deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 13:27:23 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merged PR 5462: Merge nibr-fixTokens to master

Browse Source 
manually tokenizing a handful of policy attributes
This commit is contained in:
Nicholas Brower 2018-01-24 19:04:38 +00:00
parent b11a38deca
commit d247d27171
8 changed files with 137 additions and 65 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
windows/client-management/mdm/policy-csp-cellular.md
View File

@ -87,13 +87,15 @@ If you disable or do not configure this policy setting, employees in your organi
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.”
Suported values:
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 - User is in control
- 1 - Force Allow
- 2 - Force Deny
<!--EndDescription-->
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->

21
windows/client-management/mdm/policy-csp-connectivity.md
View File

@ -105,8 +105,6 @@ ms.date: 12/14/2017
> [!NOTE]
>  This value is not supported in Windows Phone 8.1 MDM and EAS, Windows 10 for desktop, or Windows 10 Mobile.
- 2 (default) – Allow Bluetooth. If this is set to 2, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on.
<p style="margin-left: 20px">If this is not set or it is deleted, the default value of 2 (Allow) is used.
<p style="margin-left: 20px">Most restricted value is 0.
@ -117,6 +115,7 @@ The following list shows the supported values:
- 0 – Disallow Bluetooth. If this is set to 0, the radio in the Bluetooth control panel will be greyed out and the user will not be able to turn Bluetooth on.
- 1 – Reserved. If this is set to 1, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on.
- 2 (default) – Allow Bluetooth. If this is set to 2, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on.
<!--/SupportedValues-->
<!--EndPolicy-->
@ -159,13 +158,15 @@ The following list shows the supported values:
<!--StartDescription-->
<p style="margin-left: 20px">Allows the cellular data channel on the device. Device reboot is not required to enforce the policy.
<p style="margin-left: 20px">The following list shows the supported values:
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 – Do not allow the cellular data channel. The user cannot turn it on. This value is not supported in Windows 10, version 1511.
- 1 (default) – Allow the cellular data channel. The user can turn it off.
- 2 - Allow the cellular data channel. The user cannot turn it off.
<!--EndDescription-->
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
@ -206,14 +207,18 @@ The following list shows the supported values:
<!--StartDescription-->
<p style="margin-left: 20px">Allows or disallows cellular data roaming on the device. Device reboot is not required to enforce the policy.
<p style="margin-left: 20px">The following list shows the supported values:
<p style="margin-left: 20px">Most restricted value is 0.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 – Do not allow cellular data roaming. The user cannot turn it on. This value is not supported in Windows 10, version 1511.
- 1 (default) – Allow cellular data roaming.
- 2 - Allow cellular data roaming on. The user cannot turn it off.
<p style="margin-left: 20px">Most restricted value is 0.
<!--/SupportedValues-->
<!--Validation-->
<p style="margin-left: 20px">To validate, the enterprise can confirm by observing the roaming enable switch in the UX. It will be inactive if the roaming policy is being enforced by the enterprise policy.
<p style="margin-left: 20px">To validate on mobile devices, do the following:
@ -222,7 +227,7 @@ The following list shows the supported values:
2. Click on the SIM (next to the signal strength icon) and select **Properties**.
3. On the Properties page, select **Data roaming options**.
<!--EndDescription-->
<!--/Validation-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->

24
windows/client-management/mdm/policy-csp-defender.md
View File

@ -969,16 +969,18 @@ ms.date: 11/01/2017
<p style="margin-left: 20px">For more information about specific values that are supported, see the Windows Defender Antivirus documentation site.
     
> [!Note]
> This feature requires the "Join Microsoft MAPS" setting enabled in order to function.
<p style="margin-left: 20px">Possible options are:
- (0x0) Default windows defender blocking level
- (0x2) High blocking level - aggressively block unknowns while optimizing client performance (greater chance of false positives)      
- (0x4) High+ blocking level – aggressively block unknowns and apply additional protection measures (may impact  client performance)
- (0x6) Zero tolerance blocking level – block all unknown executables
> This feature requires the "Join Microsoft MAPS" setting enabled in order to function.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0x0 - Default windows defender blocking level
- 0x2 - High blocking level - aggressively block unknowns while optimizing client performance (greater chance of false positives)      
- 0x4 - High+ blocking level – aggressively block unknowns and apply additional protection measures (may impact  client performance)
- 0x6 - Zero tolerance blocking level – block all unknown executables
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
@ -1210,11 +1212,15 @@ ms.date: 11/01/2017
<p style="margin-left: 20px">Added in Windows 10, version 1709. This policy enables setting the state (On/Off/Audit) for the guard my folders feature. The guard my folders feature removes modify and delete permissions from untrusted applications to certain folders such as My Documents. Value type is integer and the range is 0 - 2.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 (default) - Disabled
- 1 - Enabled
- 2 - Audit Mode
<!--EndDescription-->
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->

11
windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
View File

@ -3338,13 +3338,16 @@ User Account Control: Virtualize file and registry write failures to per-user lo
This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and write run-time application data to %ProgramFiles%, %Windir%, %Windir%\system32, or HKLM\Software.
The options are:
- 0 - Disabled: Applications that write data to protected locations fail.
- 1 - Enabled: (Default) Application write failures are redirected at run time to defined user locations for both the file system and registry.
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 - Disabled: Applications that write data to protected locations fail.
- 1 - Enabled: (Default) Application write failures are redirected at run time to defined user locations for both the file system and registry.
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>

8
windows/client-management/mdm/policy-csp-networkisolation.md
View File

@ -123,7 +123,11 @@ ms.date: 11/01/2017
<!--EndScope-->
<!--StartDescription-->
<p style="margin-left: 20px">Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of IPv4 and IPv6 ranges. For example:
<p style="margin-left: 20px">Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of IPv4 and IPv6 ranges.
<!--EndDescription-->
<!--Example-->
For example:
``` syntax
10.0.0.0-10.255.255.255,157.54.0.0-157.54.255.255,
@ -134,7 +138,7 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
```
<!--EndDescription-->
<!--/Example-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->

10
windows/client-management/mdm/policy-csp-system.md
View File

@ -269,10 +269,6 @@ The following list shows the supported values:
> [!Note]
> Reboot is required after setting the policy; alternatively you can stop and restart the FontCache service.
<p style="margin-left: 20px">To verify if System/AllowFontProviders is set to true:
- After a client machine is rebooted, check whether there is any network traffic from client machine to fs.microsoft.com.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
@ -281,6 +277,12 @@ The following list shows the supported values:
- 1 - true (default) - There may be network traffic to fs.microsoft.com and downloadable fonts are available to apps that support them.
<!--/SupportedValues-->
<!--Validation-->
<p style="margin-left: 20px">To verify if System/AllowFontProviders is set to true:
- After a client machine is rebooted, check whether there is any network traffic from client machine to fs.microsoft.com.
<!--/Validation-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->

41
windows/client-management/mdm/policy-csp-update.md
View File

@ -403,16 +403,20 @@ ms.date: 12/19/2017
<!--EndScope-->
<!--StartDescription-->
<p style="margin-left: 20px">Added in Windows 10, version 1709. Option to download updates automatically over metered connections (off by default). Value type is integer.
- 0 (default) - Not allowed
- 1 - Allowed
<p style="margin-left: 20px">Added in Windows 10, version 1709. Option to download updates automatically over metered connections (off by default). Value type is integer.
A significant number of devices primarily use cellular data and do not have Wi-Fi access, which leads to a lower number of devices getting updates. Since a large number of devices have large data plans or unlimited data, this policy can unblock devices from getting updates.
This policy is accessible through the Update setting in the user interface or Group Policy.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 (default) - Not allowed
- 1 - Allowed
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
@ -1152,14 +1156,18 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
<p style="margin-left: 20px">For more information about dual scan, see [Demystifying "Dual Scan"](https://blogs.technet.microsoft.com/wsus/2017/05/05/demystifying-dual-scan/) and [Improving Dual Scan on 1607](https://blogs.technet.microsoft.com/wsus/2017/08/04/improving-dual-scan-on-1607/).
- 0 - allow scan against Windows Update
- 1 - do not allow update deferral policies to cause scans against Windows Update
<p style="margin-left: 20px">This is the same as the Group Policy in Windows Components > Window Update "Do not allow update deferral policies to cause scans against Windows Update."
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace, and Delete.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 - allow scan against Windows Update
- 1 - do not allow update deferral policies to cause scans against Windows Update
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
@ -1436,8 +1444,16 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
> [!WARNING]
> Setting this policy might cause devices to incur costs from MO operators.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
<p style="margin-left: 20px">To validate this policy:
- 0 (default) – Do not ignore MO download limit for apps and their updates.
- 1 – Ignore MO download limit (allow unlimited downloading) for apps and their updates.
<!--/SupportedValues-->
<!--Validation-->
To validate this policy:
1. Enable the policy ensure the device is on a cellular network.
2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell:
@ -1447,14 +1463,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
3. Verify that any downloads that are above the download size limit will complete without being paused.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 (default) – Do not ignore MO download limit for apps and their updates.
- 1 – Ignore MO download limit (allow unlimited downloading) for apps and their updates.
<!--/SupportedValues-->
<!--/Validation-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->

81
windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
View File

@ -217,12 +217,17 @@ Valid values:
<!--StartDescription-->
<p style="margin-left: 20px">Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the app and browser protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 - (Disable) The users can see the display of the app and browser protection area in Windows Defender Security Center.
- 1 - (Enable) The users cannot see the display of the app and browser protection area in Windows Defender Security Center.
<!--EndDescription-->
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
@ -321,12 +326,16 @@ Valid values:
> [!Note]
> If Suppress notification is enabled then users will not see critical or non-critical messages.
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 - (Disable) Windows Defender Security Center will display critical and non-critical notifications to users..
- 1 - (Enable) Windows Defender Security Center only display notifications which are considered critical on clients.
<!--EndDescription-->
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
@ -367,12 +376,16 @@ Valid values:
<!--StartDescription-->
<p style="margin-left: 20px">Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the family options area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 - (Disable) The users can see the display of the family options area in Windows Defender Security Center.
- 1 - (Enable) The users cannot see the display of the family options area in Windows Defender Security Center.
<!--EndDescription-->
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
@ -413,12 +426,16 @@ Valid values:
<!--StartDescription-->
<p style="margin-left: 20px">Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the device performance and health area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 - (Disable) The users can see the display of the device performance and health area in Windows Defender Security Center.
- 1 - (Enable) The users cannot see the display of the device performance and health area in Windows Defender Security Center.
<!--EndDescription-->
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
@ -459,12 +476,16 @@ Valid values:
<!--StartDescription-->
<p style="margin-left: 20px">Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the firewall and network protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 - (Disable) The users can see the display of the firewall and network protection area in Windows Defender Security Center.
- 1 - (Enable) The users cannot see the display of the firewall and network protection area in Windows Defender Security Center.
<!--EndDescription-->
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
@ -505,12 +526,16 @@ Valid values:
<!--StartDescription-->
<p style="margin-left: 20px">Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of Windows Defender Security Center notifications. If you disable or do not configure this setting, Windows Defender Security Center notifications will display on devices.
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 - (Disable) The users can see the display of Windows Defender Security Center notifications.
- 1 - (Enable) The users cannot see the display of Windows Defender Security Center notifications.
<!--EndDescription-->
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
@ -551,12 +576,16 @@ Valid values:
<!--StartDescription-->
<p style="margin-left: 20px">Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the virus and threat protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 - (Disable) The users can see the display of the virus and threat protection area in Windows Defender Security Center.
- 1 - (Enable) The users cannot see the display of the virus and threat protection area in Windows Defender Security Center.
<!--EndDescription-->
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
@ -597,12 +626,16 @@ Valid values:
<!--StartDescription-->
<p style="margin-left: 20px">Added in Windows 10, version 1709. Prevent users from making changes to the exploit protection settings area in the Windows Defender Security Center. If you disable or do not configure this setting, local users can make changes in the exploit protection settings area.
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete.Valid values:
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 - (Disable) Local users are allowed to make changes in the exploit protection settings area.
- 1 - (Enable) Local users cannot make changes in the exploit protection settings area.
<!--EndDescription-->
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
@ -686,12 +719,16 @@ Valid values:
<!--StartDescription-->
<p style="margin-left: 20px">Added in Windows 10, version 1709. Enable this policy to display your company name and contact options in the notifications. If you disable or do not configure this setting, or do not provide CompanyName and a minimum of one contact method (Phone using Skype, Email, Help portal URL) Windows Defender Security Center will display a default notification text.
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace, and Delete. Valid values:
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace, and Delete.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 - (Disable) Notifications contain a default notification text.
- 1 - (Enable) Notifications contain the company name and contact options.
<!--EndDescription-->
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
@ -732,12 +769,16 @@ Valid values:
<!--StartDescription-->
<p style="margin-left: 20px">Added in Windows 10, version 1709. Enable this policy to have your company name and contact options displayed in a contact card fly out in Windows Defender Security Center. If you disable or do not configure this setting, or do not provide CompanyName and a minimum of one contact method (Phone using Skype, Email, Help portal URL) Windows Defender Security Center will not display the contact card fly out notification.
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace, and Delete. Valid values:
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace, and Delete.
<!--EndDescription-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 - (Disable) Do not display the company name and contact options in the card fly out notification.
- 1 - (Enable) Display the company name and contact options in the card fly out notification.
<!--EndDescription-->
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->