesforCAShares-Editable-End -->
<!-- Pol_EnableOfflineFilesforCAShares-DFProperties-Begin -->
**Description framework properties**:
<!--ADMXBacked--> | Property name | Property value |
ADMX Info: |:--|:--|
- GP Friendly name: *Offline Files Availability on Continuous Availability Shares* | Format | chr (string) |
- GP name: *Pol_EnableOfflineFilesforCAShares* | Access Type | Add, Delete, Get, Replace |
- GP path: *Network\Lanman Workstation* <!-- Pol_EnableOfflineFilesforCAShares-DFProperties-End -->
- GP ADMX file name: *LanmanWorkstation.admx*
<!--/ADMXBacked--> <!-- Pol_EnableOfflineFilesforCAShares-AdmxBacked-Begin -->
<!--/Policy--> > [!TIP]
<hr/> > This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
**ADMX mapping**:
| Name | Value |
|:--|:--|
| Name | Pol_EnableCSCforCAShares_Name |
| Friendly Name | Offline Files Availability on Continuous Availability Shares |
| Location | Computer Configuration |
| Path | Network > Lanman Workstation |
| Registry Key Name | Software\Policies\Microsoft\Windows\LanmanWorkstation |
| Registry Value Name | AllowOfflineFilesforCAShares |
| ADMX File Name | LanmanWorkstation.admx |
<!-- Pol_EnableOfflineFilesforCAShares-AdmxBacked-End -->
<!--/Policies--> <!-- Pol_EnableOfflineFilesforCAShares-Examples-Begin -->
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
<!-- Pol_EnableOfflineFilesforCAShares-Examples-End -->
## Related topics <!-- Pol_EnableOfflineFilesforCAShares-End -->
[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md) <!-- ADMX_LanmanWorkstation-CspMoreInfo-Begin -->
<!-- Add any additional information about this CSP here. Anything outside this section will get overwritten. -->
<!-- ADMX_LanmanWorkstation-CspMoreInfo-End -->
<!-- ADMX_LanmanWorkstation-End -->
## Related articles
[Policy configuration service provider](policy-configuration-service-provider.md)