diff --git a/devices/surface-hub/TOC.md b/devices/surface-hub/TOC.md index 240bcc485e..74d61c7720 100644 --- a/devices/surface-hub/TOC.md +++ b/devices/surface-hub/TOC.md @@ -33,6 +33,7 @@ ### [Install apps on your Surface Hub](install-apps-on-surface-hub.md) ### [Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) ### [End a Surface Hub meeting with End session](i-am-done-finishing-your-surface-hub-meeting.md) +### [Sign in to Surface Hub with Microsoft Authenticator](surface-hub-authenticator-app.md) ### [Save your BitLocker key](save-bitlocker-key-surface-hub.md) ### [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) ### [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md) diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md index 60353013ed..6fc60ccb51 100644 --- a/devices/surface-hub/change-history-surface-hub.md +++ b/devices/surface-hub/change-history-surface-hub.md @@ -18,9 +18,14 @@ This topic lists new and updated topics in the [Surface Hub Admin Guide]( surfac ## August 2017 -New or changed topic | Description ---- | --- + +| New or changed topic | Description | +| --- | --- | [Accessibility](accessibility-surface-hub.md) | Added information about Narrator +[Sign in to Surface Hub with Microsoft Authenticator](surface-hub-authenticator-app.md) | New + + + ## July 2017 diff --git a/devices/surface-hub/images/approve-signin.png b/devices/surface-hub/images/approve-signin.png new file mode 100644 index 0000000000..7736b95431 Binary files /dev/null and b/devices/surface-hub/images/approve-signin.png differ diff --git a/devices/surface-hub/images/approve-signin2.png b/devices/surface-hub/images/approve-signin2.png new file mode 100644 index 0000000000..2ccfc40ecc Binary files /dev/null and b/devices/surface-hub/images/approve-signin2.png differ diff --git a/devices/surface-hub/images/attendees.png b/devices/surface-hub/images/attendees.png new file mode 100644 index 0000000000..fd468aa971 Binary files /dev/null and b/devices/surface-hub/images/attendees.png differ diff --git a/devices/surface-hub/images/mfa-options.png b/devices/surface-hub/images/mfa-options.png new file mode 100644 index 0000000000..c91a2a5517 Binary files /dev/null and b/devices/surface-hub/images/mfa-options.png differ diff --git a/devices/surface-hub/images/sign-in.png b/devices/surface-hub/images/sign-in.png new file mode 100644 index 0000000000..bd34f642a7 Binary files /dev/null and b/devices/surface-hub/images/sign-in.png differ diff --git a/devices/surface-hub/manage-surface-hub.md b/devices/surface-hub/manage-surface-hub.md index ce6d076d19..25cca9e168 100644 --- a/devices/surface-hub/manage-surface-hub.md +++ b/devices/surface-hub/manage-surface-hub.md @@ -34,6 +34,7 @@ Learn about managing and updating Surface Hub. | [Install apps on your Surface Hub]( https://technet.microsoft.com/itpro/surface-hub/install-apps-on-surface-hub) | Admins can install apps can from either the Microsoft Store or the Microsoft Store for Business.| | [Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | Microsoft Whiteboard’s latest update includes the capability for two Surface Hubs to collaborate in real time on the same board. | | [End a meeting with End session](https://technet.microsoft.com/itpro/surface-hub/i-am-done-finishing-your-surface-hub-meeting) | At the end of a meeting, users can tap **End session** to clean up any sensitive data and prepare the device for the next meeting.| +| [Sign in to Surface Hub with Microsoft Authenticator](surface-hub-authenticator-app.md) | You can sign in to a Surface Hub without a password using the Microsoft Authenticator app, available on Android and iOS. | | [Save your BitLocker key](https://technet.microsoft.com/itpro/surface-hub/save-bitlocker-key-surface-hub) | Every Surface Hub is automatically set up with BitLocker drive encryption software. Microsoft strongly recommends that you make sure you back up your BitLocker recovery keys.| | [Connect other devices and display with Surface Hub](https://technet.microsoft.com/itpro/surface-hub/connect-and-display-with-surface-hub) | You can connect other device to your Surface Hub to display content.| | [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md) | You can use Miracast on your wireless network or LAN to connect to Surface Hub. | diff --git a/devices/surface-hub/surface-hub-authenticator-app.md b/devices/surface-hub/surface-hub-authenticator-app.md new file mode 100644 index 0000000000..a501494419 --- /dev/null +++ b/devices/surface-hub/surface-hub-authenticator-app.md @@ -0,0 +1,83 @@ +--- +title: Sign in to Surface Hub with Microsoft Authenticator +description: Use Microsoft Authenticator on your mobile device to sign in to Surface Hub. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: surfacehub +author: jdeckerms +ms.author: jdecker +ms.date: 07/27/2017 +localizationpriority: medium +--- + +# Sign in to Surface Hub with Microsoft Authenticator + +People in your organization can sign in to a Surface Hub without a password using the Microsoft Authenticator app, available on Android and iOS. + + +## Organization prerequisites + +To let people in your organization sign in to Surface Hub with their phones and other devices instead of a password, you’ll need to make sure that your organization meets these prerequisites: + +- Your organization must be a hybrid or cloud-only organization, backed by Azure Active Directory (Azure AD). For more information, see [What is Azure Active Directory?](https://docs.microsoft.com/azure/active-directory/active-directory-whatis) + +- Make sure you have at minimum an Office 365 E3 subscription. + +- [Configure Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication). Select **Allow users to create app passwords to sign in to non-browser apps**, and make sure **Notification through mobile app** is selected. + + ![multi-factor authentication options](images/mfa-options.png) + +- Enable content hosting on Azure AD services such as Office online, SharePoint, etc. + +- Surface Hub must be running Windows 10, version 1703 or later. + +- Surface Hub is set up with either a local or domain-joined account. + +Currently, you cannot use Microsoft Authenticator to sign in to Surface Hubs that are joined to an Active Directory domain or to Azure AD. + +## Individual prerequisites + +- An Android phone running 6.0 or later, or an iPhone or iPad running iOS9 or later + +- The most recent version of the Microsoft Authenticator app from the appropriate app store + >[!NOTE] + >The Microsoft Authenticator app on phones running a Windows operating system can't be used to sign in to Surface Hub. + +- Passcode or screen lock on your device is enabled + +- A standard SMTP email address (example: joe@contoso.com). Non-standard or vanity SMTP email addresses (example: firstname.lastname@contoso.com) currently don’t work. + + +## How to set up the Microsoft Authenticator app + +>[!NOTE] +>If Company Portal is installed on your Android device, uninstall it before you set up Microsoft Authenticator. After you set up the app, you can reinstall Company Portal. + +1. Add your work or school account to Microsoft Authenticator for Multi-Factor Authentication. You will need a QR code provided by your IT department. For help, see [Get started with the Microsoft Authenticator app](https://docs.microsoft.com/azure/multi-factor-authentication/end-user/microsoft-authenticator-app-how-to). +2. Go to **Settings** and register your device. +1. Return to the accounts page and choose **Enable phone sign-in** from the account dropdown menu. + +## How to sign in to Surface Hub during a meeting + +1. After you’ve set up a meeting, go to the Surface Hub and select **Sign in to see your meetings and files**. + + >[!NOTE] + >If you’re not sure how to schedule a meeting on a Surface Hub, see [Schedule a meeting on Surface Hub](https://support.microsoft.com/help/17325/surfacehub-schedulemeeting). + + ![screenshot of Sign in option on Surface Hub](images/sign-in.png) + +2. You’ll see a list of the people invited to the meeting. Select yourself (or the person who wants to sign in – make sure this person has gone through the steps to set up their device before your meeting), and then select **Continue**. + + ![screenshot of list of attendees in a meeting](images/attendees.png) + + You'll see a code on the Surface Hub. + + ![screenshot of code for Approve Sign in](images/approve-signin.png) + +3. To approve the sign-in, open the Authenticator app, enter the four-digit code that’s displayed on the Surface Hub, and select **Approve**. You will then be asked to enter the PIN or use your fingerprint to complete the sign in. + + ![screenshot of the Approve sign-in screen in Microsoft Authenticator](images/approve-signin2.png) + +You can now access all files through the OneDrive app. + diff --git a/devices/surface-hub/surface-hub-downloads.md b/devices/surface-hub/surface-hub-downloads.md index 0adb44a4fc..10a0151d96 100644 --- a/devices/surface-hub/surface-hub-downloads.md +++ b/devices/surface-hub/surface-hub-downloads.md @@ -23,7 +23,7 @@ This topic provides links to useful Surface Hub documents, such as product datas | [Surface Hub User Guide (PDF)](http://download.microsoft.com/download/3/6/B/36B6331E-0C63-4E71-A05D-EE88D05081F8/surface-hub-user-guide-en-us.pdf) | Learn how to use Surface Hub in scheduled or ad-hoc meetings. Invite remote participants, use the built-in tools, save data from your meeting, and more. | | [Surface Hub Replacement PC Drivers](https://www.microsoft.com/download/details.aspx?id=52210) | The Surface Hub Replacement PC driver set is available for those customers who have chosen to disable the Surface Hub’s internal PC and use an external computer with their 84” or 55” Surface Hub. This download is meant to be used with the Surface Hub Admin Guide , which contains further details on configuring a Surface Hub Replacement PC. | | [Surface Hub SSD Replacement Guide (PDF)](https://www.microsoft.com/surface/en-us/support/surfacehubssd) | Learn how to replace the solid state drive (SSD) for the 55- and 84-inch Surface Hub. | -| [Microsoft Surface Hub Rollout and Adoption Success Kit (ZIP)](http://download.microsoft.com/download/F/A/3/FA3ADEA4-4966-456B-8BDE-0A594FD52C6C/Surface%20Hub%20RASK.zip) | Best practices for generating awareness and implementing change management to maximize adoption, usage, and benefits of Microsoft Surface Hub. The Rollout and Adoption Success Kit zip file includes the Rollout and Adoption Success Kit detailed document, Surface Hub presentation, demo guidance, awareness graphics, and more. | +| [Microsoft Surface Hub Rollout and Adoption Success Kit (ZIP)](http://download.microsoft.com/download/F/A/3/FA3ADEA4-4966-456B-8BDE-0A594FD52C6C/Surface_Hub_Adoption_Kit_Final_0519.pdf) | Best practices for generating awareness and implementing change management to maximize adoption, usage, and benefits of Microsoft Surface Hub. The Rollout and Adoption Success Kit zip file includes the Rollout and Adoption Success Kit detailed document, Surface Hub presentation, demo guidance, awareness graphics, and more. | | [Unpacking Guide for 84-inch Surface Hub (PDF)](https://www.microsoft.com/surface/support/surface-hub/surface-hub-unpacking-guide-84) | Learn how to unpack your 84-inch Surface Hub efficiently and safely. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/75/2b/752b73dc-6e9d-4692-8ba1-0f9fc03bff6b.mov?n=04.07.16_installation_video_03_unpacking_84.mov) | | [Unpacking Guide for 55-inch Surface Hub (PDF)](https://www.microsoft.com/surface/support/surface-hub/surface-hub-unpacking-guide-55) | Learn how to unpack your 55-inch Surface Hub efficiently and safely. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/a9/d6/a9d6b4d7-d33f-4e8b-be92-28f7fc2c06d7.mov?n=04.07.16_installation_video_02_unpacking_55.mov) | | [Wall Mounting and Assembly Guide (PDF)](https://www.microsoft.com/surface/support/surface-hub/surface-hub-wall-mounting-assembly-guide) | Detailed instructions on how to safely and securely assemble the wall brackets, and how to mount your Surface Hub onto them. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/bf/4d/bf4d6f06-370c-45ee-88e6-c409873914e8.mov?n=04.07.16_installation_video_05_wall_mount.mov) | diff --git a/mdop/mbam-v25/determining-why-a-device-receives-a-noncompliance-message.md b/mdop/mbam-v25/determining-why-a-device-receives-a-noncompliance-message.md index ed35926a8b..e9c656984d 100644 --- a/mdop/mbam-v25/determining-why-a-device-receives-a-noncompliance-message.md +++ b/mdop/mbam-v25/determining-why-a-device-receives-a-noncompliance-message.md @@ -89,6 +89,14 @@ You can use your preferred method to view WMI. If you use PowerShell, run `gwmi

14

AutoUnlock unsafe unless the OS volume is encrypted.

+ +

15

+

Policy requires minimum cypher strength is XTS-AES-128 bit, actual cypher strength is weaker than that.

+ + +

16

+

Policy requires minimum cypher strength is XTS-AES-256 bit, actual cypher strength is weaker than that.

+ diff --git a/windows/client-management/mdm/devdetail-csp.md b/windows/client-management/mdm/devdetail-csp.md index 45e1aa1d54..5eb786803f 100644 --- a/windows/client-management/mdm/devdetail-csp.md +++ b/windows/client-management/mdm/devdetail-csp.md @@ -150,32 +150,32 @@ The following diagram shows the DevDetail configuration service provider managem > [!NOTE] > This is not supported in Windows 10 for desktop editions. -**VoLTEServiceSetting** +**Ext/VoLTEServiceSetting**

Returns the VoLTE service to on or off. This is only exposed to mobile operator OMA-DM servers.

Supported operation is Get. -**WlanIPv4Address** +**Ext/WlanIPv4Address**

Returns the IPv4 address of the active Wi-Fi connection. This is only exposed to enterprise OMA DM servers.

Supported operation is Get. -**WlanIPv6Address** +**Ext/WlanIPv6Address**

Returns the IPv6 address of the active Wi-Fi connection. This is only exposed to enterprise OMA-DM servers.

Supported operation is Get. -**WlanDnsSuffix** +**Ext/WlanDnsSuffix**

Returns the DNS suffix of the active Wi-Fi connection. This is only exposed to enterprise OMA-DM servers.

Supported operation is Get. -**WlanSubnetMask** +**Ext/WlanSubnetMask**

Returns the subnet mask for the active Wi-Fi connection. This is only exposed to enterprise OMA-DM servers.

Supported operation is Get. -**DeviceHardwareData** +**Ext/DeviceHardwareData**

Added in Windows 10 version 1703. Returns a base64-encoded string of the hardware parameters of a device. > [!Note] diff --git a/windows/client-management/mdm/images/provisioning-csp-office.png b/windows/client-management/mdm/images/provisioning-csp-office.png index caa243a136..c361494236 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-office.png and b/windows/client-management/mdm/images/provisioning-csp-office.png differ diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 2960668bda..0dc3060c96 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -10,7 +10,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/14/2017 +ms.date: 08/25/2017 --- # What's new in MDM enrollment and management @@ -52,7 +52,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s ## What's new in Windows 10, version 1511 - +
@@ -184,7 +184,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s ## What's new in Windows 10, version 1607 -
+
@@ -495,7 +495,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s ## What's new in Windows 10, version 1703 -
+
@@ -916,7 +916,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s ## What's new in Windows 10, version 1709 -
+
@@ -974,9 +974,18 @@ For details about Microsoft mobile device management protocols for Windows 10 s + + + - + - - + + @@ -462,7 +462,10 @@ ms.date: 08/09/2017 > [!NOTE] > This policy requires reboot to take effect. -

Added in Windows 10, version 1703. Allows IT Admins to configure Start by collapsing or removing the all apps list. +

Allows IT Admins to configure Start by collapsing or removing the all apps list. + +> [!Note] +> There were issues reported with the previous release of this policy and a fix was added in Windows 10, version 1709.

The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index ec16e08ca7..3e242783d4 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 06/30/2017 +ms.date: 08/23/2017 --- # Policy DDF file @@ -21,6 +21,7 @@ You can download the DDF files from the links below: - [Download the Policy DDF file for Windows 10, version 1703](http://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml) - [Download the Policy DDF file for Windows 10, version 1607](http://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607.xml) +- [Download the Policy DDF file for Windows 10, version 1607 release 8C](http://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) - [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip) The XML below is the DDF for Windows 10, version 1709. @@ -353,6 +354,941 @@ The XML below is the DDF for Windows 10, version 1709. + + Browser + + + + + + + + + + + + + + + + + + + + + AllowAddressBarDropdown + + + + + + + + This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services. + + + + + + + + + + + text/plain + + + + + AllowAutofill + + + + + + + + This setting lets you decide whether employees can use Autofill to automatically fill in form fields while using Microsoft Edge. + + + + + + + + + + + text/plain + + + + + AllowBrowser + + + + + + + + + + + + + + + + + + + text/plain + + + + + AllowCookies + + + + + + + + This setting lets you configure how your company deals with cookies. + + + + + + + + + + + text/plain + + + + + AllowDeveloperTools + + + + + + + + This setting lets you decide whether employees can use F12 Developer Tools on Microsoft Edge. + + + + + + + + + + + text/plain + + + + + AllowDoNotTrack + + + + + + + + This setting lets you decide whether employees can send Do Not Track headers to websites that request tracking info. + + + + + + + + + + + text/plain + + + + + AllowExtensions + + + + + + + + This setting lets you decide whether employees can load extensions in Microsoft Edge. + + + + + + + + + + + text/plain + + + + + AllowFlash + + + + + + + + This setting lets you decide whether employees can run Adobe Flash in Microsoft Edge. + + + + + + + + + + + text/plain + + + + + AllowFlashClickToRun + + + + + + + + Configure the Adobe Flash Click-to-Run setting. + + + + + + + + + + + text/plain + + + + + AllowInPrivate + + + + + + + + This setting lets you decide whether employees can browse using InPrivate website browsing. + + + + + + + + + + + text/plain + + + + + AllowMicrosoftCompatibilityList + + + + + + + + This policy setting lets you decide whether the Microsoft Compatibility List is enabled or disabled in Microsoft Edge. This feature uses a Microsoft-provided list to ensure that any sites with known compatibility issues are displayed correctly when a user navigates to them. By default, the Microsoft Compatibility List is enabled and can be viewed by navigating to about:compat. + +If you enable or don’t configure this setting, Microsoft Edge will periodically download the latest version of the list from Microsoft and will apply the configurations specified there during browser navigation. If a user visits a site on the Microsoft Compatibility List, he or she will be prompted to open the site in Internet Explorer 11. Once in Internet Explorer, the site will automatically be rendered as if the user is viewing it in the previous version of Internet Explorer it requires to display correctly. + +If you disable this setting, the Microsoft Compatibility List will not be used during browser navigation. + + + + + + + + + + + text/plain + + + + + AllowPasswordManager + + + + + + + + This setting lets you decide whether employees can save their passwords locally, using Password Manager. + + + + + + + + + + + text/plain + + + + + AllowPopups + + + + + + + + This setting lets you decide whether to turn on Pop-up Blocker and whether to allow pop-ups to appear in secondary windows. + + + + + + + + + + + text/plain + + + + + AllowSearchEngineCustomization + + + + + + + + Allow search engine customization for MDM enrolled devices. Users can change their default search engine. + +If this setting is turned on or not configured, users can add new search engines and change the default used in the address bar from within Microsoft Edge Settings. +If this setting is disabled, users will be unable to add search engines or change the default used in the address bar. + +This policy will only apply on domain joined machines or when the device is MDM enrolled. For more information, see Microsoft browser extension policy (aka.ms/browserpolicy). + + + + + + + + + + + text/plain + + + + + AllowSearchSuggestionsinAddressBar + + + + + + + + This setting lets you decide whether search suggestions should appear in the Address bar of Microsoft Edge. + + + + + + + + + + + text/plain + + + + + AllowSmartScreen + + + + + + + + This setting lets you decide whether to turn on Windows Defender SmartScreen. + + + + + + + + + + + text/plain + + + + + AlwaysEnableBooksLibrary + + + + + + + + Specifies whether the Books Library in Microsoft Edge will always be visible regardless of the country or region setting for the device. + + + + + + + + + + + text/plain + + + + + ClearBrowsingDataOnExit + + + + + + + + Specifies whether to always clear browsing history on exiting Microsoft Edge. + + + + + + + + + + + text/plain + + + + + ConfigureAdditionalSearchEngines + + + + + + + + Allows you to add up to 5 additional search engines for MDM-enrolled devices. + +If this setting is turned on, you can add up to 5 additional search engines for your employee. For each additional search engine you wish to add, you must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. This policy does not affect the default search engine. Employees will not be able to remove these search engines, but they can set any one of these as the default. + +If this setting is not configured, the search engines are the ones specified in the App settings. If this setting is disabled, the search engines you had added will be deleted from your employee's machine. + +Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. + + + + + + + + + + + text/plain + + + + + DisableLockdownOfStartPages + + + + + + + + Boolean policy that specifies whether the lockdown on the Start pages is disabled. This policy works with the Browser/HomePages policy, which locks down the Start pages that the users cannot modify. You can use the DisableLockdownOfStartPages policy to allow users to modify the Start pages when Browser/HomePages policy is in effect. + +Note: This policy has no effect when Browser/HomePages is not configured. + +Important +This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy). + + + + + + + + + + + text/plain + + + + + EnterpriseModeSiteList + + + + + + + + This setting lets you configure whether your company uses Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy websites. + + + + + + + + + + + text/plain + + + + + EnterpriseSiteListServiceUrl + + + + + + + + + + + + + + + + + + + text/plain + + + + + FirstRunURL + + + + + + + + Configure first run URL. + + + + + + + + + + + text/plain + + + + + HomePages + + + + + + + + Configure the Start page URLs for your employees. +Example: +If you wanted to allow contoso.com and fabrikam.com then you would append /support to the site strings like contoso.com/support and fabrikam.com/support. +Encapsulate each string with greater than and less than characters like any other XML tag. + +Version 1703 or later:  If you don't want to send traffic to Microsoft, you can use the about:blank value (encapsulate with greater than and less than characters like any other XML tag), which is honored for both domain- and non-domain-joined machines, when it's the only configured URL. + + + + + + + + + + + text/plain + + + + + LockdownFavorites + + + + + + + + This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge. + +If you enable this setting, employees won't be able to add, import, or change anything in the Favorites list. Also as part of this, Save a Favorite, Import settings, and the context menu items (such as, Create a new folder) are all turned off. + +Important +Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. + +If you disable or don't configure this setting (default), employees can add, import and make changes to the Favorites list. + + + + + + + + + + + text/plain + + + + + PreventAccessToAboutFlagsInMicrosoftEdge + + + + + + + + Prevent access to the about:flags page in Microsoft Edge. + + + + + + + + + + + text/plain + + + + + PreventFirstRunPage + + + + + + + + Specifies whether the First Run webpage is prevented from automatically opening on the first launch of Microsoft Edge. This policy is only available for Windows 10 version 1703 or later for desktop. + +Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. + + + + + + + + + + + text/plain + + + + + PreventLiveTileDataCollection + + + + + + + + This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu. + +Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. + + + + + + + + + + + text/plain + + + + + PreventSmartScreenPromptOverride + + + + + + + + Don't allow Windows Defender SmartScreen warning overrides + + + + + + + + + + + text/plain + + + + + PreventSmartScreenPromptOverrideForFiles + + + + + + + + Don't allow Windows Defender SmartScreen warning overrides for unverified files. + + + + + + + + + + + text/plain + + + + + PreventUsingLocalHostIPAddressForWebRTC + + + + + + + + Prevent using localhost IP address for WebRTC + + + + + + + + + + + text/plain + + + + + ProvisionFavorites + + + + + + + + This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. + +If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites. + +Important +Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. + +If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar. + + + + + + + + + + + text/plain + + + + + SendIntranetTraffictoInternetExplorer + + + + + + + + Sends all intranet traffic over to Internet Explorer. + + + + + + + + + + + text/plain + + + + + SetDefaultSearchEngine + + + + + + + + Sets the default search engine for MDM-enrolled devices. Users can still change their default search engine. + +If this setting is turned on, you are setting the default search engine that you would like your employees to use. Employees can still change the default search engine, unless you apply the AllowSearchEngineCustomization policy which will disable the ability to change it. You must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. If you would like for your employees to use the Edge factory settings for the default search engine for their market, set the string EDGEDEFAULT; if you would like for your employees to use Bing as the default search engine, set the string EDGEBING. + +If this setting is not configured, the default search engine is set to the one specified in App settings and can be changed by your employees. If this setting is disabled, the policy-set search engine will be removed, and, if it is the current default, the default will be set back to the factory Microsoft Edge search engine for the market. + +Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. + + + + + + + + + + + text/plain + + + + + ShowMessageWhenOpeningSitesInInternetExplorer + + + + + + + + Show message when opening sites in Internet Explorer + + + + + + + + + + + text/plain + + + + + SyncFavoritesBetweenIEAndMicrosoftEdge + + + + + + + + Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering. + + + + + + + + + + + text/plain + + + + CredentialsUI @@ -467,7 +1403,7 @@ The XML below is the DDF for Windows 10, version 1709. - AllowUserPrinterInstallation + DefaultPrinterName @@ -475,9 +1411,9 @@ The XML below is the DDF for Windows 10, version 1709. - Boolean that specifies whether or not to allow user to install new printers + This policy sets user's default printer - + @@ -491,7 +1427,7 @@ The XML below is the DDF for Windows 10, version 1709. - DefaultPrinterName + PreventAddingNewPrinters @@ -499,9 +1435,9 @@ The XML below is the DDF for Windows 10, version 1709. - This policy sets user's default printer + Boolean that specifies whether or not to prevent user to install new printers - + @@ -1133,7 +2069,7 @@ The XML below is the DDF for Windows 10, version 1709. - AllowInternetExplorer7PolicyList + AllowInternetExplorer7PolicyList @@ -1757,7 +2693,7 @@ The XML below is the DDF for Windows 10, version 1709. - DisableDeletingUserVisitedWebsites + DisableDeletingUserVisitedWebsites @@ -2357,7 +3293,7 @@ The XML below is the DDF for Windows 10, version 1709. - InternetZoneAllowLoadingOfXAMLFilesWRONG + InternetZoneAllowLoadingOfXAMLFiles @@ -2597,31 +3533,7 @@ The XML below is the DDF for Windows 10, version 1709. - InternetZoneDoNotRunAntimalwareAgainstActiveXControlsWRONG1 - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneDoNotRunAntimalwareAgainstActiveXControlsWRONG2 + InternetZoneDoNotRunAntimalwareAgainstActiveXControls @@ -2861,55 +3773,7 @@ The XML below is the DDF for Windows 10, version 1709. - InternetZoneInitializeAndScriptActiveXControlsNotMarkedSafe - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneJavaPermissionsWRONG1 - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneJavaPermissionsWRONG2 + InternetZoneJavaPermissions @@ -3340,6 +4204,30 @@ The XML below is the DDF for Windows 10, version 1709. + + IntranetZoneDoNotRunAntimalwareAgainstActiveXControls + + + + + + + + + + + + + + + + + + + text/plain + + + IntranetZoneInitializeAndScriptActiveXControls @@ -3364,6 +4252,54 @@ The XML below is the DDF for Windows 10, version 1709. + + IntranetZoneInitializeAndScriptActiveXControlsNotMarkedSafe + + + + + + + + + + + + + + + + + + + text/plain + + + + + IntranetZoneJavaPermissions + + + + + + + + + + + + + + + + + + + text/plain + + + IntranetZoneNavigateWindowsAndFrames @@ -5501,31 +6437,7 @@ The XML below is the DDF for Windows 10, version 1709. - RestrictedSitesZoneAllowFontDownloadsWRONG1 - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowFontDownloadsWRONG2 + RestrictedSitesZoneAllowFontDownloads @@ -5908,6 +6820,30 @@ The XML below is the DDF for Windows 10, version 1709. + + RestrictedSitesZoneEnableCrossSiteScriptingFilter + + + + + + + + + + + + + + + + + + + text/plain + + + RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows @@ -6221,7 +7157,7 @@ The XML below is the DDF for Windows 10, version 1709. - RestrictedSitesZoneWRONG + RestrictedSitesZoneScriptingOfJavaApplets @@ -6245,7 +7181,7 @@ The XML below is the DDF for Windows 10, version 1709. - RestrictedSitesZoneWRONG2 + RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles @@ -6269,7 +7205,7 @@ The XML below is the DDF for Windows 10, version 1709. - RestrictedSitesZoneWRONG3 + RestrictedSitesZoneTurnOnCrossSiteScriptingFilter @@ -6293,7 +7229,7 @@ The XML below is the DDF for Windows 10, version 1709. - RestrictedSitesZoneWRONG4 + RestrictedSitesZoneTurnOnProtectedMode @@ -6317,7 +7253,7 @@ The XML below is the DDF for Windows 10, version 1709. - RestrictedSitesZoneWRONG5 + RestrictedSitesZoneUsePopupBlocker @@ -6652,6 +7588,54 @@ The XML below is the DDF for Windows 10, version 1709. + + TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls + + + + + + + + + + + + + + + + + + + text/plain + + + + + TrustedSitesZoneDontRunAntimalwareProgramsAgainstActiveXControls + + + + + + + + + + + + + + + + + + + text/plain + + + TrustedSitesZoneInitializeAndScriptActiveXControls @@ -6676,6 +7660,54 @@ The XML below is the DDF for Windows 10, version 1709. + + TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedAsSafe + + + + + + + + + + + + + + + + + + + text/plain + + + + + TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedSafe + + + + + + + + + + + + + + + + + + + text/plain + + + TrustedSitesZoneJavaPermissions @@ -6724,54 +7756,6 @@ The XML below is the DDF for Windows 10, version 1709. - - TrustedSitesZoneWRONG1 - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneWRONG2 - - - - - - - - - - - - - - - - - - - text/plain - - - Notifications @@ -7062,6 +8046,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + HighestValueMostSecure @@ -7108,6 +8093,7 @@ The XML below is the DDF for Windows 10, version 1709. AttachmentManager.admx AttachmentManager~AT~WindowsComponents~AM_AM AM_MarkZoneOnSavedAtttachments + LastWrite @@ -7134,6 +8120,7 @@ The XML below is the DDF for Windows 10, version 1709. AttachmentManager.admx AttachmentManager~AT~WindowsComponents~AM_AM AM_RemoveZoneInfo + LastWrite @@ -7160,6 +8147,7 @@ The XML below is the DDF for Windows 10, version 1709. AttachmentManager.admx AttachmentManager~AT~WindowsComponents~AM_AM AM_CallIOfficeAntiVirus + LastWrite @@ -7202,6 +8190,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + LowestValueMostSecure @@ -7248,6 +8237,7 @@ The XML below is the DDF for Windows 10, version 1709. AutoPlay.admx AutoPlay~AT~WindowsComponents~AutoPlay NoAutoplayfornonVolume + LastWrite @@ -7274,6 +8264,7 @@ The XML below is the DDF for Windows 10, version 1709. AutoPlay.admx AutoPlay~AT~WindowsComponents~AutoPlay NoAutorun + LastWrite @@ -7300,6 +8291,921 @@ The XML below is the DDF for Windows 10, version 1709. AutoPlay.admx AutoPlay~AT~WindowsComponents~AutoPlay Autorun + LastWrite + + + + + Browser + + + + + + + + + + + + + + + + + + + AllowAddressBarDropdown + + + + + This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services. + 1 + + + + + + + + + + + text/plain + + phone + LowestValueMostSecure + + + + AllowAutofill + + + + + This setting lets you decide whether employees can use Autofill to automatically fill in form fields while using Microsoft Edge. + 0 + + + + + + + + + + + text/plain + + LowestValueMostSecure + + + + AllowBrowser + + + + + + 1 + + + + + + + + + + + text/plain + + desktop + LowestValueMostSecure + + + + AllowCookies + + + + + This setting lets you configure how your company deals with cookies. + 2 + + + + + + + + + + + text/plain + + LowestValueMostSecure + + + + AllowDeveloperTools + + + + + This setting lets you decide whether employees can use F12 Developer Tools on Microsoft Edge. + 1 + + + + + + + + + + + text/plain + + phone + LowestValueMostSecure + + + + AllowDoNotTrack + + + + + This setting lets you decide whether employees can send Do Not Track headers to websites that request tracking info. + 0 + + + + + + + + + + + text/plain + + LowestValueMostSecure + + + + AllowExtensions + + + + + This setting lets you decide whether employees can load extensions in Microsoft Edge. + 1 + + + + + + + + + + + text/plain + + phone + LowestValueMostSecure + + + + AllowFlash + + + + + This setting lets you decide whether employees can run Adobe Flash in Microsoft Edge. + 1 + + + + + + + + + + + text/plain + + phone + HighestValueMostSecure + + + + AllowFlashClickToRun + + + + + Configure the Adobe Flash Click-to-Run setting. + 1 + + + + + + + + + + + text/plain + + phone + HighestValueMostSecure + + + + AllowInPrivate + + + + + This setting lets you decide whether employees can browse using InPrivate website browsing. + 1 + + + + + + + + + + + text/plain + + LowestValueMostSecure + + + + AllowMicrosoftCompatibilityList + + + + + This policy setting lets you decide whether the Microsoft Compatibility List is enabled or disabled in Microsoft Edge. This feature uses a Microsoft-provided list to ensure that any sites with known compatibility issues are displayed correctly when a user navigates to them. By default, the Microsoft Compatibility List is enabled and can be viewed by navigating to about:compat. + +If you enable or don’t configure this setting, Microsoft Edge will periodically download the latest version of the list from Microsoft and will apply the configurations specified there during browser navigation. If a user visits a site on the Microsoft Compatibility List, he or she will be prompted to open the site in Internet Explorer 11. Once in Internet Explorer, the site will automatically be rendered as if the user is viewing it in the previous version of Internet Explorer it requires to display correctly. + +If you disable this setting, the Microsoft Compatibility List will not be used during browser navigation. + 1 + + + + + + + + + + + text/plain + + LowestValueMostSecure + + + + AllowPasswordManager + + + + + This setting lets you decide whether employees can save their passwords locally, using Password Manager. + 1 + + + + + + + + + + + text/plain + + LowestValueMostSecure + + + + AllowPopups + + + + + This setting lets you decide whether to turn on Pop-up Blocker and whether to allow pop-ups to appear in secondary windows. + 0 + + + + + + + + + + + text/plain + + phone + LowestValueMostSecure + + + + AllowSearchEngineCustomization + + + + + Allow search engine customization for MDM enrolled devices. Users can change their default search engine. + +If this setting is turned on or not configured, users can add new search engines and change the default used in the address bar from within Microsoft Edge Settings. +If this setting is disabled, users will be unable to add search engines or change the default used in the address bar. + +This policy will only apply on domain joined machines or when the device is MDM enrolled. For more information, see Microsoft browser extension policy (aka.ms/browserpolicy). + 1 + + + + + + + + + + + text/plain + + LowestValueMostSecure + + + + AllowSearchSuggestionsinAddressBar + + + + + This setting lets you decide whether search suggestions should appear in the Address bar of Microsoft Edge. + 1 + + + + + + + + + + + text/plain + + LowestValueMostSecure + + + + AllowSmartScreen + + + + + This setting lets you decide whether to turn on Windows Defender SmartScreen. + 1 + + + + + + + + + + + text/plain + + LowestValueMostSecure + + + + AlwaysEnableBooksLibrary + + + + + Specifies whether the Books Library in Microsoft Edge will always be visible regardless of the country or region setting for the device. + 0 + + + + + + + + + + + text/plain + + LowestValueMostSecure + + + + ClearBrowsingDataOnExit + + + + + Specifies whether to always clear browsing history on exiting Microsoft Edge. + 0 + + + + + + + + + + + text/plain + + phone + LowestValueMostSecure + + + + ConfigureAdditionalSearchEngines + + + + + Allows you to add up to 5 additional search engines for MDM-enrolled devices. + +If this setting is turned on, you can add up to 5 additional search engines for your employee. For each additional search engine you wish to add, you must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. This policy does not affect the default search engine. Employees will not be able to remove these search engines, but they can set any one of these as the default. + +If this setting is not configured, the search engines are the ones specified in the App settings. If this setting is disabled, the search engines you had added will be deleted from your employee's machine. + +Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. + + + + + + + + + + + + text/plain + + LastWrite + + + + DisableLockdownOfStartPages + + + + + Boolean policy that specifies whether the lockdown on the Start pages is disabled. This policy works with the Browser/HomePages policy, which locks down the Start pages that the users cannot modify. You can use the DisableLockdownOfStartPages policy to allow users to modify the Start pages when Browser/HomePages policy is in effect. + +Note: This policy has no effect when Browser/HomePages is not configured. + +Important +This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy). + 0 + + + + + + + + + + + text/plain + + phone + LowestValueMostSecure + + + + EnterpriseModeSiteList + + + + + This setting lets you configure whether your company uses Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy websites. + + + + + + + + + + + + text/plain + + phone + LastWrite + + + + EnterpriseSiteListServiceUrl + + + + + + + + + + + + + + + + + text/plain + + phone + LastWrite + + + + FirstRunURL + + + + + Configure first run URL. + + + + + + + + + + + + text/plain + + desktop + LastWrite + + + + HomePages + + + + + Configure the Start page URLs for your employees. +Example: +If you wanted to allow contoso.com and fabrikam.com then you would append /support to the site strings like contoso.com/support and fabrikam.com/support. +Encapsulate each string with greater than and less than characters like any other XML tag. + +Version 1703 or later:  If you don't want to send traffic to Microsoft, you can use the about:blank value (encapsulate with greater than and less than characters like any other XML tag), which is honored for both domain- and non-domain-joined machines, when it's the only configured URL. + + + + + + + + + + + + text/plain + + phone + LastWrite + + + + LockdownFavorites + + + + + This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge. + +If you enable this setting, employees won't be able to add, import, or change anything in the Favorites list. Also as part of this, Save a Favorite, Import settings, and the context menu items (such as, Create a new folder) are all turned off. + +Important +Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. + +If you disable or don't configure this setting (default), employees can add, import and make changes to the Favorites list. + 0 + + + + + + + + + + + text/plain + + LowestValueMostSecure + + + + PreventAccessToAboutFlagsInMicrosoftEdge + + + + + Prevent access to the about:flags page in Microsoft Edge. + 0 + + + + + + + + + + + text/plain + + HighestValueMostSecure + + + + PreventFirstRunPage + + + + + Specifies whether the First Run webpage is prevented from automatically opening on the first launch of Microsoft Edge. This policy is only available for Windows 10 version 1703 or later for desktop. + +Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. + 0 + + + + + + + + + + + text/plain + + phone + HighestValueMostSecure + + + + PreventLiveTileDataCollection + + + + + This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu. + +Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. + 0 + + + + + + + + + + + text/plain + + HighestValueMostSecure + + + + PreventSmartScreenPromptOverride + + + + + Don't allow Windows Defender SmartScreen warning overrides + 0 + + + + + + + + + + + text/plain + + HighestValueMostSecure + + + + PreventSmartScreenPromptOverrideForFiles + + + + + Don't allow Windows Defender SmartScreen warning overrides for unverified files. + 0 + + + + + + + + + + + text/plain + + HighestValueMostSecure + + + + PreventUsingLocalHostIPAddressForWebRTC + + + + + Prevent using localhost IP address for WebRTC + 0 + + + + + + + + + + + text/plain + + HighestValueMostSecure + + + + ProvisionFavorites + + + + + This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. + +If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites. + +Important +Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. + +If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar. + + + + + + + + + + + + text/plain + + LastWrite + + + + SendIntranetTraffictoInternetExplorer + + + + + Sends all intranet traffic over to Internet Explorer. + 0 + + + + + + + + + + + text/plain + + phone + HighestValueMostSecure + + + + SetDefaultSearchEngine + + + + + Sets the default search engine for MDM-enrolled devices. Users can still change their default search engine. + +If this setting is turned on, you are setting the default search engine that you would like your employees to use. Employees can still change the default search engine, unless you apply the AllowSearchEngineCustomization policy which will disable the ability to change it. You must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. If you would like for your employees to use the Edge factory settings for the default search engine for their market, set the string EDGEDEFAULT; if you would like for your employees to use Bing as the default search engine, set the string EDGEBING. + +If this setting is not configured, the default search engine is set to the one specified in App settings and can be changed by your employees. If this setting is disabled, the policy-set search engine will be removed, and, if it is the current default, the default will be set back to the factory Microsoft Edge search engine for the market. + +Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. + + + + + + + + + + + + text/plain + + LastWrite + + + + ShowMessageWhenOpeningSitesInInternetExplorer + + + + + Show message when opening sites in Internet Explorer + 0 + + + + + + + + + + + text/plain + + phone + HighestValueMostSecure + + + + SyncFavoritesBetweenIEAndMicrosoftEdge + + + + + Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering. + 0 + + + + + + + + + + + text/plain + + phone + LowestValueMostSecure @@ -7346,6 +9252,7 @@ The XML below is the DDF for Windows 10, version 1709. credui.admx CredUI~AT~WindowsComponents~CredUI DisablePasswordReveal + LastWrite @@ -7392,6 +9299,7 @@ The XML below is the DDF for Windows 10, version 1709. desktop.admx desktop~AT~Desktop DisablePersonalDirChange + LastWrite @@ -7414,28 +9322,6 @@ The XML below is the DDF for Windows 10, version 1709. - - AllowUserPrinterInstallation - - - - - Boolean that specifies whether or not to allow user to install new printers - - - - - - - - - - - - text/plain - - - DefaultPrinterName @@ -7456,6 +9342,30 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + LastWrite + + + + PreventAddingNewPrinters + + + + + Boolean that specifies whether or not to prevent user to install new printers + 0 + + + + + + + + + + + text/plain + + HighestValueMostSecure @@ -7478,6 +9388,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + LastWrite @@ -7520,6 +9431,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + LastWrite @@ -7542,6 +9454,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + LastWrite @@ -7551,7 +9464,7 @@ The XML below is the DDF for Windows 10, version 1709. A GUID identifying the client application authorized to retrieve OAuth tokens from the OAuthAuthority - E1CF1107-FF90-4228-93BF-26052DD2C714 + @@ -7564,6 +9477,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + LastWrite @@ -7586,6 +9500,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + LastWrite @@ -7608,6 +9523,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + LastWrite @@ -7630,6 +9546,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + LastWrite @@ -7672,6 +9589,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + LowestValueMostSecure @@ -7695,6 +9613,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain phone + LowestValueMostSecure @@ -7718,6 +9637,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain phone + LowestValueMostSecure @@ -7741,6 +9661,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain phone + LowestValueMostSecure @@ -7763,6 +9684,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + LowestValueMostSecure @@ -7785,6 +9707,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + LowestValueMostSecure @@ -7808,6 +9731,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain phone + LowestValueMostSecure @@ -7854,6 +9778,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer AddSearchProvider + LastWrite @@ -7880,6 +9805,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer TurnOnActiveXFiltering + LastWrite @@ -7906,6 +9832,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement AddonManagement_AddOnList + LastWrite @@ -7932,6 +9859,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer RestrictFormSuggestPW + LastWrite @@ -7958,6 +9886,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyWarnCertMismatch + LastWrite @@ -7984,6 +9913,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~DeleteBrowsingHistory DBHDisableDeleteOnExit + LastWrite @@ -8010,6 +9940,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_EnableEnhancedProtectedMode + LastWrite @@ -8036,6 +9967,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer EnterpriseModeEnable + LastWrite @@ -8062,10 +9994,11 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer EnterpriseModeSiteList + LastWrite - AllowInternetExplorer7PolicyList + AllowInternetExplorer7PolicyList @@ -8088,6 +10021,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~CategoryCompatView CompatView_UsePolicyList + LastWrite @@ -8114,6 +10048,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~CategoryCompatView CompatView_IntranetSites + LastWrite @@ -8140,6 +10075,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyInternetZoneTemplate + LastWrite @@ -8166,6 +10102,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyIntranetZoneTemplate + LastWrite @@ -8192,6 +10129,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyLocalMachineZoneTemplate + LastWrite @@ -8218,6 +10156,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyInternetZoneLockdownTemplate + LastWrite @@ -8244,6 +10183,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyIntranetZoneLockdownTemplate + LastWrite @@ -8270,6 +10210,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyLocalMachineZoneLockdownTemplate + LastWrite @@ -8296,6 +10237,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyRestrictedSitesZoneLockdownTemplate + LastWrite @@ -8322,6 +10264,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetSettings~Advanced~Browsing UseIntranetSiteForOneWordEntry + LastWrite @@ -8348,6 +10291,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_Zonemaps + LastWrite @@ -8374,6 +10318,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyTrustedSitesZoneLockdownTemplate + LastWrite @@ -8400,6 +10345,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_InvalidSignatureBlock + LastWrite @@ -8426,6 +10372,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyRestrictedSitesZoneTemplate + LastWrite @@ -8452,6 +10399,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer EnableSuggestedSites + LastWrite @@ -8478,6 +10426,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyTrustedSitesZoneTemplate + LastWrite @@ -8504,6 +10453,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_CertificateRevocation + LastWrite @@ -8530,6 +10480,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_DownloadSignatures + LastWrite @@ -8556,6 +10507,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryBinaryBehaviorSecurityRestriction IESF_PolicyExplorerProcesses_2 + LastWrite @@ -8582,6 +10534,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement DisableFlashInIE + LastWrite @@ -8608,6 +10561,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement VerMgmtDisable + LastWrite @@ -8634,6 +10588,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer DisableSafetyFilterOverride + LastWrite @@ -8660,6 +10615,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer DisableSafetyFilterOverrideForAppRepUnknown + LastWrite @@ -8686,6 +10642,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~DeleteBrowsingHistory RestrictHistory + LastWrite @@ -8712,6 +10669,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer AddonManagement_RestrictCrashDetection + LastWrite @@ -8738,10 +10696,11 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer SQM_DisableCEIP + LastWrite - DisableDeletingUserVisitedWebsites + DisableDeletingUserVisitedWebsites @@ -8764,6 +10723,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~DeleteBrowsingHistory DBHDisableDeleteHistory + LastWrite @@ -8790,6 +10750,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~RSS_Feeds Disable_Downloading_of_Enclosures + LastWrite @@ -8816,6 +10777,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_SetWinInetProtocols + LastWrite @@ -8842,6 +10804,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer NoFirstRunCustomise + LastWrite @@ -8868,6 +10831,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_DisableFlipAhead + LastWrite @@ -8894,6 +10858,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer RestrictHomePage + LastWrite @@ -8920,6 +10885,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL NoCertError + LastWrite @@ -8946,6 +10912,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~CategoryPrivacy DisableInPrivateBrowsing + LastWrite @@ -8972,6 +10939,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_EnableEnhancedProtectedMode64Bit + LastWrite @@ -8998,6 +10966,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer RestrictProxy + LastWrite @@ -9024,6 +10993,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer NoSearchProvider + LastWrite @@ -9050,6 +11020,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer SecondaryHomePages + LastWrite @@ -9076,6 +11047,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer Disable_Security_Settings_Check + LastWrite @@ -9102,6 +11074,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_DisableEPMCompat + LastWrite @@ -9128,6 +11101,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement VerMgmtDisable + LastWrite @@ -9154,6 +11128,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement VerMgmtDomainAllowlist + LastWrite @@ -9180,6 +11155,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_IncludeUnspecifiedLocalSites + LastWrite @@ -9206,6 +11182,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_UNCAsIntranet + LastWrite @@ -9232,6 +11209,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyAccessDataSourcesAcrossDomains_1 + LastWrite @@ -9258,6 +11236,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyNotificationBarActiveXURLaction_1 + LastWrite @@ -9284,6 +11263,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyNotificationBarDownloadURLaction_1 + LastWrite @@ -9310,6 +11290,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyAllowPasteViaScript_1 + LastWrite @@ -9336,6 +11317,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyDropOrPasteFiles_1 + LastWrite @@ -9362,6 +11344,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyFontDownload_1 + LastWrite @@ -9388,10 +11371,11 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyZoneElevationURLaction_1 + LastWrite - InternetZoneAllowLoadingOfXAMLFilesWRONG + InternetZoneAllowLoadingOfXAMLFiles @@ -9414,6 +11398,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_Policy_XAML_1 + LastWrite @@ -9440,6 +11425,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyUnsignedFrameworkComponentsURLaction_1 + LastWrite @@ -9464,8 +11450,9 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Intranet + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone + IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet + LastWrite @@ -9490,8 +11477,9 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyAllowTDCControl_Both_LocalMachine + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone + IZ_PolicyAllowTDCControl_Both_Internet + LastWrite @@ -9518,6 +11506,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_Policy_WebBrowserControl_1 + LastWrite @@ -9542,8 +11531,9 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyWindowsRestrictionsURLaction_6 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone + IZ_PolicyWindowsRestrictionsURLaction_1 + LastWrite @@ -9570,6 +11560,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_Policy_AllowScriptlets_1 + LastWrite @@ -9596,6 +11587,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_Policy_Phishing_1 + LastWrite @@ -9622,6 +11614,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_Policy_ScriptStatusBar_1 + LastWrite @@ -9648,10 +11641,11 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyUserdataPersistence_1 + LastWrite - InternetZoneDoNotRunAntimalwareAgainstActiveXControlsWRONG1 + InternetZoneDoNotRunAntimalwareAgainstActiveXControls @@ -9674,32 +11668,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyAntiMalwareCheckingOfActiveXControls_1 - - - - InternetZoneDoNotRunAntimalwareAgainstActiveXControlsWRONG2 - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_3 + LastWrite @@ -9724,8 +11693,9 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyDownloadSignedActiveX_3 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone + IZ_PolicyDownloadSignedActiveX_1 + LastWrite @@ -9752,6 +11722,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyDownloadUnsignedActiveX_1 + LastWrite @@ -9776,8 +11747,9 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyTurnOnXSSFilter_Both_LocalMachine + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone + IZ_PolicyTurnOnXSSFilter_Both_Internet + LastWrite @@ -9804,6 +11776,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet + LastWrite @@ -9830,6 +11803,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet + LastWrite @@ -9856,6 +11830,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyMimeSniffingURLaction_1 + LastWrite @@ -9880,8 +11855,9 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_Policy_TurnOnProtectedMode_2 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone + IZ_Policy_TurnOnProtectedMode_1 + LastWrite @@ -9908,6 +11884,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_Policy_LocalPathForUpload_1 + LastWrite @@ -9934,36 +11911,11 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyScriptActiveXNotMarkedSafe_1 + LastWrite - InternetZoneInitializeAndScriptActiveXControlsNotMarkedSafe - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyScriptActiveXNotMarkedSafe_1 - - - - InternetZoneJavaPermissionsWRONG1 + InternetZoneJavaPermissions @@ -9986,32 +11938,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyJavaPermissions_1 - - - - InternetZoneJavaPermissionsWRONG2 - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyJavaPermissions_3 + LastWrite @@ -10038,6 +11965,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyLaunchAppsAndFilesInIFRAME_1 + LastWrite @@ -10064,6 +11992,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyLogon_1 + LastWrite @@ -10090,6 +12019,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyNavigateSubframesAcrossDomains_1 + LastWrite @@ -10116,6 +12046,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyUnsignedFrameworkComponentsURLaction_1 + LastWrite @@ -10142,6 +12073,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicySignedFrameworkComponentsURLaction_1 + LastWrite @@ -10168,6 +12100,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_Policy_UnsafeFiles_1 + LastWrite @@ -10194,6 +12127,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyBlockPopupWindows_1 + LastWrite @@ -10220,6 +12154,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyZoneElevationURLaction_1 + LastWrite @@ -10246,6 +12181,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyAccessDataSourcesAcrossDomains_3 + LastWrite @@ -10272,6 +12208,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyNotificationBarActiveXURLaction_3 + LastWrite @@ -10298,6 +12235,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyNotificationBarDownloadURLaction_3 + LastWrite @@ -10324,6 +12262,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyFontDownload_3 + LastWrite @@ -10350,6 +12289,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyZoneElevationURLaction_3 + LastWrite @@ -10376,6 +12316,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyUnsignedFrameworkComponentsURLaction_3 + LastWrite @@ -10402,6 +12343,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_Policy_AllowScriptlets_3 + LastWrite @@ -10428,6 +12370,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_Policy_Phishing_3 + LastWrite @@ -10454,6 +12397,34 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyUserdataPersistence_3 + LastWrite + + + + IntranetZoneDoNotRunAntimalwareAgainstActiveXControls + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone + IZ_PolicyAntiMalwareCheckingOfActiveXControls_3 + LastWrite @@ -10480,6 +12451,61 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyScriptActiveXNotMarkedSafe_3 + LastWrite + + + + IntranetZoneInitializeAndScriptActiveXControlsNotMarkedSafe + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone + IZ_PolicyScriptActiveXNotMarkedSafe_3 + LastWrite + + + + IntranetZoneJavaPermissions + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone + IZ_PolicyJavaPermissions_3 + LastWrite @@ -10506,6 +12532,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyNavigateSubframesAcrossDomains_3 + LastWrite @@ -10532,6 +12559,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyAccessDataSourcesAcrossDomains_9 + LastWrite @@ -10558,6 +12586,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyNotificationBarActiveXURLaction_9 + LastWrite @@ -10584,6 +12613,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyNotificationBarDownloadURLaction_9 + LastWrite @@ -10610,6 +12640,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyFontDownload_9 + LastWrite @@ -10636,6 +12667,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyZoneElevationURLaction_9 + LastWrite @@ -10662,6 +12694,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyUnsignedFrameworkComponentsURLaction_9 + LastWrite @@ -10688,6 +12721,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_Policy_AllowScriptlets_9 + LastWrite @@ -10714,6 +12748,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_Policy_Phishing_9 + LastWrite @@ -10740,6 +12775,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyUserdataPersistence_9 + LastWrite @@ -10764,8 +12800,9 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone~IZ_LocalMachineZone + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyAntiMalwareCheckingOfActiveXControls_9 + LastWrite @@ -10792,6 +12829,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyScriptActiveXNotMarkedSafe_9 + LastWrite @@ -10818,6 +12856,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyJavaPermissions_9 + LastWrite @@ -10844,6 +12883,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyNavigateSubframesAcrossDomains_9 + LastWrite @@ -10870,6 +12910,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyAccessDataSourcesAcrossDomains_2 + LastWrite @@ -10896,6 +12937,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyNotificationBarActiveXURLaction_2 + LastWrite @@ -10922,6 +12964,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyNotificationBarDownloadURLaction_2 + LastWrite @@ -10948,6 +12991,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyFontDownload_2 + LastWrite @@ -10974,6 +13018,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyZoneElevationURLaction_2 + LastWrite @@ -11000,6 +13045,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyUnsignedFrameworkComponentsURLaction_2 + LastWrite @@ -11026,6 +13072,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_Policy_AllowScriptlets_2 + LastWrite @@ -11052,6 +13099,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_Policy_Phishing_2 + LastWrite @@ -11078,6 +13126,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyUserdataPersistence_2 + LastWrite @@ -11104,6 +13153,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyScriptActiveXNotMarkedSafe_2 + LastWrite @@ -11130,6 +13180,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyJavaPermissions_2 + LastWrite @@ -11156,6 +13207,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyNavigateSubframesAcrossDomains_2 + LastWrite @@ -11182,6 +13234,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyAccessDataSourcesAcrossDomains_4 + LastWrite @@ -11208,6 +13261,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyNotificationBarActiveXURLaction_4 + LastWrite @@ -11234,6 +13288,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyNotificationBarDownloadURLaction_4 + LastWrite @@ -11260,6 +13315,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyFontDownload_4 + LastWrite @@ -11286,6 +13342,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyZoneElevationURLaction_4 + LastWrite @@ -11312,6 +13369,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyUnsignedFrameworkComponentsURLaction_4 + LastWrite @@ -11338,6 +13396,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_Policy_AllowScriptlets_4 + LastWrite @@ -11364,6 +13423,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_Policy_Phishing_4 + LastWrite @@ -11390,6 +13450,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyUserdataPersistence_4 + LastWrite @@ -11416,6 +13477,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyScriptActiveXNotMarkedSafe_4 + LastWrite @@ -11442,6 +13504,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyNavigateSubframesAcrossDomains_4 + LastWrite @@ -11468,6 +13531,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyAccessDataSourcesAcrossDomains_10 + LastWrite @@ -11494,6 +13558,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyNotificationBarActiveXURLaction_10 + LastWrite @@ -11520,6 +13585,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyNotificationBarDownloadURLaction_10 + LastWrite @@ -11546,6 +13612,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyFontDownload_10 + LastWrite @@ -11572,6 +13639,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyZoneElevationURLaction_10 + LastWrite @@ -11598,6 +13666,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyUnsignedFrameworkComponentsURLaction_10 + LastWrite @@ -11624,6 +13693,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_Policy_AllowScriptlets_10 + LastWrite @@ -11650,6 +13720,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_Policy_Phishing_10 + LastWrite @@ -11676,6 +13747,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyUserdataPersistence_10 + LastWrite @@ -11702,6 +13774,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyScriptActiveXNotMarkedSafe_10 + LastWrite @@ -11728,6 +13801,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyJavaPermissions_10 + LastWrite @@ -11754,6 +13828,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyNavigateSubframesAcrossDomains_10 + LastWrite @@ -11780,6 +13855,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyAccessDataSourcesAcrossDomains_8 + LastWrite @@ -11806,6 +13882,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyNotificationBarActiveXURLaction_8 + LastWrite @@ -11832,6 +13909,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyNotificationBarDownloadURLaction_8 + LastWrite @@ -11858,6 +13936,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyFontDownload_8 + LastWrite @@ -11884,6 +13963,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyZoneElevationURLaction_8 + LastWrite @@ -11910,6 +13990,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyUnsignedFrameworkComponentsURLaction_8 + LastWrite @@ -11936,6 +14017,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_Policy_AllowScriptlets_8 + LastWrite @@ -11962,6 +14044,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_Policy_Phishing_8 + LastWrite @@ -11988,6 +14071,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyUserdataPersistence_8 + LastWrite @@ -12014,6 +14098,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyScriptActiveXNotMarkedSafe_8 + LastWrite @@ -12040,6 +14125,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyJavaPermissions_8 + LastWrite @@ -12066,6 +14152,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyNavigateSubframesAcrossDomains_8 + LastWrite @@ -12092,6 +14179,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyAccessDataSourcesAcrossDomains_6 + LastWrite @@ -12118,6 +14206,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyNotificationBarActiveXURLaction_6 + LastWrite @@ -12144,6 +14233,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyNotificationBarDownloadURLaction_6 + LastWrite @@ -12170,6 +14260,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyFontDownload_6 + LastWrite @@ -12196,6 +14287,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyZoneElevationURLaction_6 + LastWrite @@ -12222,6 +14314,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyUnsignedFrameworkComponentsURLaction_6 + LastWrite @@ -12248,6 +14341,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_Policy_AllowScriptlets_6 + LastWrite @@ -12274,6 +14368,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_Policy_Phishing_6 + LastWrite @@ -12300,6 +14395,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyUserdataPersistence_6 + LastWrite @@ -12326,6 +14422,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyScriptActiveXNotMarkedSafe_6 + LastWrite @@ -12352,6 +14449,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyJavaPermissions_6 + LastWrite @@ -12378,6 +14476,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyNavigateSubframesAcrossDomains_6 + LastWrite @@ -12404,6 +14503,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryMimeSniffingSafetyFeature IESF_PolicyExplorerProcesses_6 + LastWrite @@ -12430,6 +14530,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryMKProtocolSecurityRestriction IESF_PolicyExplorerProcesses_3 + LastWrite @@ -12456,6 +14557,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryInformationBar IESF_PolicyExplorerProcesses_10 + LastWrite @@ -12480,8 +14582,9 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyDownloadSignedActiveX_1 + inetres~AT~WindowsComponents~InternetExplorer + Disable_Managing_Safety_Filter_IE9 + LastWrite @@ -12508,6 +14611,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer DisablePerUserActiveXInstall + LastWrite @@ -12534,6 +14638,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryProtectionFromZoneElevation IESF_PolicyAllProcesses_9 + LastWrite @@ -12560,6 +14665,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement VerMgmtDisableRunThisTime + LastWrite @@ -12586,6 +14692,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictActiveXInstall IESF_PolicyAllProcesses_11 + LastWrite @@ -12612,6 +14719,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyAccessDataSourcesAcrossDomains_7 + LastWrite @@ -12636,8 +14744,9 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyActiveScripting_1 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyActiveScripting_7 + LastWrite @@ -12664,6 +14773,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyNotificationBarActiveXURLaction_7 + LastWrite @@ -12690,6 +14800,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyNotificationBarDownloadURLaction_7 + LastWrite @@ -12714,8 +14825,9 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyBinaryBehaviors_1 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyBinaryBehaviors_7 + LastWrite @@ -12742,6 +14854,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyAllowPasteViaScript_7 + LastWrite @@ -12768,6 +14881,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyDropOrPasteFiles_7 + LastWrite @@ -12792,12 +14906,13 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyFileDownload_1 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyFileDownload_7 + LastWrite - RestrictedSitesZoneAllowFontDownloadsWRONG1 + RestrictedSitesZoneAllowFontDownloads @@ -12820,32 +14935,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyFontDownload_7 - - - - RestrictedSitesZoneAllowFontDownloadsWRONG2 - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyFontDownload_1 + LastWrite @@ -12872,6 +14962,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyZoneElevationURLaction_7 + LastWrite @@ -12898,6 +14989,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_XAML_7 + LastWrite @@ -12922,8 +15014,9 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyAllowMETAREFRESH_1 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyAllowMETAREFRESH_7 + LastWrite @@ -12950,6 +15043,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyUnsignedFrameworkComponentsURLaction_7 + LastWrite @@ -12976,6 +15070,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted + LastWrite @@ -13002,6 +15097,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyAllowTDCControl_Both_Restricted + LastWrite @@ -13028,6 +15124,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_WebBrowserControl_7 + LastWrite @@ -13054,6 +15151,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyWindowsRestrictionsURLaction_7 + LastWrite @@ -13080,6 +15178,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_AllowScriptlets_7 + LastWrite @@ -13106,6 +15205,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_Phishing_7 + LastWrite @@ -13132,6 +15232,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_ScriptStatusBar_7 + LastWrite @@ -13158,6 +15259,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyUserdataPersistence_7 + LastWrite @@ -13184,6 +15286,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyAntiMalwareCheckingOfActiveXControls_7 + LastWrite @@ -13210,6 +15313,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyDownloadSignedActiveX_7 + LastWrite @@ -13236,6 +15340,34 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyDownloadUnsignedActiveX_7 + LastWrite + + + + RestrictedSitesZoneEnableCrossSiteScriptingFilter + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyTurnOnXSSFilter_Both_Restricted + LastWrite @@ -13262,6 +15394,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted + LastWrite @@ -13288,6 +15421,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted + LastWrite @@ -13314,6 +15448,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyMimeSniffingURLaction_7 + LastWrite @@ -13340,6 +15475,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_LocalPathForUpload_7 + LastWrite @@ -13366,6 +15502,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyScriptActiveXNotMarkedSafe_7 + LastWrite @@ -13392,6 +15529,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyJavaPermissions_7 + LastWrite @@ -13418,6 +15556,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyLaunchAppsAndFilesInIFRAME_7 + LastWrite @@ -13444,6 +15583,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyLogon_7 + LastWrite @@ -13470,6 +15610,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyNavigateSubframesAcrossDomains_7 + LastWrite @@ -13494,8 +15635,9 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyNavigateSubframesAcrossDomains_1 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyNavigateSubframesAcrossDomains_7 + LastWrite @@ -13520,8 +15662,9 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyRunActiveXControls_1 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyRunActiveXControls_7 + LastWrite @@ -13548,6 +15691,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicySignedFrameworkComponentsURLaction_7 + LastWrite @@ -13572,12 +15716,13 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyScriptActiveXMarkedSafe_1 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyScriptActiveXMarkedSafe_7 + LastWrite - RestrictedSitesZoneWRONG + RestrictedSitesZoneScriptingOfJavaApplets @@ -13598,12 +15743,13 @@ The XML below is the DDF for Windows 10, version 1709. phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyScriptingOfJavaApplets_6 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyScriptingOfJavaApplets_7 + LastWrite - RestrictedSitesZoneWRONG2 + RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles @@ -13626,10 +15772,11 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_UnsafeFiles_7 + LastWrite - RestrictedSitesZoneWRONG3 + RestrictedSitesZoneTurnOnCrossSiteScriptingFilter @@ -13652,10 +15799,11 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyTurnOnXSSFilter_Both_Restricted + LastWrite - RestrictedSitesZoneWRONG4 + RestrictedSitesZoneTurnOnProtectedMode @@ -13678,10 +15826,11 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_TurnOnProtectedMode_7 + LastWrite - RestrictedSitesZoneWRONG5 + RestrictedSitesZoneUsePopupBlocker @@ -13704,6 +15853,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyBlockPopupWindows_7 + LastWrite @@ -13730,6 +15880,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictFileDownload IESF_PolicyAllProcesses_12 + LastWrite @@ -13756,6 +15907,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryScriptedWindowSecurityRestrictions IESF_PolicyAllProcesses_8 + LastWrite @@ -13782,6 +15934,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer SpecificSearchProvider + LastWrite @@ -13808,6 +15961,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer OnlyUseAXISForActiveXInstall + LastWrite @@ -13834,6 +15988,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyAccessDataSourcesAcrossDomains_5 + LastWrite @@ -13860,6 +16015,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyNotificationBarActiveXURLaction_5 + LastWrite @@ -13886,6 +16042,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyNotificationBarDownloadURLaction_5 + LastWrite @@ -13912,6 +16069,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyFontDownload_5 + LastWrite @@ -13938,6 +16096,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyZoneElevationURLaction_5 + LastWrite @@ -13964,6 +16123,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyUnsignedFrameworkComponentsURLaction_5 + LastWrite @@ -13990,6 +16150,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_Policy_AllowScriptlets_5 + LastWrite @@ -14016,6 +16177,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_Policy_Phishing_5 + LastWrite @@ -14042,6 +16204,61 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyUserdataPersistence_5 + LastWrite + + + + TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone + IZ_PolicyAntiMalwareCheckingOfActiveXControls_5 + LastWrite + + + + TrustedSitesZoneDontRunAntimalwareProgramsAgainstActiveXControls + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone + IZ_PolicyAntiMalwareCheckingOfActiveXControls_5 + LastWrite @@ -14068,6 +16285,61 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyScriptActiveXNotMarkedSafe_5 + LastWrite + + + + TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedAsSafe + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone + IZ_PolicyScriptActiveXNotMarkedSafe_5 + LastWrite + + + + TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedSafe + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone + IZ_PolicyScriptActiveXNotMarkedSafe_5 + LastWrite @@ -14094,6 +16366,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyJavaPermissions_5 + LastWrite @@ -14120,58 +16393,7 @@ The XML below is the DDF for Windows 10, version 1709. inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyNavigateSubframesAcrossDomains_5 - - - - TrustedSitesZoneWRONG1 - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_5 - - - - TrustedSitesZoneWRONG2 - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyScriptActiveXNotMarkedSafe_5 + LastWrite @@ -14214,6 +16436,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + LowestValueMostSecure @@ -14260,6 +16483,7 @@ The XML below is the DDF for Windows 10, version 1709. Printing.admx Printing~AT~ControlPanel~CplPrinters PointAndPrint_Restrictions + LastWrite @@ -14302,6 +16526,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + LastWrite @@ -14345,6 +16570,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain phone + LastWrite @@ -14387,6 +16613,7 @@ The XML below is the DDF for Windows 10, version 1709. text/plain + LowestValueMostSecure @@ -14642,87 +16869,6 @@ The XML below is the DDF for Windows 10, version 1709. - - AccountPolicies - - - - - - - - - - - - - - - - - - - - - MinDevicePasswordLength - - - - - - - - This security setting determines the least number of characters that a password for a user account may contain. You can set a value of between 1 and 14 characters, or you can establish that no password is required by setting the number of characters to 0. - - - - - - - - - - - text/plain - - - - - PasswordMustMeetComplexityRequirement - - - - - - - - This security setting determines whether passwords must meet complexity requirements. - -If this policy is enabled, passwords must meet the following minimum requirements: - -Not contain the user's account name or parts of the user's full name that exceed two consecutive characters -Be at least six characters in length -Contain characters from three of the following four categories: -English uppercase characters (A through Z) -English lowercase characters (a through z) -Base 10 digits (0 through 9) -Non-alphabetic characters (for example, !, $, #, %) -Complexity requirements are enforced when passwords are changed or created. - - - - - - - - - - - text/plain - - - - Accounts @@ -15910,6 +18056,30 @@ Complexity requirements are enforced when passwords are changed or created. + + AllowAadPasswordReset + + + + + + + + Specifies whether password reset is enabled for AAD accounts. + + + + + + + + + + + text/plain + + + AllowFastReconnect @@ -16537,7 +18707,7 @@ Complexity requirements are enforced when passwords are changed or created. This policy setting lets you decide whether the Microsoft Compatibility List is enabled or disabled in Microsoft Edge. This feature uses a Microsoft-provided list to ensure that any sites with known compatibility issues are displayed correctly when a user navigates to them. By default, the Microsoft Compatibility List is enabled and can be viewed by navigating to about:compat. -If you enable or don’t configure this setting, Microsoft Edge will periodically download the latest version of the list from Microsoft and will apply the configurations specified there during browser navigation. If a user visits a site on the Microsoft Compatibility List, he or she will be prompted to open the site in Internet Explorer 11. Once in Internet Explorer, the site will automatically be rendered as if the user is viewing it in the previous version of Internet Explorer it requires to display correctly. +If you enable or don’t configure this setting, Microsoft Edge will periodically download the latest version of the list from Microsoft and will apply the configurations specified there during browser navigation. If a user visits a site on the Microsoft Compatibility List, he or she will be prompted to open the site in Internet Explorer 11. Once in Internet Explorer, the site will automatically be rendered as if the user is viewing it in the previous version of Internet Explorer it requires to display correctly. If you disable this setting, the Microsoft Compatibility List will not be used during browser navigation. @@ -16679,6 +18849,30 @@ This policy will only apply on domain joined machines or when the device is MDM + + AlwaysEnableBooksLibrary + + + + + + + + Specifies whether the Books Library in Microsoft Edge will always be visible regardless of the country or region setting for the device. + + + + + + + + + + + text/plain + + + ClearBrowsingDataOnExit @@ -16848,7 +19042,7 @@ Example: If you wanted to allow contoso.com and fabrikam.com then you would append /support to the site strings like contoso.com/support and fabrikam.com/support. Encapsulate each string with greater than and less than characters like any other XML tag. -Version 1703 or later:  If you don't want to send traffic to Microsoft, you can use the about:blank value (encapsulate with greater than and less than characters like any other XML tag), which is honored for both domain- and non-domain-joined machines, when it's the only configured URL. +Version 1703 or later:  If you don't want to send traffic to Microsoft, you can use the about:blank value (encapsulate with greater than and less than characters like any other XML tag), which is honored for both domain- and non-domain-joined machines, when it's the only configured URL. @@ -16863,6 +19057,37 @@ Version 1703 or later:  If you don't want to send traffic to Microsoft, yo + + LockdownFavorites + + + + + + + + This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge. + +If you enable this setting, employees won't be able to add, import, or change anything in the Favorites list. Also as part of this, Save a Favorite, Import settings, and the context menu items (such as, Create a new folder) are all turned off. + +Important +Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. + +If you disable or don't configure this setting (default), employees can add, import and make changes to the Favorites list. + + + + + + + + + + + text/plain + + + PreventAccessToAboutFlagsInMicrosoftEdge @@ -17011,6 +19236,37 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + ProvisionFavorites + + + + + + + + This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. + +If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites. + +Important +Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. + +If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar. + + + + + + + + + + + text/plain + + + SendIntranetTraffictoInternetExplorer @@ -17181,6 +19437,102 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + LetAppsAccessCellularData + + + + + + + + This policy setting specifies whether Windows apps can access cellular data. + + + + + + + + + + + text/plain + + + + + LetAppsAccessCellularData_ForceAllowTheseApps + + + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + + + + + + + + + + + text/plain + + + + + LetAppsAccessCellularData_ForceDenyTheseApps + + + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + + + + + + + + + + + text/plain + + + + + LetAppsAccessCellularData_UserInControlOfTheseApps + + + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + + + + + + + + + + + text/plain + + + ShowAppCellularAccessUI @@ -17633,6 +19985,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + EnableWindowsAutoPilotResetCredentials + + + + + + + + + + + + + + + + + + + text/plain + + + CredentialsUI @@ -18845,6 +21221,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + DOCacheHost + + + + + + + + + + + + + + + + + + + text/plain + + + DODownloadMode @@ -19520,7 +21920,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Specifies how many passwords can be stored in the history that can’t be used. + Specifies how many passwords can be stored in the history that can’t be used. @@ -20468,6 +22868,52 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + ExploitGuard + + + + + + + + + + + + + + + + + + + + + ExploitProtectionSettings + + + + + + + + + + + + + + + + + + + text/plain + + + + Games @@ -20514,6 +22960,52 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + Handwriting + + + + + + + + + + + + + + + + + + + + + PanelDefaultModeDocked + + + + + + + + Specifies whether the handwriting panel comes up floating near the text box or attached to the bottom of the screen + + + + + + + + + + + text/plain + + + + InternetExplorer @@ -20752,7 +23244,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - AllowInternetExplorer7PolicyList + AllowInternetExplorer7PolicyList @@ -21376,7 +23868,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - DisableDeletingUserVisitedWebsites + DisableDeletingUserVisitedWebsites @@ -22024,7 +24516,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - InternetZoneAllowLoadingOfXAMLFilesWRONG + InternetZoneAllowLoadingOfXAMLFiles @@ -22264,31 +24756,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - InternetZoneDoNotRunAntimalwareAgainstActiveXControlsWRONG1 - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneDoNotRunAntimalwareAgainstActiveXControlsWRONG2 + InternetZoneDoNotRunAntimalwareAgainstActiveXControls @@ -22528,55 +24996,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - InternetZoneInitializeAndScriptActiveXControlsNotMarkedSafe - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneJavaPermissionsWRONG1 - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneJavaPermissionsWRONG2 + InternetZoneJavaPermissions @@ -23007,6 +25427,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + IntranetZoneDoNotRunAntimalwareAgainstActiveXControls + + + + + + + + + + + + + + + + + + + text/plain + + + IntranetZoneInitializeAndScriptActiveXControls @@ -23031,6 +25475,54 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + IntranetZoneInitializeAndScriptActiveXControlsNotMarkedSafe + + + + + + + + + + + + + + + + + + + text/plain + + + + + IntranetZoneJavaPermissions + + + + + + + + + + + + + + + + + + + text/plain + + + IntranetZoneNavigateWindowsAndFrames @@ -25168,31 +27660,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - RestrictedSitesZoneAllowFontDownloadsWRONG1 - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowFontDownloadsWRONG2 + RestrictedSitesZoneAllowFontDownloads @@ -25575,6 +28043,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + RestrictedSitesZoneEnableCrossSiteScriptingFilter + + + + + + + + + + + + + + + + + + + text/plain + + + RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows @@ -25888,7 +28380,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - RestrictedSitesZoneWRONG + RestrictedSitesZoneScriptingOfJavaApplets @@ -25912,7 +28404,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - RestrictedSitesZoneWRONG2 + RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles @@ -25936,7 +28428,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - RestrictedSitesZoneWRONG3 + RestrictedSitesZoneTurnOnCrossSiteScriptingFilter @@ -25960,7 +28452,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - RestrictedSitesZoneWRONG4 + RestrictedSitesZoneTurnOnProtectedMode @@ -25984,7 +28476,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - RestrictedSitesZoneWRONG5 + RestrictedSitesZoneUsePopupBlocker @@ -26080,7 +28572,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - SecurityZonesUseOnlyMachineSettings + SecurityZonesUseOnlyMachineSettings @@ -26343,6 +28835,54 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls + + + + + + + + + + + + + + + + + + + text/plain + + + + + TrustedSitesZoneDontRunAntimalwareProgramsAgainstActiveXControls + + + + + + + + + + + + + + + + + + + text/plain + + + TrustedSitesZoneInitializeAndScriptActiveXControls @@ -26367,6 +28907,54 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedAsSafe + + + + + + + + + + + + + + + + + + + text/plain + + + + + TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedSafe + + + + + + + + + + + + + + + + + + + text/plain + + + TrustedSitesZoneJavaPermissions @@ -26415,54 +29003,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - - TrustedSitesZoneWRONG1 - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneWRONG2 - - - - - - - - - - - - - - - - - - - text/plain - - - Kerberos @@ -26708,9 +29248,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor This policy setting prevents users from adding new Microsoft accounts on this computer. -If you select the "Users can’t add Microsoft accounts" option, users will not be able to create new Microsoft accounts on this computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. +If you select the "Users can’t add Microsoft accounts" option, users will not be able to create new Microsoft accounts on this computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. -If you select the "Users can’t add or log on with Microsoft accounts" option, existing Microsoft account users will not be able to log on to Windows. Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system. +If you select the "Users can’t add or log on with Microsoft accounts" option, existing Microsoft account users will not be able to log on to Windows. Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system. If you disable or do not configure this policy (recommended), users will be able to use Microsoft accounts with Windows. @@ -26883,6 +29423,130 @@ Default: Guest. + + Devices_AllowedToFormatAndEjectRemovableMedia + + + + + + + + Devices: Allowed to format and eject removable media + +This security setting determines who is allowed to format and eject removable NTFS media. This capability can be given to: + +Administrators +Administrators and Interactive Users + +Default: This policy is not defined and only Administrators have this ability. + + + + + + + + + + + text/plain + + + + + Devices_AllowUndockWithoutHavingToLogon + + + + + + + + Devices: Allow undock without having to log on +This security setting determines whether a portable computer can be undocked without having to log on. If this policy is enabled, logon is not required and an external hardware eject button can be used to undock the computer. If disabled, a user must log on and have the Remove computer from docking station privilege to undock the computer. +Default: Enabled. + +Caution +Disabling this policy may tempt users to try and physically remove the laptop from its docking station using methods other than the external hardware eject button. Since this may cause damage to the hardware, this setting, in general, should only be disabled on laptop configurations that are physically securable. + + + + + + + + + + + text/plain + + + + + Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters + + + + + + + + Devices: Prevent users from installing printer drivers when connecting to shared printers + +For a computer to print to a shared printer, the driver for that shared printer must be installed on the local computer. This security setting determines who is allowed to install a printer driver as part of connecting to a shared printer. If this setting is enabled, only Administrators can install a printer driver as part of connecting to a shared printer. If this setting is disabled, any user can install a printer driver as part of connecting to a shared printer. + +Default on servers: Enabled. +Default on workstations: Disabled + +Notes + +This setting does not affect the ability to add a local printer. +This setting does not affect Administrators. + + + + + + + + + + + text/plain + + + + + Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly + + + + + + + + Devices: Restrict CD-ROM access to locally logged-on user only + +This security setting determines whether a CD-ROM is accessible to both local and remote users simultaneously. + +If this policy is enabled, it allows only the interactively logged-on user to access removable CD-ROM media. If this policy is enabled and no one is logged on interactively, the CD-ROM can be accessed over the network. + +Default: This policy is not defined and CD-ROM access is not restricted to the locally logged-on user. + + + + + + + + + + + text/plain + + + InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked @@ -26911,7 +29575,7 @@ Do not display user information (3) - Interactivelogon_DoNotDisplayLastSignedIn + InteractiveLogon_DoNotDisplayLastSignedIn @@ -26941,7 +29605,7 @@ Default: Disabled. - Interactivelogon_DoNotDisplayUsernameAtSignIn + InteractiveLogon_DoNotDisplayUsernameAtSignIn @@ -26971,7 +29635,7 @@ Default: Disabled. - Interactivelogon_DoNotRequireCTRLALTDEL + InteractiveLogon_DoNotRequireCTRLALTDEL @@ -27233,6 +29897,39 @@ Default: This policy is not defined and automatic administrative logon is not al + + Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn + + + + + + + + Shutdown: Allow system to be shut down without having to log on + +This security setting determines whether a computer can be shut down without having to log on to Windows. + +When this policy is enabled, the Shut Down command is available on the Windows logon screen. + +When this policy is disabled, the option to shut down the computer does not appear on the Windows logon screen. In this case, users must be able to log on to the computer successfully and have the Shut down the system user right before they can perform a system shutdown. + +Default on workstations: Enabled. +Default on servers: Disabled. + + + + + + + + + + + text/plain + + + Shutdown_ClearVirtualMemoryPageFile @@ -27278,9 +29975,9 @@ Default: Disabled. This policy setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts used by a standard user. -• Enabled: UIA programs, including Windows Remote Assistance, automatically disable the secure desktop for elevation prompts. If you do not disable the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting, the prompts appear on the interactive user's desktop instead of the secure desktop. +• Enabled: UIA programs, including Windows Remote Assistance, automatically disable the secure desktop for elevation prompts. If you do not disable the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting, the prompts appear on the interactive user's desktop instead of the secure desktop. -• Disabled: (Default) The secure desktop can be disabled only by the user of the interactive desktop or by disabling the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting. +• Disabled: (Default) The secure desktop can be disabled only by the user of the interactive desktop or by disabling the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting. @@ -27310,17 +30007,17 @@ This policy setting controls the behavior of the elevation prompt for administra The options are: -• Elevate without prompting: Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials. Note: Use this option only in the most constrained environments. +• Elevate without prompting: Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials. Note: Use this option only in the most constrained environments. -• Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. +• Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. -• Prompt for consent on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. +• Prompt for consent on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. -• Prompt for credentials: When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. +• Prompt for credentials: When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. -• Prompt for consent: When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. +• Prompt for consent: When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. -• Prompt for consent for non-Windows binaries: (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. +• Prompt for consent for non-Windows binaries: (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. @@ -27349,11 +30046,43 @@ This policy setting controls the behavior of the elevation prompt for standard u The options are: -• Prompt for credentials: (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. +• Prompt for credentials: (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. -• Automatically deny elevation requests: When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls. +• Automatically deny elevation requests: When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls. -• Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. +• Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. + + + + + + + + + + + text/plain + + + + + UserAccountControl_DetectApplicationInstallationsAndPromptForElevation + + + + + + + + User Account Control: Detect application installations and prompt for elevation + +This policy setting controls the behavior of application installation detection for the computer. + +The options are: + +Enabled: (Default) When an application installation package is detected that requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. + +Disabled: Application installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies such as Group Policy Software Installation or Systems Management Server (SMS) should disable this policy setting. In this case, installer detection is unnecessary. @@ -27383,9 +30112,9 @@ This policy setting enforces public key infrastructure (PKI) signature checks fo The options are: -• Enabled: Enforces the PKI certification path validation for a given executable file before it is permitted to run. +• Enabled: Enforces the PKI certification path validation for a given executable file before it is permitted to run. -• Disabled: (Default) Does not enforce PKI certification path validation before a given executable file is permitted to run. +• Disabled: (Default) Does not enforce PKI certification path validation before a given executable file is permitted to run. @@ -27413,17 +30142,17 @@ The options are: This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following: -- …\Program Files\, including subfolders -- …\Windows\system32\ -- …\Program Files (x86)\, including subfolders for 64-bit versions of Windows +- …\Program Files\, including subfolders +- …\Windows\system32\ +- …\Program Files (x86)\, including subfolders for 64-bit versions of Windows Note: Windows enforces a public key infrastructure (PKI) signature check on any interactive application that requests to run with a UIAccess integrity level regardless of the state of this security setting. The options are: -• Enabled: (Default) If an application resides in a secure location in the file system, it runs only with UIAccess integrity. +• Enabled: (Default) If an application resides in a secure location in the file system, it runs only with UIAccess integrity. -• Disabled: An application runs with UIAccess integrity even if it does not reside in a secure location in the file system. +• Disabled: An application runs with UIAccess integrity even if it does not reside in a secure location in the file system. @@ -27453,9 +30182,9 @@ This policy setting controls the behavior of all User Account Control (UAC) poli The options are: -• Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. +• Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. -• Disabled: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. +• Disabled: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. @@ -27485,9 +30214,9 @@ This policy setting controls whether the elevation request prompt is displayed o The options are: -• Enabled: (Default) All elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users. +• Enabled: (Default) All elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users. -• Disabled: All elevation requests go to the interactive user's desktop. Prompt behavior policy settings for administrators and standard users are used. +• Disabled: All elevation requests go to the interactive user's desktop. Prompt behavior policy settings for administrators and standard users are used. @@ -27517,9 +30246,9 @@ This policy setting controls the behavior of Admin Approval Mode for the built-i The options are: -• Enabled: The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation. +• Enabled: The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation. -• Disabled: (Default) The built-in Administrator account runs all applications with full administrative privilege. +• Disabled: (Default) The built-in Administrator account runs all applications with full administrative privilege. @@ -27549,9 +30278,9 @@ This policy setting controls whether application write failures are redirected t The options are: -• Enabled: (Default) Application write failures are redirected at run time to defined user locations for both the file system and registry. +• Enabled: (Default) Application write failures are redirected at run time to defined user locations for both the file system and registry. -• Disabled: Applications that write data to protected locations fail. +• Disabled: Applications that write data to protected locations fail. @@ -28846,102 +31575,6 @@ The options are: - - LetAppsAccessCellularData - - - - - - - - This policy setting specifies whether Windows apps can access cellular data. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCellularData_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCellularData_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCellularData_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data privacy setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. - - - - - - - - - - - text/plain - - - LetAppsAccessContacts @@ -30199,7 +32832,7 @@ The options are: - This policy setting specifies whether Windows apps can sync with devices. + This policy setting specifies whether Windows apps can communicate with unpaired wireless devices. @@ -30223,7 +32856,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -30247,7 +32880,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -30271,7 +32904,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'sync with devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -31258,6 +33891,30 @@ The options are: + + AllowCloudSearch + + + + + + + + + + + + + + + + + + + text/plain + + + AllowIndexingEncryptedStoresOrItems @@ -32950,6 +35607,30 @@ The options are: + + AllowDiskHealthModelUpdates + + + + + + + + + + + + + + + + + + + text/plain + + + EnhancedStorageDevices @@ -33221,7 +35902,7 @@ The options are: - This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Windows Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. + This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Windows Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. @@ -33260,6 +35941,30 @@ The options are: + + FeedbackHubAlwaysSaveDiagnosticsLocally + + + + + + + + Diagnostic files created when a feedback is filed in the Feedback Hub app will always be saved locally. If this policy is not present or set to false, users will be presented with the option to save locally. The default is to not save locally. + + + + + + + + + + + text/plain + + + TelemetryProxy @@ -34070,6 +36775,30 @@ The options are: + + DisableDualScan + + + + + + + + Do not allow update deferral policies to cause scans against Windows Update + + + + + + + + + + + text/plain + + + EngagedRestartDeadline @@ -34239,7 +36968,7 @@ The options are: - ManageBuildPreview + ManagePreviewBuilds @@ -35739,6 +38468,7 @@ The options are: text/plain desktop + LowestValueMostSecure @@ -35761,6 +38491,7 @@ The options are: text/plain + LowestValueMostSecure @@ -35783,83 +38514,7 @@ The options are: text/plain - - - - - AccountPolicies - - - - - - - - - - - - - - - - - - - MinDevicePasswordLength - - - - - This security setting determines the least number of characters that a password for a user account may contain. You can set a value of between 1 and 14 characters, or you can establish that no password is required by setting the number of characters to 0. - 7 - - - - - - - - - - - text/plain - - phone - - - - PasswordMustMeetComplexityRequirement - - - - - This security setting determines whether passwords must meet complexity requirements. - -If this policy is enabled, passwords must meet the following minimum requirements: - -Not contain the user's account name or parts of the user's full name that exceed two consecutive characters -Be at least six characters in length -Contain characters from three of the following four categories: -English uppercase characters (A through Z) -English lowercase characters (a through z) -Base 10 digits (0 through 9) -Non-alphabetic characters (for example, !, $, #, %) -Complexity requirements are enforced when passwords are changed or created. - 0 - - - - - - - - - - - text/plain - - phone + LowestValueMostSecure @@ -35902,6 +38557,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -35924,6 +38580,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -35946,6 +38603,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LastWrite @@ -35968,6 +38626,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LastWrite @@ -36014,6 +38673,7 @@ Complexity requirements are enforced when passwords are changed or created.ActiveXInstallService.admx ActiveXInstallService~AT~WindowsComponents~AxInstSv ApprovedActiveXInstallSites + LastWrite @@ -36057,6 +38717,7 @@ Complexity requirements are enforced when passwords are changed or created.text/plain phone + LastWrite @@ -36099,6 +38760,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -36121,6 +38783,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -36143,6 +38806,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -36166,6 +38830,7 @@ Complexity requirements are enforced when passwords are changed or created.text/plain phone + LowestValueMostSecure @@ -36188,6 +38853,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -36211,6 +38877,7 @@ Complexity requirements are enforced when passwords are changed or created.text/plain desktop + LowestValueMostSecure @@ -36234,6 +38901,7 @@ Complexity requirements are enforced when passwords are changed or created.text/plain desktop + LastWrite @@ -36256,6 +38924,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -36278,6 +38947,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -36300,6 +38970,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -36346,6 +39017,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV EnableAppV + LastWrite @@ -36372,6 +39044,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Virtualization Virtualization_JITVEnable + LastWrite @@ -36398,6 +39071,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_PackageManagement PackageManagement_AutoCleanupEnable + LastWrite @@ -36424,6 +39098,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Scripting Scripting_Enable_Package_Scripts + LastWrite @@ -36450,6 +39125,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Publishing Enable_Publishing_Refresh_UX + LastWrite @@ -36476,6 +39152,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Reporting Reporting_Server_Policy + LastWrite @@ -36502,6 +39179,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Integration Integration_Roaming_File_Exclusions + LastWrite @@ -36528,6 +39206,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Integration Integration_Roaming_Registry_Exclusions + LastWrite @@ -36554,6 +39233,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Streaming Steaming_Autoload + LastWrite @@ -36580,6 +39260,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Client_Coexistence Client_Coexistence_Enable_Migration_mode + LastWrite @@ -36606,6 +39287,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Integration Integration_Root_User + LastWrite @@ -36632,6 +39314,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Integration Integration_Root_Global + LastWrite @@ -36658,6 +39341,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Publishing Publishing_Server1_Policy + LastWrite @@ -36684,6 +39368,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Publishing Publishing_Server2_Policy + LastWrite @@ -36710,6 +39395,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Publishing Publishing_Server3_Policy + LastWrite @@ -36736,6 +39422,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Publishing Publishing_Server4_Policy + LastWrite @@ -36762,6 +39449,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Publishing Publishing_Server5_Policy + LastWrite @@ -36788,6 +39476,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Streaming Streaming_Certificate_Filter_For_Client_SSL + LastWrite @@ -36814,6 +39503,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Streaming Streaming_Allow_High_Cost_Launch + LastWrite @@ -36840,6 +39530,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Streaming Streaming_Location_Provider + LastWrite @@ -36866,6 +39557,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Streaming Streaming_Package_Installation_Root + LastWrite @@ -36892,6 +39584,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Streaming Streaming_Package_Source_Root + LastWrite @@ -36918,6 +39611,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Streaming Streaming_Reestablishment_Interval + LastWrite @@ -36944,6 +39638,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Streaming Streaming_Reestablishment_Retries + LastWrite @@ -36970,6 +39665,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Streaming Streaming_Shared_Content_Store_Mode + LastWrite @@ -36996,6 +39692,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Streaming Streaming_Support_Branch_Cache + LastWrite @@ -37022,6 +39719,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Streaming Streaming_Verify_Certificate_Revocation_List + LastWrite @@ -37048,6 +39746,7 @@ Complexity requirements are enforced when passwords are changed or created.appv.admx appv~AT~System~CAT_AppV~CAT_Virtualization Virtualization_JITVAllowList + LastWrite @@ -37070,6 +39769,30 @@ Complexity requirements are enforced when passwords are changed or created. + + AllowAadPasswordReset + + + + + Specifies whether password reset is enabled for AAD accounts. + 0 + + + + + + + + + + + text/plain + + phone + LowestValueMostSecure + + AllowFastReconnect @@ -37090,6 +39813,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -37113,6 +39837,7 @@ Complexity requirements are enforced when passwords are changed or created.text/plain phone + LowestValueMostSecure @@ -37135,6 +39860,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -37181,6 +39907,7 @@ Complexity requirements are enforced when passwords are changed or created.AutoPlay.admx AutoPlay~AT~WindowsComponents~AutoPlay NoAutoplayfornonVolume + LastWrite @@ -37207,6 +39934,7 @@ Complexity requirements are enforced when passwords are changed or created.AutoPlay.admx AutoPlay~AT~WindowsComponents~AutoPlay NoAutorun + LastWrite @@ -37233,6 +39961,7 @@ Complexity requirements are enforced when passwords are changed or created.AutoPlay.admx AutoPlay~AT~WindowsComponents~AutoPlay Autorun + LastWrite @@ -37275,6 +40004,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LastWrite @@ -37317,6 +40047,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -37339,6 +40070,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -37361,6 +40093,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -37383,6 +40116,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LastWrite @@ -37405,6 +40139,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LastWrite @@ -37448,6 +40183,7 @@ Complexity requirements are enforced when passwords are changed or created.text/plain phone + LowestValueMostSecure @@ -37470,6 +40206,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -37493,6 +40230,7 @@ Complexity requirements are enforced when passwords are changed or created.text/plain desktop + LowestValueMostSecure @@ -37515,6 +40253,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -37538,6 +40277,7 @@ Complexity requirements are enforced when passwords are changed or created.text/plain phone + LowestValueMostSecure @@ -37560,6 +40300,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -37583,6 +40324,7 @@ Complexity requirements are enforced when passwords are changed or created.text/plain phone + LowestValueMostSecure @@ -37606,6 +40348,7 @@ Complexity requirements are enforced when passwords are changed or created.text/plain phone + HighestValueMostSecure @@ -37629,6 +40372,7 @@ Complexity requirements are enforced when passwords are changed or created.text/plain phone + HighestValueMostSecure @@ -37651,6 +40395,7 @@ Complexity requirements are enforced when passwords are changed or created. text/plain + LowestValueMostSecure @@ -37661,7 +40406,7 @@ Complexity requirements are enforced when passwords are changed or created. This policy setting lets you decide whether the Microsoft Compatibility List is enabled or disabled in Microsoft Edge. This feature uses a Microsoft-provided list to ensure that any sites with known compatibility issues are displayed correctly when a user navigates to them. By default, the Microsoft Compatibility List is enabled and can be viewed by navigating to about:compat. -If you enable or don’t configure this setting, Microsoft Edge will periodically download the latest version of the list from Microsoft and will apply the configurations specified there during browser navigation. If a user visits a site on the Microsoft Compatibility List, he or she will be prompted to open the site in Internet Explorer 11. Once in Internet Explorer, the site will automatically be rendered as if the user is viewing it in the previous version of Internet Explorer it requires to display correctly. +If you enable or don’t configure this setting, Microsoft Edge will periodically download the latest version of the list from Microsoft and will apply the configurations specified there during browser navigation. If a user visits a site on the Microsoft Compatibility List, he or she will be prompted to open the site in Internet Explorer 11. Once in Internet Explorer, the site will automatically be rendered as if the user is viewing it in the previous version of Internet Explorer it requires to display correctly. If you disable this setting, the Microsoft Compatibility List will not be used during browser navigation. 1 @@ -37677,6 +40422,7 @@ If you disable this setting, the Microsoft Compatibility List will not be used d text/plain + LowestValueMostSecure @@ -37699,6 +40445,7 @@ If you disable this setting, the Microsoft Compatibility List will not be used d text/plain + LowestValueMostSecure @@ -37722,6 +40469,7 @@ If you disable this setting, the Microsoft Compatibility List will not be used d text/plain phone + LowestValueMostSecure @@ -37749,6 +40497,7 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + LowestValueMostSecure @@ -37771,6 +40520,7 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + LowestValueMostSecure @@ -37793,6 +40543,30 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + LowestValueMostSecure + + + + AlwaysEnableBooksLibrary + + + + + Specifies whether the Books Library in Microsoft Edge will always be visible regardless of the country or region setting for the device. + 0 + + + + + + + + + + + text/plain + + LowestValueMostSecure @@ -37816,6 +40590,7 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain phone + LowestValueMostSecure @@ -37844,6 +40619,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LastWrite @@ -37872,6 +40648,7 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo text/plain phone + LowestValueMostSecure @@ -37895,6 +40672,7 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo text/plain phone + LastWrite @@ -37918,6 +40696,7 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo text/plain phone + LastWrite @@ -37941,6 +40720,7 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo text/plain desktop + LastWrite @@ -37954,7 +40734,7 @@ Example: If you wanted to allow contoso.com and fabrikam.com then you would append /support to the site strings like contoso.com/support and fabrikam.com/support. Encapsulate each string with greater than and less than characters like any other XML tag. -Version 1703 or later:  If you don't want to send traffic to Microsoft, you can use the about:blank value (encapsulate with greater than and less than characters like any other XML tag), which is honored for both domain- and non-domain-joined machines, when it's the only configured URL. +Version 1703 or later:  If you don't want to send traffic to Microsoft, you can use the about:blank value (encapsulate with greater than and less than characters like any other XML tag), which is honored for both domain- and non-domain-joined machines, when it's the only configured URL. @@ -37969,6 +40749,37 @@ Version 1703 or later:  If you don't want to send traffic to Microsoft, yo text/plain phone + LastWrite + + + + LockdownFavorites + + + + + This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge. + +If you enable this setting, employees won't be able to add, import, or change anything in the Favorites list. Also as part of this, Save a Favorite, Import settings, and the context menu items (such as, Create a new folder) are all turned off. + +Important +Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. + +If you disable or don't configure this setting (default), employees can add, import and make changes to the Favorites list. + 0 + + + + + + + + + + + text/plain + + LowestValueMostSecure @@ -37991,6 +40802,7 @@ Version 1703 or later:  If you don't want to send traffic to Microsoft, yo text/plain + HighestValueMostSecure @@ -38016,6 +40828,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -38040,6 +40853,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -38062,6 +40876,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -38084,6 +40899,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -38106,6 +40922,37 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure + + + + ProvisionFavorites + + + + + This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. + +If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites. + +Important +Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. + +If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar. + + + + + + + + + + + + text/plain + + LastWrite @@ -38129,6 +40976,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -38157,6 +41005,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LastWrite @@ -38180,6 +41029,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -38203,6 +41053,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LowestValueMostSecure @@ -38245,6 +41096,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -38267,6 +41119,101 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + LetAppsAccessCellularData + + + + + This policy setting specifies whether Windows apps can access cellular data. + 0 + + + + + + + + + + + text/plain + + HighestValueMostSecure + + + + LetAppsAccessCellularData_ForceAllowTheseApps + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + + + + + + + + + + + + text/plain + + LastWrite + ; + + + + LetAppsAccessCellularData_ForceDenyTheseApps + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + + + + + + + + + + + + text/plain + + LastWrite + ; + + + + LetAppsAccessCellularData_UserInControlOfTheseApps + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + + + + + + + + + + + + text/plain + + LastWrite + ; + + ShowAppCellularAccessUI @@ -38290,6 +41237,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on wwansvc.admx wwansvc~AT~Network~WwanSvc_Category~UISettings_Category ShowAppCellularAccessUI + LastWrite @@ -38332,6 +41280,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -38354,6 +41303,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -38376,6 +41326,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -38398,6 +41349,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -38421,6 +41373,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain desktop + LowestValueMostSecure @@ -38444,6 +41397,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain desktop + LowestValueMostSecure @@ -38466,6 +41420,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -38488,6 +41443,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -38514,6 +41470,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on ICM.admx ICM~AT~System~InternetManagement~InternetManagement_Settings DisableHTTPPrinting_2 + LastWrite @@ -38540,6 +41497,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on ICM.admx ICM~AT~System~InternetManagement~InternetManagement_Settings DisableWebPnPDownload_2 + LastWrite @@ -38566,6 +41524,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on ICM.admx ICM~AT~System~InternetManagement~InternetManagement_Settings ShellPreventWPWDownload_2 + LastWrite @@ -38588,6 +41547,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -38614,6 +41574,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on networkprovider.admx NetworkProvider~AT~Network~Cat_NetworkProvider Pol_HardenedPaths + LastWrite @@ -38640,6 +41601,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on NetworkConnections.admx NetworkConnections~AT~Network~NetworkConnections NC_AllowNetBridge_NLA + LastWrite @@ -38686,6 +41648,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on credentialproviders.admx CredentialProviders~AT~System~Logon AllowDomainPINLogon + LastWrite @@ -38712,6 +41675,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on credentialproviders.admx CredentialProviders~AT~System~Logon BlockDomainPicturePassword + LastWrite + + + + EnableWindowsAutoPilotResetCredentials + + + + + + 0 + + + + + + + + + + + text/plain + + LowestValueMostSecure @@ -38758,6 +41745,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on credui.admx CredUI~AT~WindowsComponents~CredUI DisablePasswordReveal + LastWrite @@ -38784,6 +41772,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on credui.admx CredUI~AT~WindowsComponents~CredUI EnumerateAdministrators + LastWrite @@ -38826,6 +41815,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LastWrite @@ -38848,6 +41838,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LastWrite @@ -38890,6 +41881,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -38912,6 +41904,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LastWrite @@ -38957,6 +41950,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on wwansvc.admx wwansvc~AT~Network~WwanSvc_Category~NetworkCost_Category SetCost3G + LastWrite @@ -38982,6 +41976,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on wwansvc.admx wwansvc~AT~Network~WwanSvc_Category~NetworkCost_Category SetCost4G + LastWrite @@ -39025,6 +42020,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -39048,6 +42044,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -39071,6 +42068,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -39094,6 +42092,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -39117,6 +42116,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -39140,6 +42140,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -39163,6 +42164,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -39186,6 +42188,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -39209,6 +42212,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -39232,6 +42236,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -39255,6 +42260,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -39278,6 +42284,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -39301,6 +42308,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39324,6 +42332,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39347,6 +42356,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39370,6 +42380,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39393,6 +42404,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39416,6 +42428,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39439,6 +42452,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39462,6 +42476,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39485,6 +42500,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39508,6 +42524,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39531,6 +42548,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39554,6 +42572,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39577,6 +42596,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39600,6 +42620,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39623,6 +42644,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39646,6 +42668,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LowestValueMostSecure @@ -39669,6 +42692,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39692,6 +42716,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39715,6 +42740,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39738,6 +42764,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39761,6 +42788,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39784,6 +42812,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -39807,6 +42836,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39850,6 +42880,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39873,6 +42904,31 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LowestValueMostSecure + + + + DOCacheHost + + + + + + + + + + + + + + + + + text/plain + + phone + LastWrite @@ -39896,6 +42952,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39919,6 +42976,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39942,6 +43000,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39965,6 +43024,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -39988,6 +43048,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -40011,6 +43072,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -40034,6 +43096,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -40057,6 +43120,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -40080,6 +43144,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -40103,6 +43168,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -40126,6 +43192,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -40149,6 +43216,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -40172,6 +43240,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -40195,6 +43264,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -40238,6 +43308,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -40261,6 +43332,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LowestValueMostSecureZeroHasNoLimits @@ -40284,6 +43356,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + HighestValueMostSecure @@ -40330,6 +43403,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on deviceinstallation.admx DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category DeviceInstall_IDs_Deny + LastWrite @@ -40356,6 +43430,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on deviceinstallation.admx DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category DeviceInstall_Classes_Deny + LastWrite @@ -40399,6 +43474,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain desktop + LowestValueMostSecure @@ -40421,6 +43497,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LastWrite @@ -40443,6 +43520,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -40465,6 +43543,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -40487,6 +43566,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -40509,6 +43589,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecureZeroHasNoLimits @@ -40517,7 +43598,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Specifies how many passwords can be stored in the history that can’t be used. + Specifies how many passwords can be stored in the history that can’t be used. 0 @@ -40531,6 +43612,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -40554,6 +43636,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + LastWrite @@ -40576,6 +43659,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LastWrite @@ -40598,6 +43682,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecureZeroHasNoLimits @@ -40620,6 +43705,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecureZeroHasNoLimits @@ -40643,6 +43729,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain desktop + LowestValueMostSecure @@ -40665,6 +43752,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -40687,6 +43775,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecureZeroHasNoLimits @@ -40714,6 +43803,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain phone + HighestValueMostSecure @@ -40740,6 +43830,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor ControlPanelDisplay.admx ControlPanelDisplay~AT~ControlPanel~Personalization CPL_Personalization_NoLockScreenSlideshow + LastWrite @@ -40762,6 +43853,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LastWrite @@ -40805,6 +43897,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain phone + LastWrite @@ -40828,6 +43921,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain phone + LastWrite @@ -40874,6 +43968,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor ErrorReporting.admx ErrorReporting~AT~WindowsComponents~CAT_WindowsErrorReporting WerConsentCustomize_2 + LastWrite @@ -40900,6 +43995,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor ErrorReporting.admx ErrorReporting~AT~WindowsComponents~CAT_WindowsErrorReporting WerDisable_2 + LastWrite @@ -40926,6 +44022,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor ErrorReporting.admx ErrorReporting~AT~WindowsComponents~CAT_WindowsErrorReporting PCH_ShowUI + LastWrite @@ -40952,6 +44049,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor ErrorReporting.admx ErrorReporting~AT~WindowsComponents~CAT_WindowsErrorReporting WerNoSecondLevelData_2 + LastWrite @@ -40978,6 +44076,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor ErrorReporting.admx ErrorReporting~AT~WindowsComponents~CAT_WindowsErrorReporting WerDoNotShowUI + LastWrite @@ -41024,6 +44123,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor eventlog.admx EventLog~AT~WindowsComponents~EventLogCategory~EventLog_Application Channel_Log_Retention_1 + LastWrite @@ -41050,6 +44150,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor eventlog.admx EventLog~AT~WindowsComponents~EventLogCategory~EventLog_Application Channel_LogMaxSize_1 + LastWrite @@ -41076,6 +44177,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor eventlog.admx EventLog~AT~WindowsComponents~EventLogCategory~EventLog_Security Channel_LogMaxSize_2 + LastWrite @@ -41102,6 +44204,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor eventlog.admx EventLog~AT~WindowsComponents~EventLogCategory~EventLog_System Channel_LogMaxSize_4 + LastWrite @@ -41145,6 +44248,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain desktop + LowestValueMostSecure @@ -41167,6 +44271,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -41189,6 +44294,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -41211,6 +44317,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -41233,6 +44340,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -41255,6 +44363,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -41277,6 +44386,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -41299,6 +44409,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -41321,6 +44432,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + HighestValueMostSecure @@ -41343,6 +44455,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -41366,6 +44479,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain desktop + LowestValueMostSecure @@ -41389,6 +44503,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain desktop + LowestValueMostSecure @@ -41412,6 +44527,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain phone + LowestValueMostSecure @@ -41434,6 +44550,50 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + HighestValueMostSecure + + + + + ExploitGuard + + + + + + + + + + + + + + + + + + + ExploitProtectionSettings + + + + + + + + + + + + + + + + + text/plain + + LastWrite @@ -41476,6 +44636,51 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure + + + + + Handwriting + + + + + + + + + + + + + + + + + + + PanelDefaultModeDocked + + + + + Specifies whether the handwriting panel comes up floating near the text box or attached to the bottom of the screen + 0 + + + + + + + + + + + text/plain + + phone + LowestValueMostSecure @@ -41522,6 +44727,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer AddSearchProvider + LastWrite @@ -41548,6 +44754,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer TurnOnActiveXFiltering + LastWrite @@ -41574,6 +44781,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement AddonManagement_AddOnList + LastWrite @@ -41600,6 +44808,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyWarnCertMismatch + LastWrite @@ -41626,6 +44835,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~DeleteBrowsingHistory DBHDisableDeleteOnExit + LastWrite @@ -41652,6 +44862,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_EnableEnhancedProtectedMode + LastWrite @@ -41678,6 +44889,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer EnterpriseModeEnable + LastWrite @@ -41704,6 +44916,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer EnterpriseModeSiteList + LastWrite @@ -41730,10 +44943,11 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures Advanced_EnableSSL3Fallback + LastWrite - AllowInternetExplorer7PolicyList + AllowInternetExplorer7PolicyList @@ -41756,6 +44970,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~CategoryCompatView CompatView_UsePolicyList + LastWrite @@ -41782,6 +44997,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~CategoryCompatView CompatView_IntranetSites + LastWrite @@ -41808,6 +45024,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyInternetZoneTemplate + LastWrite @@ -41834,6 +45051,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyIntranetZoneTemplate + LastWrite @@ -41860,6 +45078,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyLocalMachineZoneTemplate + LastWrite @@ -41886,6 +45105,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyInternetZoneLockdownTemplate + LastWrite @@ -41912,6 +45132,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyIntranetZoneLockdownTemplate + LastWrite @@ -41938,6 +45159,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyLocalMachineZoneLockdownTemplate + LastWrite @@ -41964,6 +45186,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyRestrictedSitesZoneLockdownTemplate + LastWrite @@ -41990,6 +45213,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetSettings~Advanced~Browsing UseIntranetSiteForOneWordEntry + LastWrite @@ -42016,6 +45240,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_Zonemaps + LastWrite @@ -42042,6 +45267,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyTrustedSitesZoneLockdownTemplate + LastWrite @@ -42068,6 +45294,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_InvalidSignatureBlock + LastWrite @@ -42094,6 +45321,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyRestrictedSitesZoneTemplate + LastWrite @@ -42120,6 +45348,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer EnableSuggestedSites + LastWrite @@ -42146,6 +45375,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_PolicyTrustedSitesZoneTemplate + LastWrite @@ -42172,6 +45402,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_CertificateRevocation + LastWrite @@ -42198,6 +45429,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_DownloadSignatures + LastWrite @@ -42224,6 +45456,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryBinaryBehaviorSecurityRestriction IESF_PolicyExplorerProcesses_2 + LastWrite @@ -42250,6 +45483,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement DisableFlashInIE + LastWrite @@ -42276,6 +45510,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement VerMgmtDisable + LastWrite @@ -42300,6 +45535,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + DisableSafetyFilterOverride + LastWrite @@ -42324,6 +45562,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + DisableSafetyFilterOverrideForAppRepUnknown + LastWrite @@ -42350,6 +45591,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~DeleteBrowsingHistory RestrictHistory + LastWrite @@ -42374,6 +45616,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + AddonManagement_RestrictCrashDetection + LastWrite @@ -42400,10 +45645,11 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer SQM_DisableCEIP + LastWrite - DisableDeletingUserVisitedWebsites + DisableDeletingUserVisitedWebsites @@ -42426,6 +45672,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~DeleteBrowsingHistory DBHDisableDeleteHistory + LastWrite @@ -42452,6 +45699,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~RSS_Feeds Disable_Downloading_of_Enclosures + LastWrite @@ -42478,6 +45726,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_SetWinInetProtocols + LastWrite @@ -42504,6 +45753,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer NoFirstRunCustomise + LastWrite @@ -42530,6 +45780,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_DisableFlipAhead + LastWrite @@ -42556,6 +45807,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL NoCertError + LastWrite @@ -42582,6 +45834,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~CategoryPrivacy DisableInPrivateBrowsing + LastWrite @@ -42608,6 +45861,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_EnableEnhancedProtectedMode64Bit + LastWrite @@ -42632,6 +45886,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + RestrictProxy + LastWrite @@ -42658,6 +45915,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer NoSearchProvider + LastWrite @@ -42684,6 +45942,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer SecondaryHomePages + LastWrite @@ -42710,6 +45969,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer Disable_Security_Settings_Check + LastWrite @@ -42736,6 +45996,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer NoUpdateCheck + LastWrite @@ -42762,6 +46023,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage Advanced_DisableEPMCompat + LastWrite @@ -42788,6 +46050,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer Security_zones_map_edit + LastWrite @@ -42814,6 +46077,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer Security_options_edit + LastWrite @@ -42840,6 +46104,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement VerMgmtDisable + LastWrite @@ -42866,6 +46131,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement VerMgmtDomainAllowlist + LastWrite @@ -42892,6 +46158,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_IncludeUnspecifiedLocalSites + LastWrite @@ -42918,6 +46185,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage IZ_UNCAsIntranet + LastWrite @@ -42944,6 +46212,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyAccessDataSourcesAcrossDomains_1 + LastWrite @@ -42970,6 +46239,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyNotificationBarActiveXURLaction_1 + LastWrite @@ -42996,6 +46266,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyNotificationBarDownloadURLaction_1 + LastWrite @@ -43022,6 +46293,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyAllowPasteViaScript_1 + LastWrite @@ -43048,6 +46320,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyDropOrPasteFiles_1 + LastWrite @@ -43074,6 +46347,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyFontDownload_1 + LastWrite @@ -43100,10 +46374,11 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyZoneElevationURLaction_1 + LastWrite - InternetZoneAllowLoadingOfXAMLFilesWRONG + InternetZoneAllowLoadingOfXAMLFiles @@ -43126,6 +46401,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_Policy_XAML_1 + LastWrite @@ -43152,6 +46428,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyUnsignedFrameworkComponentsURLaction_1 + LastWrite @@ -43176,8 +46453,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Intranet + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone + IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet + LastWrite @@ -43202,8 +46480,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyAllowTDCControl_Both_LocalMachine + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone + IZ_PolicyAllowTDCControl_Both_Internet + LastWrite @@ -43230,6 +46509,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_Policy_WebBrowserControl_1 + LastWrite @@ -43254,8 +46534,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyWindowsRestrictionsURLaction_6 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone + IZ_PolicyWindowsRestrictionsURLaction_1 + LastWrite @@ -43282,6 +46563,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_Policy_AllowScriptlets_1 + LastWrite @@ -43308,6 +46590,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_Policy_Phishing_1 + LastWrite @@ -43334,6 +46617,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_Policy_ScriptStatusBar_1 + LastWrite @@ -43360,10 +46644,11 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyUserdataPersistence_1 + LastWrite - InternetZoneDoNotRunAntimalwareAgainstActiveXControlsWRONG1 + InternetZoneDoNotRunAntimalwareAgainstActiveXControls @@ -43386,32 +46671,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyAntiMalwareCheckingOfActiveXControls_1 - - - - InternetZoneDoNotRunAntimalwareAgainstActiveXControlsWRONG2 - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_3 + LastWrite @@ -43436,8 +46696,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyDownloadSignedActiveX_3 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone + IZ_PolicyDownloadSignedActiveX_1 + LastWrite @@ -43464,6 +46725,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyDownloadUnsignedActiveX_1 + LastWrite @@ -43488,8 +46750,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyTurnOnXSSFilter_Both_LocalMachine + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone + IZ_PolicyTurnOnXSSFilter_Both_Internet + LastWrite @@ -43516,6 +46779,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet + LastWrite @@ -43542,6 +46806,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet + LastWrite @@ -43568,6 +46833,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyMimeSniffingURLaction_1 + LastWrite @@ -43592,8 +46858,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_Policy_TurnOnProtectedMode_2 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone + IZ_Policy_TurnOnProtectedMode_1 + LastWrite @@ -43620,6 +46887,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_Policy_LocalPathForUpload_1 + LastWrite @@ -43646,36 +46914,11 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyScriptActiveXNotMarkedSafe_1 + LastWrite - InternetZoneInitializeAndScriptActiveXControlsNotMarkedSafe - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyScriptActiveXNotMarkedSafe_1 - - - - InternetZoneJavaPermissionsWRONG1 + InternetZoneJavaPermissions @@ -43698,32 +46941,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyJavaPermissions_1 - - - - InternetZoneJavaPermissionsWRONG2 - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyJavaPermissions_3 + LastWrite @@ -43750,6 +46968,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyLaunchAppsAndFilesInIFRAME_1 + LastWrite @@ -43776,6 +46995,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyLogon_1 + LastWrite @@ -43802,6 +47022,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyNavigateSubframesAcrossDomains_1 + LastWrite @@ -43828,6 +47049,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyUnsignedFrameworkComponentsURLaction_1 + LastWrite @@ -43854,6 +47076,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicySignedFrameworkComponentsURLaction_1 + LastWrite @@ -43880,6 +47103,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_Policy_UnsafeFiles_1 + LastWrite @@ -43906,6 +47130,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyBlockPopupWindows_1 + LastWrite @@ -43932,6 +47157,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone IZ_PolicyZoneElevationURLaction_1 + LastWrite @@ -43958,6 +47184,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyAccessDataSourcesAcrossDomains_3 + LastWrite @@ -43984,6 +47211,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyNotificationBarActiveXURLaction_3 + LastWrite @@ -44010,6 +47238,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyNotificationBarDownloadURLaction_3 + LastWrite @@ -44036,6 +47265,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyFontDownload_3 + LastWrite @@ -44062,6 +47292,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyZoneElevationURLaction_3 + LastWrite @@ -44088,6 +47319,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyUnsignedFrameworkComponentsURLaction_3 + LastWrite @@ -44114,6 +47346,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_Policy_AllowScriptlets_3 + LastWrite @@ -44140,6 +47373,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_Policy_Phishing_3 + LastWrite @@ -44166,6 +47400,34 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyUserdataPersistence_3 + LastWrite + + + + IntranetZoneDoNotRunAntimalwareAgainstActiveXControls + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone + IZ_PolicyAntiMalwareCheckingOfActiveXControls_3 + LastWrite @@ -44192,6 +47454,61 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyScriptActiveXNotMarkedSafe_3 + LastWrite + + + + IntranetZoneInitializeAndScriptActiveXControlsNotMarkedSafe + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone + IZ_PolicyScriptActiveXNotMarkedSafe_3 + LastWrite + + + + IntranetZoneJavaPermissions + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone + IZ_PolicyJavaPermissions_3 + LastWrite @@ -44218,6 +47535,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone IZ_PolicyNavigateSubframesAcrossDomains_3 + LastWrite @@ -44244,6 +47562,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyAccessDataSourcesAcrossDomains_9 + LastWrite @@ -44270,6 +47589,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyNotificationBarActiveXURLaction_9 + LastWrite @@ -44296,6 +47616,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyNotificationBarDownloadURLaction_9 + LastWrite @@ -44322,6 +47643,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyFontDownload_9 + LastWrite @@ -44348,6 +47670,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyZoneElevationURLaction_9 + LastWrite @@ -44374,6 +47697,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyUnsignedFrameworkComponentsURLaction_9 + LastWrite @@ -44400,6 +47724,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_Policy_AllowScriptlets_9 + LastWrite @@ -44426,6 +47751,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_Policy_Phishing_9 + LastWrite @@ -44452,6 +47778,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyUserdataPersistence_9 + LastWrite @@ -44476,8 +47803,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone~IZ_LocalMachineZone + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyAntiMalwareCheckingOfActiveXControls_9 + LastWrite @@ -44504,6 +47832,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyScriptActiveXNotMarkedSafe_9 + LastWrite @@ -44530,6 +47859,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyJavaPermissions_9 + LastWrite @@ -44556,6 +47886,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone IZ_PolicyNavigateSubframesAcrossDomains_9 + LastWrite @@ -44582,6 +47913,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyAccessDataSourcesAcrossDomains_2 + LastWrite @@ -44608,6 +47940,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyNotificationBarActiveXURLaction_2 + LastWrite @@ -44634,6 +47967,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyNotificationBarDownloadURLaction_2 + LastWrite @@ -44660,6 +47994,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyFontDownload_2 + LastWrite @@ -44686,6 +48021,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyZoneElevationURLaction_2 + LastWrite @@ -44712,6 +48048,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyUnsignedFrameworkComponentsURLaction_2 + LastWrite @@ -44738,6 +48075,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_Policy_AllowScriptlets_2 + LastWrite @@ -44764,6 +48102,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_Policy_Phishing_2 + LastWrite @@ -44790,6 +48129,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyUserdataPersistence_2 + LastWrite @@ -44816,6 +48156,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyScriptActiveXNotMarkedSafe_2 + LastWrite @@ -44842,6 +48183,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyJavaPermissions_2 + LastWrite @@ -44868,6 +48210,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown IZ_PolicyNavigateSubframesAcrossDomains_2 + LastWrite @@ -44894,6 +48237,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyAccessDataSourcesAcrossDomains_4 + LastWrite @@ -44920,6 +48264,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyNotificationBarActiveXURLaction_4 + LastWrite @@ -44946,6 +48291,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyNotificationBarDownloadURLaction_4 + LastWrite @@ -44972,6 +48318,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyFontDownload_4 + LastWrite @@ -44998,6 +48345,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyZoneElevationURLaction_4 + LastWrite @@ -45024,6 +48372,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyUnsignedFrameworkComponentsURLaction_4 + LastWrite @@ -45050,6 +48399,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_Policy_AllowScriptlets_4 + LastWrite @@ -45076,6 +48426,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_Policy_Phishing_4 + LastWrite @@ -45102,6 +48453,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyUserdataPersistence_4 + LastWrite @@ -45128,6 +48480,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyScriptActiveXNotMarkedSafe_4 + LastWrite @@ -45154,6 +48507,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown IZ_PolicyNavigateSubframesAcrossDomains_4 + LastWrite @@ -45180,6 +48534,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyAccessDataSourcesAcrossDomains_10 + LastWrite @@ -45206,6 +48561,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyNotificationBarActiveXURLaction_10 + LastWrite @@ -45232,6 +48588,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyNotificationBarDownloadURLaction_10 + LastWrite @@ -45258,6 +48615,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyFontDownload_10 + LastWrite @@ -45284,6 +48642,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyZoneElevationURLaction_10 + LastWrite @@ -45310,6 +48669,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyUnsignedFrameworkComponentsURLaction_10 + LastWrite @@ -45336,6 +48696,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_Policy_AllowScriptlets_10 + LastWrite @@ -45362,6 +48723,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_Policy_Phishing_10 + LastWrite @@ -45388,6 +48750,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyUserdataPersistence_10 + LastWrite @@ -45414,6 +48777,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyScriptActiveXNotMarkedSafe_10 + LastWrite @@ -45440,6 +48804,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyJavaPermissions_10 + LastWrite @@ -45466,6 +48831,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown IZ_PolicyNavigateSubframesAcrossDomains_10 + LastWrite @@ -45492,6 +48858,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyAccessDataSourcesAcrossDomains_8 + LastWrite @@ -45518,6 +48885,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyNotificationBarActiveXURLaction_8 + LastWrite @@ -45544,6 +48912,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyNotificationBarDownloadURLaction_8 + LastWrite @@ -45570,6 +48939,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyFontDownload_8 + LastWrite @@ -45596,6 +48966,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyZoneElevationURLaction_8 + LastWrite @@ -45622,6 +48993,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyUnsignedFrameworkComponentsURLaction_8 + LastWrite @@ -45648,6 +49020,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_Policy_AllowScriptlets_8 + LastWrite @@ -45674,6 +49047,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_Policy_Phishing_8 + LastWrite @@ -45700,6 +49074,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyUserdataPersistence_8 + LastWrite @@ -45726,6 +49101,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyScriptActiveXNotMarkedSafe_8 + LastWrite @@ -45752,6 +49128,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyJavaPermissions_8 + LastWrite @@ -45778,6 +49155,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown IZ_PolicyNavigateSubframesAcrossDomains_8 + LastWrite @@ -45804,6 +49182,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyAccessDataSourcesAcrossDomains_6 + LastWrite @@ -45830,6 +49209,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyNotificationBarActiveXURLaction_6 + LastWrite @@ -45856,6 +49236,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyNotificationBarDownloadURLaction_6 + LastWrite @@ -45882,6 +49263,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyFontDownload_6 + LastWrite @@ -45908,6 +49290,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyZoneElevationURLaction_6 + LastWrite @@ -45934,6 +49317,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyUnsignedFrameworkComponentsURLaction_6 + LastWrite @@ -45960,6 +49344,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_Policy_AllowScriptlets_6 + LastWrite @@ -45986,6 +49371,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_Policy_Phishing_6 + LastWrite @@ -46012,6 +49398,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyUserdataPersistence_6 + LastWrite @@ -46038,6 +49425,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyScriptActiveXNotMarkedSafe_6 + LastWrite @@ -46064,6 +49452,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyJavaPermissions_6 + LastWrite @@ -46090,6 +49479,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown IZ_PolicyNavigateSubframesAcrossDomains_6 + LastWrite @@ -46116,6 +49506,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryMimeSniffingSafetyFeature IESF_PolicyExplorerProcesses_6 + LastWrite @@ -46142,6 +49533,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryMKProtocolSecurityRestriction IESF_PolicyExplorerProcesses_3 + LastWrite @@ -46168,6 +49560,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryInformationBar IESF_PolicyExplorerProcesses_10 + LastWrite @@ -46192,8 +49585,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyDownloadSignedActiveX_1 + inetres~AT~WindowsComponents~InternetExplorer + Disable_Managing_Safety_Filter_IE9 + LastWrite @@ -46220,6 +49614,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer DisablePerUserActiveXInstall + LastWrite @@ -46246,6 +49641,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryProtectionFromZoneElevation IESF_PolicyAllProcesses_9 + LastWrite @@ -46272,6 +49668,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement VerMgmtDisableRunThisTime + LastWrite @@ -46298,6 +49695,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictActiveXInstall IESF_PolicyAllProcesses_11 + LastWrite @@ -46324,6 +49722,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyAccessDataSourcesAcrossDomains_7 + LastWrite @@ -46348,8 +49747,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyActiveScripting_1 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyActiveScripting_7 + LastWrite @@ -46376,6 +49776,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyNotificationBarActiveXURLaction_7 + LastWrite @@ -46402,6 +49803,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyNotificationBarDownloadURLaction_7 + LastWrite @@ -46426,8 +49828,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyBinaryBehaviors_1 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyBinaryBehaviors_7 + LastWrite @@ -46454,6 +49857,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyAllowPasteViaScript_7 + LastWrite @@ -46480,6 +49884,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyDropOrPasteFiles_7 + LastWrite @@ -46504,12 +49909,13 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyFileDownload_1 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyFileDownload_7 + LastWrite - RestrictedSitesZoneAllowFontDownloadsWRONG1 + RestrictedSitesZoneAllowFontDownloads @@ -46532,32 +49938,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyFontDownload_7 - - - - RestrictedSitesZoneAllowFontDownloadsWRONG2 - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyFontDownload_1 + LastWrite @@ -46584,6 +49965,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyZoneElevationURLaction_7 + LastWrite @@ -46610,6 +49992,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_XAML_7 + LastWrite @@ -46634,8 +50017,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyAllowMETAREFRESH_1 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyAllowMETAREFRESH_7 + LastWrite @@ -46662,6 +50046,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyUnsignedFrameworkComponentsURLaction_7 + LastWrite @@ -46688,6 +50073,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted + LastWrite @@ -46714,6 +50100,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyAllowTDCControl_Both_Restricted + LastWrite @@ -46740,6 +50127,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_WebBrowserControl_7 + LastWrite @@ -46766,6 +50154,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyWindowsRestrictionsURLaction_7 + LastWrite @@ -46792,6 +50181,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_AllowScriptlets_7 + LastWrite @@ -46818,6 +50208,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_Phishing_7 + LastWrite @@ -46844,6 +50235,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_ScriptStatusBar_7 + LastWrite @@ -46870,6 +50262,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyUserdataPersistence_7 + LastWrite @@ -46896,6 +50289,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyAntiMalwareCheckingOfActiveXControls_7 + LastWrite @@ -46922,6 +50316,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyDownloadSignedActiveX_7 + LastWrite @@ -46948,6 +50343,34 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyDownloadUnsignedActiveX_7 + LastWrite + + + + RestrictedSitesZoneEnableCrossSiteScriptingFilter + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyTurnOnXSSFilter_Both_Restricted + LastWrite @@ -46974,6 +50397,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted + LastWrite @@ -47000,6 +50424,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted + LastWrite @@ -47026,6 +50451,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyMimeSniffingURLaction_7 + LastWrite @@ -47052,6 +50478,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_LocalPathForUpload_7 + LastWrite @@ -47078,6 +50505,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyScriptActiveXNotMarkedSafe_7 + LastWrite @@ -47104,6 +50532,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyJavaPermissions_7 + LastWrite @@ -47130,6 +50559,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyLaunchAppsAndFilesInIFRAME_7 + LastWrite @@ -47156,6 +50586,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyLogon_7 + LastWrite @@ -47182,6 +50613,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyNavigateSubframesAcrossDomains_7 + LastWrite @@ -47206,8 +50638,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyNavigateSubframesAcrossDomains_1 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyNavigateSubframesAcrossDomains_7 + LastWrite @@ -47232,8 +50665,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyRunActiveXControls_1 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyRunActiveXControls_7 + LastWrite @@ -47260,6 +50694,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicySignedFrameworkComponentsURLaction_7 + LastWrite @@ -47284,12 +50719,13 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyScriptActiveXMarkedSafe_1 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyScriptActiveXMarkedSafe_7 + LastWrite - RestrictedSitesZoneWRONG + RestrictedSitesZoneScriptingOfJavaApplets @@ -47310,12 +50746,13 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyScriptingOfJavaApplets_6 + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyScriptingOfJavaApplets_7 + LastWrite - RestrictedSitesZoneWRONG2 + RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles @@ -47338,10 +50775,11 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_UnsafeFiles_7 + LastWrite - RestrictedSitesZoneWRONG3 + RestrictedSitesZoneTurnOnCrossSiteScriptingFilter @@ -47364,10 +50802,11 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyTurnOnXSSFilter_Both_Restricted + LastWrite - RestrictedSitesZoneWRONG4 + RestrictedSitesZoneTurnOnProtectedMode @@ -47390,10 +50829,11 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_Policy_TurnOnProtectedMode_7 + LastWrite - RestrictedSitesZoneWRONG5 + RestrictedSitesZoneUsePopupBlocker @@ -47416,6 +50856,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone IZ_PolicyBlockPopupWindows_7 + LastWrite @@ -47442,6 +50883,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictFileDownload IESF_PolicyAllProcesses_12 + LastWrite @@ -47468,6 +50910,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryScriptedWindowSecurityRestrictions IESF_PolicyAllProcesses_8 + LastWrite @@ -47494,10 +50937,11 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer SpecificSearchProvider + LastWrite - SecurityZonesUseOnlyMachineSettings + SecurityZonesUseOnlyMachineSettings @@ -47520,6 +50964,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer Security_HKLM_only + LastWrite @@ -47546,6 +50991,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer OnlyUseAXISForActiveXInstall + LastWrite @@ -47572,6 +51018,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyAccessDataSourcesAcrossDomains_5 + LastWrite @@ -47598,6 +51045,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyNotificationBarActiveXURLaction_5 + LastWrite @@ -47624,6 +51072,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyNotificationBarDownloadURLaction_5 + LastWrite @@ -47650,6 +51099,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyFontDownload_5 + LastWrite @@ -47676,6 +51126,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyZoneElevationURLaction_5 + LastWrite @@ -47702,6 +51153,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyUnsignedFrameworkComponentsURLaction_5 + LastWrite @@ -47728,6 +51180,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_Policy_AllowScriptlets_5 + LastWrite @@ -47754,6 +51207,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_Policy_Phishing_5 + LastWrite @@ -47780,6 +51234,61 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyUserdataPersistence_5 + LastWrite + + + + TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone + IZ_PolicyAntiMalwareCheckingOfActiveXControls_5 + LastWrite + + + + TrustedSitesZoneDontRunAntimalwareProgramsAgainstActiveXControls + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone + IZ_PolicyAntiMalwareCheckingOfActiveXControls_5 + LastWrite @@ -47806,6 +51315,61 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyScriptActiveXNotMarkedSafe_5 + LastWrite + + + + TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedAsSafe + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone + IZ_PolicyScriptActiveXNotMarkedSafe_5 + LastWrite + + + + TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedSafe + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone + IZ_PolicyScriptActiveXNotMarkedSafe_5 + LastWrite @@ -47832,6 +51396,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyJavaPermissions_5 + LastWrite @@ -47858,58 +51423,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor inetres.admx inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone IZ_PolicyNavigateSubframesAcrossDomains_5 - - - - TrustedSitesZoneWRONG1 - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_5 - - - - TrustedSitesZoneWRONG2 - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyScriptActiveXNotMarkedSafe_5 + LastWrite @@ -47956,6 +51470,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor Kerberos.admx Kerberos~AT~System~kerberos ForestSearch + LastWrite @@ -47982,6 +51497,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor Kerberos.admx Kerberos~AT~System~kerberos EnableCbacAndArmor + LastWrite @@ -48008,6 +51524,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor Kerberos.admx Kerberos~AT~System~kerberos ClientRequireFast + LastWrite @@ -48034,6 +51551,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor Kerberos.admx Kerberos~AT~System~kerberos ValidateKDC + LastWrite @@ -48060,6 +51578,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor Kerberos.admx Kerberos~AT~System~kerberos MaxTokenSize + LastWrite @@ -48103,6 +51622,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain phone + LowestValueMostSecure @@ -48126,6 +51646,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain phone + LowestValueMostSecure @@ -48156,9 +51677,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor This policy setting prevents users from adding new Microsoft accounts on this computer. -If you select the "Users can’t add Microsoft accounts" option, users will not be able to create new Microsoft accounts on this computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. +If you select the "Users can’t add Microsoft accounts" option, users will not be able to create new Microsoft accounts on this computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. -If you select the "Users can’t add or log on with Microsoft accounts" option, existing Microsoft account users will not be able to log on to Windows. Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system. +If you select the "Users can’t add or log on with Microsoft accounts" option, existing Microsoft account users will not be able to log on to Windows. Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system. If you disable or do not configure this policy (recommended), users will be able to use Microsoft accounts with Windows. 0 @@ -48175,6 +51696,7 @@ If you disable or do not configure this policy (recommended), users will be able text/plain phone + LastWrite @@ -48206,7 +51728,8 @@ Default: Disabled. text/plain - desktop + phone + LastWrite @@ -48233,7 +51756,8 @@ Note: If the Guest account is disabled and the security option Network Access: S text/plain - desktop + phone + LastWrite @@ -48272,6 +51796,7 @@ It is possible for applications that use remote interactive logons to bypass thi text/plain phone + LastWrite @@ -48285,7 +51810,7 @@ It is possible for applications that use remote interactive logons to bypass thi This security setting determines whether a different account name is associated with the security identifier (SID) for the account Administrator. Renaming the well-known Administrator account makes it slightly more difficult for unauthorized persons to guess this privileged user name and password combination. Default: Administrator. - + Administrator @@ -48299,6 +51824,7 @@ Default: Administrator. text/plain phone + LastWrite @@ -48312,7 +51838,7 @@ Default: Administrator. This security setting determines whether a different account name is associated with the security identifier (SID) for the account "Guest." Renaming the well-known Guest account makes it slightly more difficult for unauthorized persons to guess this user name and password combination. Default: Guest. - + Guest @@ -48326,6 +51852,131 @@ Default: Guest. text/plain phone + LastWrite + + + + Devices_AllowedToFormatAndEjectRemovableMedia + + + + + Devices: Allowed to format and eject removable media + +This security setting determines who is allowed to format and eject removable NTFS media. This capability can be given to: + +Administrators +Administrators and Interactive Users + +Default: This policy is not defined and only Administrators have this ability. + 0 + + + + + + + + + + + text/plain + + phone + LastWrite + + + + Devices_AllowUndockWithoutHavingToLogon + + + + + Devices: Allow undock without having to log on +This security setting determines whether a portable computer can be undocked without having to log on. If this policy is enabled, logon is not required and an external hardware eject button can be used to undock the computer. If disabled, a user must log on and have the Remove computer from docking station privilege to undock the computer. +Default: Enabled. + +Caution +Disabling this policy may tempt users to try and physically remove the laptop from its docking station using methods other than the external hardware eject button. Since this may cause damage to the hardware, this setting, in general, should only be disabled on laptop configurations that are physically securable. + 1 + + + + + + + + + + + text/plain + + phone + LastWrite + + + + Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters + + + + + Devices: Prevent users from installing printer drivers when connecting to shared printers + +For a computer to print to a shared printer, the driver for that shared printer must be installed on the local computer. This security setting determines who is allowed to install a printer driver as part of connecting to a shared printer. If this setting is enabled, only Administrators can install a printer driver as part of connecting to a shared printer. If this setting is disabled, any user can install a printer driver as part of connecting to a shared printer. + +Default on servers: Enabled. +Default on workstations: Disabled + +Notes + +This setting does not affect the ability to add a local printer. +This setting does not affect Administrators. + 0 + + + + + + + + + + + text/plain + + phone + LastWrite + + + + Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly + + + + + Devices: Restrict CD-ROM access to locally logged-on user only + +This security setting determines whether a CD-ROM is accessible to both local and remote users simultaneously. + +If this policy is enabled, it allows only the interactively logged-on user to access removable CD-ROM media. If this policy is enabled and no one is logged on interactively, the CD-ROM can be accessed over the network. + +Default: This policy is not defined and CD-ROM access is not restricted to the locally logged-on user. + 0 + + + + + + + + + + + text/plain + + phone + LastWrite @@ -48352,10 +52003,11 @@ Do not display user information (3) text/plain phone + LastWrite - Interactivelogon_DoNotDisplayLastSignedIn + InteractiveLogon_DoNotDisplayLastSignedIn @@ -48381,10 +52033,11 @@ Default: Disabled. text/plain phone + LastWrite - Interactivelogon_DoNotDisplayUsernameAtSignIn + InteractiveLogon_DoNotDisplayUsernameAtSignIn @@ -48396,7 +52049,7 @@ If this policy is enabled, the username will not be shown. If this policy is disabled, the username will be shown. Default: Disabled. - 0 + 1 @@ -48410,10 +52063,11 @@ Default: Disabled. text/plain phone + LastWrite - Interactivelogon_DoNotRequireCTRLALTDEL + InteractiveLogon_DoNotRequireCTRLALTDEL @@ -48442,6 +52096,7 @@ Default on stand-alone computers: Enabled. text/plain phone + LastWrite @@ -48468,6 +52123,8 @@ Default: not enforced. text/plain + phone + LastWrite @@ -48497,6 +52154,8 @@ Default: No message. text/plain phone + LastWrite + 0xF000 @@ -48524,6 +52183,7 @@ Default: No message. text/plain phone + LastWrite @@ -48553,6 +52213,7 @@ Default: Disabled. text/plain phone + LastWrite @@ -48582,6 +52243,7 @@ Default: Enabled. text/plain phone + LastWrite @@ -48611,6 +52273,7 @@ This policy is supported on at least Windows Server 2016. text/plain phone + LastWrite @@ -48636,6 +52299,7 @@ This policy will be turned off by default on domain joined machines. This would text/plain phone + LastWrite @@ -48663,6 +52327,40 @@ Default: This policy is not defined and automatic administrative logon is not al text/plain phone + LastWrite + + + + Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn + + + + + Shutdown: Allow system to be shut down without having to log on + +This security setting determines whether a computer can be shut down without having to log on to Windows. + +When this policy is enabled, the Shut Down command is available on the Windows logon screen. + +When this policy is disabled, the option to shut down the computer does not appear on the Windows logon screen. In this case, users must be able to log on to the computer successfully and have the Shut down the system user right before they can perform a system shutdown. + +Default on workstations: Enabled. +Default on servers: Disabled. + 1 + + + + + + + + + + + text/plain + + phone + LastWrite @@ -48694,6 +52392,7 @@ Default: Disabled. text/plain phone + LastWrite @@ -48706,10 +52405,10 @@ Default: Disabled. This policy setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts used by a standard user. -• Enabled: UIA programs, including Windows Remote Assistance, automatically disable the secure desktop for elevation prompts. If you do not disable the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting, the prompts appear on the interactive user's desktop instead of the secure desktop. +• Enabled: UIA programs, including Windows Remote Assistance, automatically disable the secure desktop for elevation prompts. If you do not disable the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting, the prompts appear on the interactive user's desktop instead of the secure desktop. -• Disabled: (Default) The secure desktop can be disabled only by the user of the interactive desktop or by disabling the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting. - 1 +• Disabled: (Default) The secure desktop can be disabled only by the user of the interactive desktop or by disabling the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting. + 0 @@ -48723,6 +52422,7 @@ This policy setting controls whether User Interface Accessibility (UIAccess or U text/plain phone + LastWrite @@ -48737,18 +52437,18 @@ This policy setting controls the behavior of the elevation prompt for administra The options are: -• Elevate without prompting: Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials. Note: Use this option only in the most constrained environments. +• Elevate without prompting: Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials. Note: Use this option only in the most constrained environments. -• Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. +• Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. -• Prompt for consent on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. +• Prompt for consent on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. -• Prompt for credentials: When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. +• Prompt for credentials: When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. -• Prompt for consent: When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. +• Prompt for consent: When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. -• Prompt for consent for non-Windows binaries: (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - 0 +• Prompt for consent for non-Windows binaries: (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. + 5 @@ -48762,6 +52462,7 @@ The options are: text/plain phone + LastWrite @@ -48775,12 +52476,12 @@ This policy setting controls the behavior of the elevation prompt for standard u The options are: -• Prompt for credentials: (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. +• Prompt for credentials: (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. -• Automatically deny elevation requests: When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls. +• Automatically deny elevation requests: When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls. -• Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - 0 +• Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. + 3 @@ -48794,6 +52495,39 @@ The options are: text/plain phone + LastWrite + + + + UserAccountControl_DetectApplicationInstallationsAndPromptForElevation + + + + + User Account Control: Detect application installations and prompt for elevation + +This policy setting controls the behavior of application installation detection for the computer. + +The options are: + +Enabled: (Default) When an application installation package is detected that requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. + +Disabled: Application installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies such as Group Policy Software Installation or Systems Management Server (SMS) should disable this policy setting. In this case, installer detection is unnecessary. + 1 + + + + + + + + + + + text/plain + + phone + LastWrite @@ -48808,77 +52542,9 @@ This policy setting enforces public key infrastructure (PKI) signature checks fo The options are: -• Enabled: Enforces the PKI certification path validation for a given executable file before it is permitted to run. +• Enabled: Enforces the PKI certification path validation for a given executable file before it is permitted to run. -• Disabled: (Default) Does not enforce PKI certification path validation before a given executable file is permitted to run. - 1 - - - - - - - - - - - text/plain - - phone - - - - UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations - - - - - User Account Control: Only elevate UIAccess applications that are installed in secure locations - -This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following: - -- …\Program Files\, including subfolders -- …\Windows\system32\ -- …\Program Files (x86)\, including subfolders for 64-bit versions of Windows - -Note: Windows enforces a public key infrastructure (PKI) signature check on any interactive application that requests to run with a UIAccess integrity level regardless of the state of this security setting. - -The options are: - -• Enabled: (Default) If an application resides in a secure location in the file system, it runs only with UIAccess integrity. - -• Disabled: An application runs with UIAccess integrity even if it does not reside in a secure location in the file system. - 1 - - - - - - - - - - - text/plain - - phone - - - - UserAccountControl_RunAllAdministratorsInAdminApprovalMode - - - - - User Account Control: Turn on Admin Approval Mode - -This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. - -The options are: - -• Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. - -• Disabled: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. +• Disabled: (Default) Does not enforce PKI certification path validation before a given executable file is permitted to run. 0 @@ -48893,6 +52559,77 @@ The options are: text/plain phone + LastWrite + + + + UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations + + + + + User Account Control: Only elevate UIAccess applications that are installed in secure locations + +This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following: + +- …\Program Files\, including subfolders +- …\Windows\system32\ +- …\Program Files (x86)\, including subfolders for 64-bit versions of Windows + +Note: Windows enforces a public key infrastructure (PKI) signature check on any interactive application that requests to run with a UIAccess integrity level regardless of the state of this security setting. + +The options are: + +• Enabled: (Default) If an application resides in a secure location in the file system, it runs only with UIAccess integrity. + +• Disabled: An application runs with UIAccess integrity even if it does not reside in a secure location in the file system. + 1 + + + + + + + + + + + text/plain + + phone + LastWrite + + + + UserAccountControl_RunAllAdministratorsInAdminApprovalMode + + + + + User Account Control: Turn on Admin Approval Mode + +This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. + +The options are: + +• Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. + +• Disabled: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. + 1 + + + + + + + + + + + text/plain + + phone + LastWrite @@ -48907,9 +52644,9 @@ This policy setting controls whether the elevation request prompt is displayed o The options are: -• Enabled: (Default) All elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users. +• Enabled: (Default) All elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users. -• Disabled: All elevation requests go to the interactive user's desktop. Prompt behavior policy settings for administrators and standard users are used. +• Disabled: All elevation requests go to the interactive user's desktop. Prompt behavior policy settings for administrators and standard users are used. 1 @@ -48924,6 +52661,7 @@ The options are: text/plain phone + LastWrite @@ -48938,10 +52676,10 @@ This policy setting controls the behavior of Admin Approval Mode for the built-i The options are: -• Enabled: The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation. +• Enabled: The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation. -• Disabled: (Default) The built-in Administrator account runs all applications with full administrative privilege. - 1 +• Disabled: (Default) The built-in Administrator account runs all applications with full administrative privilege. + 0 @@ -48955,6 +52693,7 @@ The options are: text/plain phone + LastWrite @@ -48969,9 +52708,9 @@ This policy setting controls whether application write failures are redirected t The options are: -• Enabled: (Default) Application write failures are redirected at run time to defined user locations for both the file system and registry. +• Enabled: (Default) Application write failures are redirected at run time to defined user locations for both the file system and registry. -• Disabled: Applications that write data to protected locations fail. +• Disabled: Applications that write data to protected locations fail. 1 @@ -48986,6 +52725,7 @@ The options are: text/plain phone + LastWrite @@ -49028,6 +52768,7 @@ The options are: text/plain + LastWrite @@ -49071,6 +52812,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -49113,6 +52855,7 @@ The options are: text/plain + LastWrite @@ -49135,6 +52878,7 @@ The options are: text/plain + LastWrite @@ -49178,6 +52922,7 @@ The options are: text/plain desktop + LowestValueMostSecure @@ -49201,6 +52946,7 @@ The options are: text/plain desktop + LowestValueMostSecure @@ -49224,6 +52970,7 @@ The options are: text/plain desktop + LowestValueMostSecure @@ -49266,6 +53013,7 @@ The options are: text/plain + LastWrite @@ -49288,6 +53036,7 @@ The options are: text/plain + LastWrite @@ -49310,6 +53059,7 @@ The options are: text/plain + LastWrite @@ -49332,6 +53082,7 @@ The options are: text/plain + LastWrite @@ -49354,6 +53105,7 @@ The options are: text/plain + LastWrite @@ -49376,6 +53128,7 @@ The options are: text/plain + LastWrite @@ -49398,6 +53151,7 @@ The options are: text/plain + LastWrite @@ -49420,6 +53174,7 @@ The options are: text/plain + LastWrite @@ -49466,6 +53221,7 @@ The options are: power.admx Power~AT~System~PowerManagementCat~PowerSleepSettingsCat AllowStandbyStatesAC_2 + LastWrite @@ -49492,6 +53248,7 @@ The options are: power.admx Power~AT~System~PowerManagementCat~PowerVideoSettingsCat VideoPowerDownTimeOutDC_2 + LastWrite @@ -49518,6 +53275,7 @@ The options are: power.admx Power~AT~System~PowerManagementCat~PowerVideoSettingsCat VideoPowerDownTimeOutAC_2 + LastWrite @@ -49544,6 +53302,7 @@ The options are: power.admx Power~AT~System~PowerManagementCat~PowerSleepSettingsCat DCHibernateTimeOut_2 + LastWrite @@ -49570,6 +53329,7 @@ The options are: power.admx Power~AT~System~PowerManagementCat~PowerSleepSettingsCat ACHibernateTimeOut_2 + LastWrite @@ -49596,6 +53356,7 @@ The options are: power.admx Power~AT~System~PowerManagementCat~PowerSleepSettingsCat DCPromptForPasswordOnResume_2 + LastWrite @@ -49622,6 +53383,7 @@ The options are: power.admx Power~AT~System~PowerManagementCat~PowerSleepSettingsCat ACPromptForPasswordOnResume_2 + LastWrite @@ -49648,6 +53410,7 @@ The options are: power.admx Power~AT~System~PowerManagementCat~PowerSleepSettingsCat DCStandbyTimeOut_2 + LastWrite @@ -49674,6 +53437,7 @@ The options are: power.admx Power~AT~System~PowerManagementCat~PowerSleepSettingsCat ACStandbyTimeOut_2 + LastWrite @@ -49720,6 +53484,7 @@ The options are: Printing.admx Printing~AT~ControlPanel~CplPrinters PointAndPrint_Restrictions_Win7 + LastWrite @@ -49746,6 +53511,7 @@ The options are: Printing2.admx Printing2~AT~Printers PublishPrinters + LastWrite @@ -49788,7 +53554,7 @@ The options are: text/plain - desktop + LowestValueMostSecure @@ -49812,6 +53578,7 @@ The options are: text/plain 10.0.10240 + LowestValueMostSecure @@ -49834,6 +53601,7 @@ The options are: text/plain + LowestValueMostSecureZeroHasNoLimits @@ -49856,6 +53624,7 @@ The options are: text/plain + HighestValueMostSecure @@ -49878,6 +53647,7 @@ The options are: text/plain + HighestValueMostSecure @@ -49900,6 +53670,8 @@ The options are: text/plain + LastWrite + ; @@ -49922,6 +53694,8 @@ The options are: text/plain + LastWrite + ; @@ -49944,6 +53718,8 @@ The options are: text/plain + LastWrite + ; @@ -49966,6 +53742,7 @@ The options are: text/plain + HighestValueMostSecure @@ -49988,6 +53765,8 @@ The options are: text/plain + LastWrite + ; @@ -50010,6 +53789,8 @@ The options are: text/plain + LastWrite + ; @@ -50032,6 +53813,8 @@ The options are: text/plain + LastWrite + ; @@ -50054,6 +53837,7 @@ The options are: text/plain + HighestValueMostSecure @@ -50076,6 +53860,8 @@ The options are: text/plain + LastWrite + ; @@ -50098,6 +53884,8 @@ The options are: text/plain + LastWrite + ; @@ -50120,6 +53908,8 @@ The options are: text/plain + LastWrite + ; @@ -50142,6 +53932,7 @@ The options are: text/plain + HighestValueMostSecure @@ -50164,6 +53955,8 @@ The options are: text/plain + LastWrite + ; @@ -50186,6 +53979,8 @@ The options are: text/plain + LastWrite + ; @@ -50208,94 +54003,8 @@ The options are: text/plain - - - - LetAppsAccessCellularData - - - - - This policy setting specifies whether Windows apps can access cellular data. - 0 - - - - - - - - - - - text/plain - - - - - LetAppsAccessCellularData_ForceAllowTheseApps - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. - - - - - - - - - - - - text/plain - - - - - LetAppsAccessCellularData_ForceDenyTheseApps - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. - - - - - - - - - - - - text/plain - - - - - LetAppsAccessCellularData_UserInControlOfTheseApps - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data privacy setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. - - - - - - - - - - - - text/plain - + LastWrite + ; @@ -50318,6 +54027,7 @@ The options are: text/plain + HighestValueMostSecure @@ -50340,6 +54050,8 @@ The options are: text/plain + LastWrite + ; @@ -50362,6 +54074,8 @@ The options are: text/plain + LastWrite + ; @@ -50384,6 +54098,8 @@ The options are: text/plain + LastWrite + ; @@ -50406,6 +54122,7 @@ The options are: text/plain + HighestValueMostSecure @@ -50428,6 +54145,8 @@ The options are: text/plain + LastWrite + ; @@ -50450,6 +54169,8 @@ The options are: text/plain + LastWrite + ; @@ -50472,6 +54193,8 @@ The options are: text/plain + LastWrite + ; @@ -50494,6 +54217,7 @@ The options are: text/plain + HighestValueMostSecure @@ -50516,6 +54240,8 @@ The options are: text/plain + LastWrite + ; @@ -50538,6 +54264,8 @@ The options are: text/plain + LastWrite + ; @@ -50560,6 +54288,8 @@ The options are: text/plain + LastWrite + ; @@ -50582,6 +54312,7 @@ The options are: text/plain + HighestValueMostSecure @@ -50604,6 +54335,8 @@ The options are: text/plain + LastWrite + ; @@ -50626,6 +54359,8 @@ The options are: text/plain + LastWrite + ; @@ -50648,6 +54383,8 @@ The options are: text/plain + LastWrite + ; @@ -50670,6 +54407,7 @@ The options are: text/plain + HighestValueMostSecure @@ -50692,6 +54430,8 @@ The options are: text/plain + LastWrite + ; @@ -50714,6 +54454,8 @@ The options are: text/plain + LastWrite + ; @@ -50736,6 +54478,8 @@ The options are: text/plain + LastWrite + ; @@ -50758,6 +54502,7 @@ The options are: text/plain + HighestValueMostSecure @@ -50780,6 +54525,8 @@ The options are: text/plain + LastWrite + ; @@ -50802,6 +54549,8 @@ The options are: text/plain + LastWrite + ; @@ -50824,6 +54573,8 @@ The options are: text/plain + LastWrite + ; @@ -50846,6 +54597,7 @@ The options are: text/plain + HighestValueMostSecure @@ -50868,6 +54620,8 @@ The options are: text/plain + LastWrite + ; @@ -50890,6 +54644,8 @@ The options are: text/plain + LastWrite + ; @@ -50912,6 +54668,8 @@ The options are: text/plain + LastWrite + ; @@ -50934,6 +54692,7 @@ The options are: text/plain + HighestValueMostSecure @@ -50956,6 +54715,8 @@ The options are: text/plain + LastWrite + ; @@ -50978,6 +54739,8 @@ The options are: text/plain + LastWrite + ; @@ -51000,6 +54763,8 @@ The options are: text/plain + LastWrite + ; @@ -51022,6 +54787,7 @@ The options are: text/plain + HighestValueMostSecure @@ -51044,6 +54810,8 @@ The options are: text/plain + LastWrite + ; @@ -51066,6 +54834,8 @@ The options are: text/plain + LastWrite + ; @@ -51088,6 +54858,8 @@ The options are: text/plain + LastWrite + ; @@ -51110,6 +54882,7 @@ The options are: text/plain + HighestValueMostSecure @@ -51132,6 +54905,8 @@ The options are: text/plain + LastWrite + ; @@ -51154,6 +54929,8 @@ The options are: text/plain + LastWrite + ; @@ -51176,6 +54953,8 @@ The options are: text/plain + LastWrite + ; @@ -51198,6 +54977,7 @@ The options are: text/plain + HighestValueMostSecure @@ -51220,6 +55000,8 @@ The options are: text/plain + LastWrite + ; @@ -51242,6 +55024,8 @@ The options are: text/plain + LastWrite + ; @@ -51264,6 +55048,8 @@ The options are: text/plain + LastWrite + ; @@ -51286,6 +55072,7 @@ The options are: text/plain + HighestValueMostSecure @@ -51308,6 +55095,8 @@ The options are: text/plain + LastWrite + ; @@ -51330,6 +55119,8 @@ The options are: text/plain + LastWrite + ; @@ -51352,6 +55143,8 @@ The options are: text/plain + LastWrite + ; @@ -51374,6 +55167,7 @@ The options are: text/plain + HighestValueMostSecure @@ -51396,6 +55190,8 @@ The options are: text/plain + LastWrite + ; @@ -51418,6 +55214,8 @@ The options are: text/plain + LastWrite + ; @@ -51440,6 +55238,8 @@ The options are: text/plain + LastWrite + ; @@ -51448,7 +55248,7 @@ The options are: - This policy setting specifies whether Windows apps can sync with devices. + This policy setting specifies whether Windows apps can communicate with unpaired wireless devices. 0 @@ -51462,6 +55262,7 @@ The options are: text/plain + HighestValueMostSecure @@ -51470,7 +55271,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -51484,6 +55285,8 @@ The options are: text/plain + LastWrite + ; @@ -51492,7 +55295,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -51506,6 +55309,8 @@ The options are: text/plain + LastWrite + ; @@ -51514,7 +55319,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'sync with devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -51528,6 +55333,8 @@ The options are: text/plain + LastWrite + ; @@ -51550,6 +55357,7 @@ The options are: text/plain + HighestValueMostSecure @@ -51596,6 +55404,7 @@ The options are: remoteassistance.admx RemoteAssistance~AT~System~RemoteAssist RA_Options + LastWrite @@ -51622,6 +55431,7 @@ The options are: remoteassistance.admx RemoteAssistance~AT~System~RemoteAssist RA_Logging + LastWrite @@ -51648,6 +55458,7 @@ The options are: remoteassistance.admx RemoteAssistance~AT~System~RemoteAssist RA_Solicit + LastWrite @@ -51674,6 +55485,7 @@ The options are: remoteassistance.admx RemoteAssistance~AT~System~RemoteAssist RA_Unsolicit + LastWrite @@ -51720,6 +55532,7 @@ The options are: terminalserver.admx TerminalServer~AT~WindowsComponents~TS_GP_NODE~TS_TERMINAL_SERVER~TS_CONNECTIONS TS_DISABLE_CONNECTIONS + LastWrite @@ -51746,6 +55559,7 @@ The options are: terminalserver.admx TerminalServer~AT~WindowsComponents~TS_GP_NODE~TS_TERMINAL_SERVER~TS_SECURITY TS_ENCRYPTION_POLICY + LastWrite @@ -51772,6 +55586,7 @@ The options are: terminalserver.admx TerminalServer~AT~WindowsComponents~TS_GP_NODE~TS_TERMINAL_SERVER~TS_REDIRECTION TS_CLIENT_DRIVE_M + LastWrite @@ -51798,6 +55613,7 @@ The options are: terminalserver.admx TerminalServer~AT~WindowsComponents~TS_GP_NODE~TS_CLIENT TS_CLIENT_DISABLE_PASSWORD_SAVING_2 + LastWrite @@ -51824,6 +55640,7 @@ The options are: terminalserver.admx TerminalServer~AT~WindowsComponents~TS_GP_NODE~TS_TERMINAL_SERVER~TS_SECURITY TS_PASSWORD + LastWrite @@ -51850,6 +55667,7 @@ The options are: terminalserver.admx TerminalServer~AT~WindowsComponents~TS_GP_NODE~TS_TERMINAL_SERVER~TS_SECURITY TS_RPC_ENCRYPTION + LastWrite @@ -51896,6 +55714,7 @@ The options are: WindowsRemoteManagement.admx WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMClient AllowBasic_2 + LastWrite @@ -51922,6 +55741,7 @@ The options are: WindowsRemoteManagement.admx WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService AllowBasic_1 + LastWrite @@ -51946,8 +55766,9 @@ The options are: phone WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService - AllowCredSSP_1 + WindowsRemoteManagement~AT~WindowsComponents~WinRMClient + AllowCredSSP_2 + LastWrite @@ -51973,7 +55794,8 @@ The options are: phone WindowsRemoteManagement.admx WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService - AllowCredSSP_2 + AllowCredSSP_1 + LastWrite @@ -52000,6 +55822,7 @@ The options are: WindowsRemoteManagement.admx WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService AllowAutoConfig + LastWrite @@ -52026,6 +55849,7 @@ The options are: WindowsRemoteManagement.admx WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMClient AllowUnencrypted_2 + LastWrite @@ -52052,6 +55876,7 @@ The options are: WindowsRemoteManagement.admx WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService AllowUnencrypted_1 + LastWrite @@ -52078,6 +55903,7 @@ The options are: WindowsRemoteManagement.admx WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMClient DisallowDigest + LastWrite @@ -52102,8 +55928,9 @@ The options are: phone WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService - DisallowNegotiate_1 + WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMClient + DisallowNegotiate_2 + LastWrite @@ -52128,8 +55955,9 @@ The options are: phone WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMClient - DisallowNegotiate_2 + WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService + DisallowNegotiate_1 + LastWrite @@ -52156,6 +55984,7 @@ The options are: WindowsRemoteManagement.admx WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService DisableRunAs + LastWrite @@ -52182,6 +56011,7 @@ The options are: WindowsRemoteManagement.admx WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService CBTHardeningLevel_1 + LastWrite @@ -52208,6 +56038,7 @@ The options are: WindowsRemoteManagement.admx WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMClient TrustedHosts + LastWrite @@ -52234,6 +56065,7 @@ The options are: WindowsRemoteManagement.admx WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService HttpCompatibilityListener + LastWrite @@ -52260,6 +56092,7 @@ The options are: WindowsRemoteManagement.admx WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService HttpsCompatibilityListener + LastWrite @@ -52306,6 +56139,7 @@ The options are: rpc.admx RPC~AT~System~Rpc RpcRestrictRemoteClients + LastWrite @@ -52332,6 +56166,7 @@ The options are: rpc.admx RPC~AT~System~Rpc RpcEnableAuthEpResolution + LastWrite @@ -52378,6 +56213,7 @@ The options are: WindowsRemoteShell.admx WindowsRemoteShell~AT~WindowsComponents~WinRS AllowRemoteShellAccess + LastWrite @@ -52404,6 +56240,7 @@ The options are: WindowsRemoteShell.admx WindowsRemoteShell~AT~WindowsComponents~WinRS MaxConcurrentUsers + LastWrite @@ -52430,6 +56267,7 @@ The options are: WindowsRemoteShell.admx WindowsRemoteShell~AT~WindowsComponents~WinRS IdleTimeout + LastWrite @@ -52456,6 +56294,7 @@ The options are: WindowsRemoteShell.admx WindowsRemoteShell~AT~WindowsComponents~WinRS MaxMemoryPerShellMB + LastWrite @@ -52482,6 +56321,7 @@ The options are: WindowsRemoteShell.admx WindowsRemoteShell~AT~WindowsComponents~WinRS MaxProcessesPerShell + LastWrite @@ -52508,6 +56348,7 @@ The options are: WindowsRemoteShell.admx WindowsRemoteShell~AT~WindowsComponents~WinRS MaxShellsPerUser + LastWrite @@ -52534,6 +56375,7 @@ The options are: WindowsRemoteShell.admx WindowsRemoteShell~AT~WindowsComponents~WinRS ShellTimeOut + LastWrite @@ -52556,6 +56398,29 @@ The options are: + + AllowCloudSearch + + + + + + 2 + + + + + + + + + + + text/plain + + LowestValueMostSecure + + AllowIndexingEncryptedStoresOrItems @@ -52576,6 +56441,7 @@ The options are: text/plain + LowestValueMostSecure @@ -52598,6 +56464,7 @@ The options are: text/plain + LowestValueMostSecure @@ -52620,6 +56487,7 @@ The options are: text/plain + LowestValueMostSecure @@ -52642,6 +56510,7 @@ The options are: text/plain + HighestValueMostSecure @@ -52664,6 +56533,7 @@ The options are: text/plain + LowestValueMostSecure @@ -52686,6 +56556,7 @@ The options are: text/plain + HighestValueMostSecure @@ -52708,6 +56579,7 @@ The options are: text/plain + HighestValueMostSecure @@ -52730,6 +56602,7 @@ The options are: text/plain + HighestValueMostSecure @@ -52752,6 +56625,7 @@ The options are: text/plain + HighestValueMostSecure @@ -52774,6 +56648,7 @@ The options are: text/plain + HighestValueMostSecure @@ -52797,6 +56672,7 @@ The options are: text/plain desktop + HighestValueMostSecure @@ -52839,6 +56715,7 @@ The options are: text/plain + LowestValueMostSecure @@ -52862,6 +56739,7 @@ The options are: text/plain desktop + LowestValueMostSecure @@ -52884,6 +56762,7 @@ The options are: text/plain + LowestValueMostSecure @@ -52907,6 +56786,7 @@ The options are: text/plain desktop + LowestValueMostSecure @@ -52930,6 +56810,7 @@ The options are: text/plain phone + HighestValueMostSecure @@ -52952,6 +56833,7 @@ The options are: text/plain + LastWrite @@ -52974,6 +56856,7 @@ The options are: text/plain + HighestValueMostSecure @@ -52996,6 +56879,7 @@ The options are: text/plain + HighestValueMostSecure @@ -53018,6 +56902,7 @@ The options are: text/plain + HighestValueMostSecure @@ -53061,6 +56946,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53083,6 +56969,7 @@ The options are: text/plain + LowestValueMostSecure @@ -53105,6 +56992,7 @@ The options are: text/plain + LowestValueMostSecure @@ -53127,6 +57015,7 @@ The options are: text/plain + LowestValueMostSecure @@ -53150,6 +57039,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53173,6 +57063,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53196,6 +57087,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53219,6 +57111,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53241,6 +57134,7 @@ The options are: text/plain + LowestValueMostSecure @@ -53264,6 +57158,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53286,6 +57181,7 @@ The options are: text/plain + LowestValueMostSecure @@ -53308,6 +57204,7 @@ The options are: text/plain + LastWrite @@ -53351,6 +57248,7 @@ The options are: text/plain phone + HighestValueMostSecure @@ -53374,6 +57272,7 @@ The options are: text/plain phone + HighestValueMostSecure @@ -53397,6 +57296,7 @@ The options are: text/plain phone + HighestValueMostSecure @@ -53439,6 +57339,7 @@ The options are: text/plain + LowestValueMostSecure @@ -53482,6 +57383,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53505,6 +57407,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53528,6 +57431,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53551,6 +57455,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53574,6 +57479,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53597,6 +57503,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53620,6 +57527,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53643,6 +57551,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53666,6 +57575,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53689,6 +57599,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53712,6 +57623,7 @@ The options are: text/plain phone + LastWrite @@ -53735,6 +57647,7 @@ The options are: text/plain phone + LastWrite @@ -53757,6 +57670,7 @@ The options are: text/plain + LowestValueMostSecure @@ -53780,6 +57694,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53802,6 +57717,7 @@ The options are: text/plain + LowestValueMostSecure @@ -53824,6 +57740,7 @@ The options are: text/plain + LowestValueMostSecure @@ -53847,6 +57764,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53869,6 +57787,7 @@ The options are: text/plain + LowestValueMostSecure @@ -53892,6 +57811,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53915,6 +57835,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -53937,6 +57858,7 @@ The options are: text/plain + LowestValueMostSecure @@ -53959,6 +57881,7 @@ The options are: text/plain + LowestValueMostSecure @@ -53981,6 +57904,7 @@ The options are: text/plain + LowestValueMostSecure @@ -54003,6 +57927,7 @@ The options are: text/plain + LowestValueMostSecure @@ -54025,6 +57950,7 @@ The options are: text/plain + LowestValueMostSecure @@ -54047,6 +57973,7 @@ The options are: text/plain + LowestValueMostSecure @@ -54070,6 +57997,7 @@ The options are: text/plain phone + LastWrite @@ -54093,6 +58021,7 @@ The options are: text/plain phone + HighestValueMostSecure @@ -54116,6 +58045,7 @@ The options are: text/plain phone + LastWrite @@ -54138,6 +58068,30 @@ The options are: + + AllowDiskHealthModelUpdates + + + + + + 1 + + + + + + + + + + + text/plain + + phone + LastWrite + + EnhancedStorageDevices @@ -54162,6 +58116,7 @@ The options are: enhancedstorage.admx EnhancedStorage~AT~System~EnStorDeviceAccess TCGSecurityActivationDisabled + LastWrite @@ -54204,6 +58159,7 @@ The options are: text/plain + LowestValueMostSecure @@ -54226,6 +58182,7 @@ The options are: text/plain + LowestValueMostSecure @@ -54248,6 +58205,7 @@ The options are: text/plain + LowestValueMostSecure @@ -54270,6 +58228,7 @@ The options are: text/plain + LowestValueMostSecure @@ -54292,6 +58251,7 @@ The options are: text/plain + LowestValueMostSecure @@ -54314,6 +58274,7 @@ The options are: text/plain + LowestValueMostSecure @@ -54336,6 +58297,7 @@ The options are: text/plain + LowestValueMostSecure @@ -54358,6 +58320,7 @@ The options are: text/plain + LowestValueMostSecure @@ -54384,6 +58347,7 @@ The options are: earlylauncham.admx EarlyLaunchAM~AT~System~ELAMCategory POL_DriverLoadPolicy_Name + LastWrite @@ -54392,7 +58356,7 @@ The options are: - This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Windows Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. + This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Windows Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. 0 @@ -54406,6 +58370,7 @@ The options are: text/plain + HighestValueMostSecure @@ -54432,6 +58397,30 @@ The options are: systemrestore.admx SystemRestore~AT~System~SR SR_DisableSR + LastWrite + + + + FeedbackHubAlwaysSaveDiagnosticsLocally + + + + + Diagnostic files created when a feedback is filed in the Feedback Hub app will always be saved locally. If this policy is not present or set to false, users will be presented with the option to save locally. The default is to not save locally. + 0 + + + + + + + + + + + text/plain + + LastWrite @@ -54454,6 +58443,7 @@ The options are: text/plain + LastWrite @@ -54497,6 +58487,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -54520,6 +58511,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -54543,6 +58535,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -54566,6 +58559,7 @@ The options are: text/plain phone + HighestValueMostSecure @@ -54589,6 +58583,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -54612,6 +58607,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -54635,6 +58631,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -54657,6 +58654,7 @@ The options are: text/plain + LowestValueMostSecure @@ -54680,6 +58678,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -54702,6 +58701,7 @@ The options are: text/plain + HighestValueMostSecure @@ -54725,6 +58725,7 @@ The options are: text/plain phone + HighestValueMostSecure @@ -54748,6 +58749,7 @@ The options are: text/plain phone + HighestValueMostSecure @@ -54791,6 +58793,7 @@ The options are: text/plain desktop + LowestValueMostSecure @@ -54833,6 +58836,7 @@ The options are: text/plain + LastWrite @@ -54855,6 +58859,7 @@ The options are: text/plain + LastWrite @@ -54877,6 +58882,7 @@ The options are: text/plain + LastWrite @@ -54899,6 +58905,7 @@ The options are: text/plain + LowestValueMostSecure @@ -54921,6 +58928,7 @@ The options are: text/plain + LastWrite @@ -54944,6 +58952,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -54966,6 +58975,7 @@ The options are: text/plain + LowestValueMostSecure @@ -54988,6 +58998,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55010,6 +59021,7 @@ The options are: text/plain + LastWrite @@ -55032,6 +59044,7 @@ The options are: text/plain + LastWrite @@ -55054,6 +59067,7 @@ The options are: text/plain + LastWrite @@ -55076,6 +59090,7 @@ The options are: text/plain + LastWrite @@ -55098,6 +59113,7 @@ The options are: text/plain + LastWrite @@ -55120,6 +59136,7 @@ The options are: text/plain + LastWrite @@ -55142,6 +59159,7 @@ The options are: text/plain + LastWrite @@ -55164,6 +59182,7 @@ The options are: text/plain + LastWrite @@ -55186,6 +59205,30 @@ The options are: text/plain + LastWrite + + + + DisableDualScan + + + + + Do not allow update deferral policies to cause scans against Windows Update + 0 + + + + + + + + + + + text/plain + + LastWrite @@ -55208,6 +59251,7 @@ The options are: text/plain + LastWrite @@ -55230,6 +59274,7 @@ The options are: text/plain + LastWrite @@ -55252,6 +59297,7 @@ The options are: text/plain + LastWrite @@ -55274,6 +59320,7 @@ The options are: text/plain + LastWrite @@ -55296,6 +59343,7 @@ The options are: text/plain + LastWrite @@ -55318,6 +59366,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55340,10 +59389,11 @@ The options are: text/plain + LowestValueMostSecure - ManageBuildPreview + ManagePreviewBuilds @@ -55362,6 +59412,7 @@ The options are: text/plain + LastWrite @@ -55384,6 +59435,7 @@ The options are: text/plain + LastWrite @@ -55406,6 +59458,7 @@ The options are: text/plain + LastWrite @@ -55428,6 +59481,7 @@ The options are: text/plain + LastWrite @@ -55450,6 +59504,7 @@ The options are: text/plain + LastWrite @@ -55472,6 +59527,7 @@ The options are: text/plain + LastWrite @@ -55494,6 +59550,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55516,6 +59573,7 @@ The options are: text/plain + LastWrite @@ -55538,6 +59596,7 @@ The options are: text/plain + HighestValueMostSecure @@ -55560,6 +59619,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55582,6 +59642,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55604,6 +59665,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55626,6 +59688,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55648,6 +59711,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55670,6 +59734,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55692,6 +59757,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55714,6 +59780,7 @@ The options are: text/plain + LastWrite @@ -55736,6 +59803,7 @@ The options are: text/plain + LastWrite @@ -55758,6 +59826,7 @@ The options are: text/plain + LastWrite @@ -55780,6 +59849,7 @@ The options are: text/plain + LastWrite @@ -55802,6 +59872,7 @@ The options are: text/plain + LastWrite @@ -55825,6 +59896,7 @@ The options are: text/plain phone + LastWrite @@ -55867,6 +59939,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55889,6 +59962,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55911,6 +59985,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55933,6 +60008,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55955,6 +60031,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55977,6 +60054,7 @@ The options are: text/plain + HighestValueMostSecureZeroHasNoLimits @@ -56020,6 +60098,7 @@ The options are: text/plain phone + LastWrite @@ -56043,6 +60122,7 @@ The options are: text/plain phone + LastWrite @@ -56066,6 +60146,7 @@ The options are: text/plain phone + LastWrite @@ -56089,6 +60170,7 @@ The options are: text/plain phone + LastWrite @@ -56112,6 +60194,7 @@ The options are: text/plain phone + LastWrite @@ -56135,6 +60218,7 @@ The options are: text/plain phone + LastWrite @@ -56158,6 +60242,7 @@ The options are: text/plain phone + LastWrite @@ -56181,6 +60266,7 @@ The options are: text/plain phone + LastWrite @@ -56204,6 +60290,7 @@ The options are: text/plain phone + LastWrite @@ -56227,6 +60314,7 @@ The options are: text/plain phone + LastWrite @@ -56250,6 +60338,7 @@ The options are: text/plain phone + LastWrite @@ -56273,6 +60362,7 @@ The options are: text/plain phone + LastWrite @@ -56296,6 +60386,7 @@ The options are: text/plain phone + LastWrite @@ -56319,6 +60410,7 @@ The options are: text/plain phone + LastWrite @@ -56362,6 +60454,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -56385,6 +60478,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -56431,6 +60525,7 @@ The options are: logon.admx Logon~AT~System~Logon DisableLockScreenAppNotifications + LastWrite @@ -56457,6 +60552,7 @@ The options are: logon.admx Logon~AT~System~Logon DontDisplayNetworkSelectionUI + LastWrite @@ -56479,6 +60575,7 @@ The options are: text/plain + HighestValueMostSecure @@ -56521,6 +60618,7 @@ The options are: text/plain + LowestValueMostSecure @@ -56543,6 +60641,7 @@ The options are: text/plain + LowestValueMostSecure @@ -56567,6 +60666,7 @@ The options are: text/plain + LowestValueMostSecure @@ -56591,6 +60691,7 @@ The options are: text/plain + LowestValueMostSecure @@ -56616,6 +60717,7 @@ The options are: text/plain phone + LowestValueMostSecure @@ -56640,6 +60742,7 @@ The options are: text/plain + LowestValueMostSecure @@ -56662,6 +60765,7 @@ The options are: text/plain + LowestValueMostSecure @@ -56686,6 +60790,7 @@ The options are: text/plain + LowestValueMostSecure diff --git a/windows/deployment/Windows-AutoPilot-EULA-note.md b/windows/deployment/Windows-AutoPilot-EULA-note.md new file mode 100644 index 0000000000..941c15911e --- /dev/null +++ b/windows/deployment/Windows-AutoPilot-EULA-note.md @@ -0,0 +1,20 @@ +--- +title: Windows Autopilot EULA dismissal – important information +description: A notice about EULA dismissal through Windows AutoPilot +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +ms.localizationpriority: high +ms.author: mayam +ms.date: 08/22/2017 +ROBOTS: noindex,nofollow +--- +# Windows Autopilot EULA dismissal – important information + +>[!IMPORTANT] +>The information below isn't the EULA. It is a notice of awareness to the administrator that's configuring to skip End User License Agreement (EULA) during the OOBE (Out-of-Box Experience). + +Using this tool allows you to configure individual installations of Windows on devices managed by your organization. You may choose to suppress or hide certain set-up screens that are normally presented to users when setting up Windows, including the EULA acceptance screen. + +By using this function, you agree that suppressing or hiding any screens that are designed to provide users with notice or acceptance of terms means that you, on behalf of your organization or the individual user as the case may be, have consented to the notices and accepted the applicable terms. This includes your agreement to the terms and conditions of the license or notice that would be presented to the user if you did not suppress or hide it using this tool. You and your users may not use the Windows software on those devices if you have not validly acquired a license for the software from Microsoft or its licensed distributors. \ No newline at end of file diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md index 40f279e10f..a05a03bbe9 100644 --- a/windows/deployment/deploy-enterprise-licenses.md +++ b/windows/deployment/deploy-enterprise-licenses.md @@ -7,6 +7,7 @@ ms.mktglfcycl: deploy localizationpriority: high ms.sitesec: library ms.pagetype: mdt +ms.date: 08/23/2017 author: greg-lindsay --- diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index fddacf3a05..e11c92867c 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -7,6 +7,7 @@ ms.localizationpriority: high ms.prod: w10 ms.sitesec: library ms.pagetype: deploy +ms.date: 08/23/2017 author: greg-lindsay --- diff --git a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md index dd5cbaf8b7..cddacc1917 100644 --- a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md +++ b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md @@ -181,12 +181,12 @@ During the life of a device, it may be necessary or desirable to switch between

- - + + - - + +
[Office CSP](office-csp.md)

Added the following setting in Windows 10, version 1709:

+
    +
  • Installation/CurrentStatus
    • +
+
[Policy CSP](policy-configuration-service-provider.md)

Added the following new policies for Windows 10, version 1709:

    +
  • Browser/LockdownFavorites
    • +
  • Browser/ProvisionFavorites
  • CredentialProviders/DisableAutomaticReDeploymentCredentials
  • DeviceGuard/EnableVirtualizationBasedSecurity
  • DeviceGuard/RequirePlatformSecurityFeatures
    • @@ -1012,14 +1021,16 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • Power/HibernateTimeoutPluggedIn
  • Power/StandbyTimeoutOnBattery
  • Power/StandbyTimeoutPluggedIn
    • +
  • Privacy/EnableActivityFeed
    • +
  • Privacy/PublishUserActivities
  • Defender/AttackSurfaceReductionOnlyExclusions
  • Defender/AttackSurfaceReductionRules
  • Defender/CloudBlockLevel
  • Defender/CloudExtendedTimeout
    • -
  • Defender/EnableGuardMyFolders
    • +
  • Defender/ControlledFolderAccessAllowedApplications
    • +
  • Defender/ControlledFolderAccessProtectedFolders
    • +
  • Defender/EnableControlledFolderAccess
  • Defender/EnableNetworkProtection
    • -
  • Defender/GuardedFoldersAllowedApplications
    • -
  • Defender/GuardedFoldersList
  • Education/DefaultPrinterName
  • Education/PreventAddingNewPrinters
  • Education/PrinterNames
    • @@ -1315,7 +1326,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware ### August 2017 - +
    @@ -1365,6 +1376,13 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware + + + @@ -1378,10 +1396,21 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
  • Added default values.
    • + + +
    [Office CSP](office-csp.md)

    Added the following setting in Windows 10, version 1709:

    +
      +
    • Installation/CurrentStatus
      • +
    +
    [BitLocker CSP](bitlocker-csp.md) Added information to the ADMX-backed policies.
    [Policy DDF file](policy-ddf-file.md)Added another Policy DDF file [download](http://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) for the 8C release of Windows 10, version 1607, which added the following policies: +
      +
    • Browser/AllowMicrosoftCompatibilityList
      • +
    • Update/DisableDualScan
      • +
    • Update/FillEmptyContentUrls
      • +
    +
    [Policy CSP](policy-configuration-service-provider.md)

    Added the following new policies for Windows 10, version 1709:

      +
    • Browser/ProvisionFavorites
      • +
    • Browser/LockdownFavorites
    • ExploitGuard/ExploitProtectionSettings
    • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
    • LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus
      • @@ -1407,9 +1436,22 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
    • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
    • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
    • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
      • +
    • Privacy/EnableActivityFeed
      • +
    • Privacy/PublishUserActivities

    Changed the name of new policy to CredentialProviders/DisableAutomaticReDeploymentCredentials from CredentialProviders/EnableWindowsAutoPilotResetCredentials.

    +

    Changed the names of the following policies:

    +
      +
    • Defender/GuardedFoldersAllowedApplications to Defender/ControlledFolderAccessAllowedApplications
      • +
    • Defender/GuardedFoldersList to Defender/ControlledFolderAccessProtectedFolders
      • +
    • Defender/EnableGuardMyFolders to Defender/EnableControlledFolderAccess
      • +

    Added links to the additional [ADMX-backed BitLocker policies](policy-csp-bitlocker.md).

    +

    There were issues reported with the previous release of the following policies. These issues were fixed in Window 10, version 1709:

    +
      +
    • Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts
      • +
    • Start/HideAppList
      • +
    diff --git a/windows/client-management/mdm/office-csp.md b/windows/client-management/mdm/office-csp.md index 8b62bdd0c7..96b82f9aa7 100644 --- a/windows/client-management/mdm/office-csp.md +++ b/windows/client-management/mdm/office-csp.md @@ -6,11 +6,14 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 06/19/2017 +ms.date: 08/22/2017 --- # Office CSP +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + The Office configuration service provider (CSP) enables a Microsoft Office client to be installed on a device via the Office Deployment Tool. For more information, see [Configuration options for the Office Deployment Tool](https://technet.microsoft.com/en-us/library/jj219426.aspx). This CSP was added in Windows 10, version 1703. @@ -38,7 +41,7 @@ The following diagram shows the Office configuration service provider in tree fo **Install** -

    Installs office by using the XML data specified in the configuration.xml file. +

    Installs Office by using the XML data specified in the configuration.xml file.

    The supported operations are Get and Execute. @@ -48,13 +51,18 @@ The following diagram shows the Office configuration service provider in tree fo

    The only supported operation is Get. +**CurrentStatus** + +

    Returns an XML of current Office 365 installation status on the device. + +

    The only supported operation is Get. ## Examples Sample SyncML to install Office 365 Business Retail from current channel. ```syntax - + 7 @@ -76,7 +84,7 @@ Sample SyncML to install Office 365 Business Retail from current channel. To uninstall the Office 365 from the system: ```syntax - + 7 @@ -95,6 +103,24 @@ To uninstall the Office 365 from the system: ``` +To get the current status of Office 365 on the device. + +``` syntax + +  +    +      7 +        +          +            ./Vendor/MSFT/Office/Installation/CurrentStatus +          +        +    +    +  + +``` + ## Status code diff --git a/windows/client-management/mdm/office-ddf.md b/windows/client-management/mdm/office-ddf.md index 0fd89434b4..ebd7f2b843 100644 --- a/windows/client-management/mdm/office-ddf.md +++ b/windows/client-management/mdm/office-ddf.md @@ -7,11 +7,14 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 06/19/2017 +ms.date: 08/22/2017 --- # Office DDF +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + This topic shows the OMA DM device description framework (DDF) for the **Office** configuration service provider. DDF files are used only with OMA DM provisioning XML. You can download the DDF files from the links below: @@ -19,7 +22,7 @@ You can download the DDF files from the links below: - [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip) -The XML below is the current version for this CSP. +The XML below is for Windows 10, version 1709. ``` syntax @@ -30,12 +33,12 @@ The XML below is the current version for this CSP. 1.2 Office - ./Vendor/MSFT + ./User/Vendor/MSFT - Root of the office CSP. + Root of the Office CSP. @@ -46,7 +49,7 @@ The XML below is the current version for this CSP. - com.microsoft/1.0/MDM/Office + com.microsoft/1.3/MDM/Office @@ -55,7 +58,7 @@ The XML below is the current version for this CSP. - Installation options for the office CSP. + Installation options for the Office CSP. @@ -100,7 +103,7 @@ The XML below is the current version for this CSP. - The install action will install office given the configuration in the data. The string data is the xml configuration to use in order to install office. + The install action will install Office given the configuration in the data. The string data is the xml configuration to use in order to install Office. @@ -137,6 +140,27 @@ The XML below is the current version for this CSP. + + CurrentStatus + + + + + The current Office 365 installation status on the machine + + + + + + + + + + + text/plain + + + @@ -156,7 +180,7 @@ The XML below is the current version for this CSP. - + com.microsoft/1.3/MDM/Office @@ -243,6 +267,27 @@ The XML below is the current version for this CSP. + + CurrentStatus + + + + + The current Office 365 installation status on the machine + + + + + + + + + + + text/plain + + + diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 69a15107f8..750dc3fc1a 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/14/2017 +ms.date: 08/25/2017 --- # Policy CSP @@ -456,6 +456,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Browser/HomePages
    +
    + Browser/LockdownFavorites +
    Browser/PreventAccessToAboutFlagsInMicrosoftEdge
    @@ -474,6 +477,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Browser/PreventUsingLocalHostIPAddressForWebRTC
    +
    + Browser/ProvisionFavorites +
    Browser/SendIntranetTraffictoInternetExplorer
    @@ -667,7 +673,7 @@ The following diagram shows the Policy configuration service provider in tree fo Defender/DaysToRetainCleanedMalware
    - Defender/EnableGuardMyFolders + Defender/EnableControlledFolderAccess
    Defender/EnableNetworkProtection @@ -682,10 +688,10 @@ The following diagram shows the Policy configuration service provider in tree fo Defender/ExcludedProcesses
    - Defender/GuardedFoldersAllowedApplications + Defender/ControlledFolderAccessAllowedApplications
    - Defender/GuardedFoldersList + Defender/ControlledFolderAccessProtectedFolders
    Defender/PUAProtection @@ -2023,6 +2029,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Privacy/DisableAdvertisingId
    +
    + Privacy/EnableActivityFeed +
    Privacy/LetAppsAccessAccountInfo
    @@ -2239,6 +2248,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps
    +
    + Privacy/PublishUserActivities +
    ### RemoteAssistance policies @@ -3353,6 +3365,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [CredentialProviders/AllowPINLogon](#credentialproviders-allowpinlogon) - [CredentialProviders/BlockPicturePassword](#credentialproviders-blockpicturepassword) - [DataProtection/AllowDirectMemoryAccess](#dataprotection-allowdirectmemoryaccess) +- [Privacy/EnableActivityFeed](#privacy-enableactivityfeed) - [Privacy/LetAppsGetDiagnosticInfo](#privacy-letappsgetdiagnosticinfo) - [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) - [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) @@ -3361,6 +3374,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](#privacy-letappsruninbackground-forceallowtheseapps) - [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](#privacy-letappsruninbackground-forcedenytheseapps) - [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](#privacy-letappsruninbackground-userincontroloftheseapps) +- [Privacy/PublishUserActivities](#privacy-publishuseractivities) - [Security/AllowAddProvisioningPackage](#security-allowaddprovisioningpackage) - [Security/AllowRemoveProvisioningPackage](#security-allowremoveprovisioningpackage) - [Security/RequireDeviceEncryption](#security-requiredeviceencryption) @@ -3406,6 +3420,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [Experience/AllowCortana](#experience-allowcortana) - [Experience/AllowManualMDMUnenrollment](#experience-allowmanualmdmunenrollment) - [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) +- [Privacy/EnableActivityFeed](#privacy-enableactivityfeed) - [Privacy/LetAppsGetDiagnosticInfo](#privacy-letappsgetdiagnosticinfo) - [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) - [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) @@ -3414,6 +3429,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](#privacy-letappsruninbackground-forceallowtheseapps) - [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](#privacy-letappsruninbackground-forcedenytheseapps) - [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](#privacy-letappsruninbackground-userincontroloftheseapps) +- [Privacy/PublishUserActivities](#privacy-publishuseractivities) - [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) - [Security/RequireDeviceEncryption](#security-requiredeviceencryption) - [Settings/AllowDateTime](#settings-allowdatetime) diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index f0d50ff7ac..89fd1b0f08 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/09/2017 +ms.date: 08/25/2017 --- # Policy CSP - Browser @@ -965,6 +965,51 @@ Employees cannot remove these search engines, but they can set any one as the de > [!NOTE] > Turning this setting off, or not configuring it, sets your default Start pages to the webpages specified in App settings. + + + +**Browser/LockdownFavorites** + + +
    + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark3check mark3check mark3check mark3check mark3check mark3
    + + + +

    Added in Windows 10, version 1709. This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge. + +

    If you enable this setting, employees won't be able to add, import, or change anything in the Favorites list. Also as part of this, Save a Favorite, Import settings, and the context menu items (such as, Create a new folder) are all turned off. + +> [!Important] +> Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. + +

      +
    • 0 - Disabled. Do not lockdown Favorites.
      • +
    • 1 - Enabled. Lockdown Favorites.
      • +
    + +

    If you disable or don't configure this setting (default), employees can add, import and make changes to the Favorites list. + +

    Data type is integer. Supported operations are Add, Get, Replace, and Delete. + @@ -1194,6 +1239,49 @@ Employees cannot remove these search engines, but they can set any one as the de +**Browser/ProvisionFavorites** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark3check mark3check mark3check mark3check mark3check mark3
    + + + +

    Added in Windows 10, version 1709. This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. Specify the URL which points to the file that has all the data for provisioning favorites (in html format). You can export a set of favorites from Edge and use that html file for provisioning user machines. +  +

    URL can be specified as: + +- HTTP location: "SiteList"="http://localhost:8080/URLs.html" +- Local network: "SiteList"="\\network\shares\URLs.html" +- Local file: "SiteList"="file:///c:\\Users\\\\Documents\\URLs.html" + +> [!Important] +> Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. + +

    If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar. + +

    Data type is string. Supported operations are Add, Get, Replace, and Delete. + + + **Browser/SendIntranetTraffictoInternetExplorer** diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 42421382a1..2ab2afa893 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -782,7 +782,7 @@ Value type is string. -**Defender/EnableGuardMyFolders** +**Defender/EnableControlledFolderAccess** @@ -809,13 +809,13 @@ Value type is string. > [!NOTE] -> This policy is only enforced in Windows 10 for desktop. +> This policy is only enforced in Windows 10 for desktop. The previous name was EnableGuardMyFolders and changed to EnableControlledFolderAccess.

    Added in Windows 10, version 1709. This policy enables setting the state (On/Off/Audit) for the guard my folders feature. The guard my folders feature removes modify and delete permissions from untrusted applications to certain folders such as My Documents. Value type is integer and the range is 0 - 2. -- 0 (default) - Off -- 1 - Audit mode -- 2 - Enforcement mode +- 0 (default) - Disabled +- 1 - Enabled +- 2 - Audit Mode @@ -977,7 +977,7 @@ Value type is string. -**Defender/GuardedFoldersAllowedApplications** +**Defender/ControlledFolderAccessAllowedApplications**

    @@ -1004,14 +1004,14 @@ Value type is string. > [!NOTE] -> This policy is only enforced in Windows 10 for desktop. +> This policy is only enforced in Windows 10 for desktop. The previous name was GuardedFoldersAllowedApplications and changed to ControlledFolderAccessAllowedApplications.

    Added in Windows 10, version 1709. This policy setting allows user-specified applications to the guard my folders feature. Adding an allowed application means the guard my folders feature will allow the application to modify or delete content in certain folders such as My Documents. In most cases it will not be necessary to add entries. Windows Defender Antivirus will automatically detect and dynamically add applications that are friendly. Value type is string. Use the Unicode  as the substring separator. -**Defender/GuardedFoldersList** +**Defender/ControlledFolderAccessProtectedFolders**

    @@ -1038,7 +1038,7 @@ Value type is string. > [!NOTE] -> This policy is only enforced in Windows 10 for desktop. +> This policy is only enforced in Windows 10 for desktop. The previous name was GuardedFoldersList and changed to ControlledFolderAccessProtectedFolders.

    Added in Windows 10, version 1709. This policy settings allows adding user-specified folder locations to the guard my folders feature. These folders will complement the system defined folders such as My Documents and My Pictures. The list of system folders will be displayed in the user interface and can not be changed. Value type is string. Use the Unicode  as the substring separator. diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index b2969151a6..8f5423f922 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/09/2017 +ms.date: 08/21/2017 --- # Policy CSP - Privacy @@ -34,11 +34,11 @@ ms.date: 08/09/2017

    - - + + - - + + @@ -48,6 +48,9 @@ ms.date: 08/09/2017

    Allows or disallows the automatic acceptance of the pairing and privacy user consent dialog when launching apps. +> [!Note] +> There were issues reported with the previous release of this policy and a fix was added in Windows 10, version 1709. +

    The following list shows the supported values: - 0 (default)– Not allowed. @@ -133,6 +136,42 @@ ms.date: 08/09/2017

    Most restricted value is 0. + + + +**Privacy/EnableActivityFeed** + + +

    Mobile Enterprise
    check mark1check mark1check mark3check mark3 check mark1check mark1check mark3check mark3 check mark check mark
    + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark3check mark3check mark3check mark3check mark3check mark3check mark3
    + + + +Added in Windows 10, version 1709. Allows IT Admins to allow Apps/OS to publish to the activity feed. + +The following list shows the supported values: + +- 0 – Disabled. Apps/OS can't publish the activities and roaming is disabled. (not published to the cloud). +- 1 – (default) Enabled. Apps/OS can publish the activities and will be roamed across device graph. + @@ -2503,6 +2542,42 @@ ms.date: 08/09/2017

    Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'sync with devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + + + +**Privacy/PublishUserActivities** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark3check mark3check mark3check mark3check mark3check mark3check mark3
    + + + +Added in Windows 10, version 1709. Allows It Admins to enable publishing of user activities to the activity feed. + +The following list shows the supported values: + +- 0 – Disabled. Apps/OS can't publish the *user activities*. +- 1 – (default) Enabled. Apps/OS can publish the *user activities*. +

    @@ -2518,7 +2593,7 @@ Footnote: ## Privacy policies supported by Windows Holographic for Business -- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) +- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) - [Privacy/LetAppsGetDiagnosticInfo](#privacy-letappsgetdiagnosticinfo) - [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) - [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) @@ -2545,6 +2620,7 @@ Footnote: ## Privacy policies supported by Microsoft Surface Hub +- [Privacy/EnableActivityFeed](#privacy-enableactivityfeed) - [Privacy/LetAppsGetDiagnosticInfo](#privacy-letappsgetdiagnosticinfo) - [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) - [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) @@ -2553,5 +2629,7 @@ Footnote: - [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](#privacy-letappsruninbackground-forceallowtheseapps) - [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](#privacy-letappsruninbackground-forcedenytheseapps) - [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](#privacy-letappsruninbackground-userincontroloftheseapps) +- [Privacy/PublishUserActivities](#privacy-publishuseractivities) + diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index 6c0dd2a75b..c33b8625ee 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -448,10 +448,10 @@ ms.date: 08/09/2017
cross markcheck mark2check mark3 check mark2check mark2check mark3check mark3 cross mark cross mark
Use media to upgrade to the latest Windows Insider Program build.
Long-Term Servicing Channel (Targeted)Use media to upgrade to a later Long-Term Servicing Channel build. (Note that the Long-Term Servicing Channel build must be a later build.)Semi-Annual Channel (Targeted)Use media to upgrade. Note that the Semi-Annual Channel build must be a later build.
Long-Term Servicing ChannelUse media to upgrade to a later Long-Term Servicing Channel for Business build (Long-Term Servicing Channel build plus fixes). Note that it must be a later build.Semi-Annual ChannelUse media to upgrade. Note that the Semi-Annual Channel build must be a later build.
diff --git a/windows/deployment/vda-subscription-activation.md b/windows/deployment/vda-subscription-activation.md index 8d3a787f3c..a6f560cc33 100644 --- a/windows/deployment/vda-subscription-activation.md +++ b/windows/deployment/vda-subscription-activation.md @@ -7,6 +7,7 @@ ms.mktglfcycl: deploy localizationpriority: high ms.sitesec: library ms.pagetype: mdt +ms.date: 08/23/2017 author: greg-lindsay --- diff --git a/windows/deployment/windows-10-enterprise-e3-overview.md b/windows/deployment/windows-10-enterprise-e3-overview.md index f76208ce9c..5f663ae222 100644 --- a/windows/deployment/windows-10-enterprise-e3-overview.md +++ b/windows/deployment/windows-10-enterprise-e3-overview.md @@ -7,6 +7,7 @@ ms.mktglfcycl: deploy ms.localizationpriority: high ms.sitesec: library ms.pagetype: mdt +ms.date: 08/23/2017 author: greg-lindsay --- diff --git a/windows/deployment/windows-10-enterprise-subscription-activation.md b/windows/deployment/windows-10-enterprise-subscription-activation.md index 8e9912ed68..c767d18075 100644 --- a/windows/deployment/windows-10-enterprise-subscription-activation.md +++ b/windows/deployment/windows-10-enterprise-subscription-activation.md @@ -7,6 +7,7 @@ ms.mktglfcycl: deploy localizationpriority: high ms.sitesec: library ms.pagetype: mdt +ms.date: 08/23/2017 author: greg-lindsay --- diff --git a/windows/deployment/windows-10-poc-mdt.md b/windows/deployment/windows-10-poc-mdt.md index d9870313ca..f7f79e2f18 100644 --- a/windows/deployment/windows-10-poc-mdt.md +++ b/windows/deployment/windows-10-poc-mdt.md @@ -7,6 +7,7 @@ ms.sitesec: library ms.pagetype: deploy keywords: deployment, automate, tools, configure, mdt ms.localizationpriority: high +ms.date: 08/23/2017 author: greg-lindsay --- diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index 63e2727b2a..eb042d424b 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -7,6 +7,7 @@ ms.sitesec: library ms.pagetype: deploy keywords: deployment, automate, tools, configure, sccm ms.localizationpriority: high +ms.date: 08/23/2017 author: greg-lindsay --- diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md index 621de876bd..5a67eebb9e 100644 --- a/windows/deployment/windows-10-poc.md +++ b/windows/deployment/windows-10-poc.md @@ -7,6 +7,7 @@ ms.sitesec: library ms.pagetype: deploy keywords: deployment, automate, tools, configure, mdt, sccm ms.localizationpriority: high +ms.date: 08/23/2017 author: greg-lindsay --- @@ -771,6 +772,27 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to Add-DnsServerForwarder -IPAddress 192.168.0.2 + **Configure service and user accounts** + + Windows 10 deployment with MDT and System Center Configuration Manager requires specific accounts to perform some actions. Service accounts will be created to use for these tasks. A user account is also added in the contoso.com domain that can be used for testing purposes. In the test lab environment, passwords are set to never expire. + + >To keep this test lab relatively simple, we will not create a custom OU structure and set permissions. Required permissions are enabled by adding accounts to the Domain Admins group. To configure these settings in a production environment, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) + + On DC1, open an elevated Windows PowerShell prompt and type the following commands: + + 

+    New-ADUser -Name User1 -UserPrincipalName user1 -Description "User account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
+    New-ADUser -Name MDT_BA -UserPrincipalName MDT_BA -Description "MDT Build Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
+    New-ADUser -Name CM_JD -UserPrincipalName CM_JD -Description "Configuration Manager Join Domain Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
+    New-ADUser -Name CM_NAA -UserPrincipalName CM_NAA -Description "Configuration Manager Network Access Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
+    Add-ADGroupMember "Domain Admins" MDT_BA,CM_JD,CM_NAA
+    Set-ADUser -Identity user1 -PasswordNeverExpires $true
+    Set-ADUser -Identity administrator -PasswordNeverExpires $true
+    Set-ADUser -Identity MDT_BA -PasswordNeverExpires $true
+    Set-ADUser -Identity CM_JD -PasswordNeverExpires $true
+    Set-ADUser -Identity CM_NAA -PasswordNeverExpires $true
+
+ 12. Minimize the DC1 VM window but **do not stop** the VM. Next, the client VM will be started and joined to the contoso.com domain. This is done before adding a gateway to the PoC network so that there is no danger of duplicate DNS registrations for the physical client and its cloned VM in the corporate domain. @@ -984,27 +1006,6 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to Restart-Computer -### Configure service and user accounts - -Windows 10 deployment with MDT and System Center Configuration Manager requires specific accounts to perform some actions. Service accounts will be created to use for these tasks. A user account is also added in the contoso.com domain that can be used for testing purposes. In the test lab environment, passwords are set to never expire. - ->To keep this test lab relatively simple, we will not create a custom OU structure and set permissions. Required permissions are enabled by adding accounts to the Domain Admins group. To configure these settings in a production environment, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) - -On DC1, open an elevated Windows PowerShell prompt and type the following commands: - -
-New-ADUser -Name User1 -UserPrincipalName user1 -Description "User account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
-New-ADUser -Name MDT_BA -UserPrincipalName MDT_BA -Description "MDT Build Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
-New-ADUser -Name CM_JD -UserPrincipalName CM_JD -Description "Configuration Manager Join Domain Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
-New-ADUser -Name CM_NAA -UserPrincipalName CM_NAA -Description "Configuration Manager Network Access Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
-Add-ADGroupMember "Domain Admins" MDT_BA,CM_JD,CM_NAA
-Set-ADUser -Identity user1 -PasswordNeverExpires $true
-Set-ADUser -Identity administrator -PasswordNeverExpires $true
-Set-ADUser -Identity MDT_BA -PasswordNeverExpires $true
-Set-ADUser -Identity CM_JD -PasswordNeverExpires $true
-Set-ADUser -Identity CM_NAA -PasswordNeverExpires $true
-
- This completes configuration of the starting PoC environment. Additional services and tools are installed in subsequent guides. ## Appendix A: Verify the configuration diff --git a/windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md index 79abd8d757..eb1d2a3b47 100644 --- a/windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md +++ b/windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md @@ -82,7 +82,7 @@ Reporting | Configure time out for detections in non-critical failed state | Not Reporting | Configure time out for detections in recently remediated state | Not used Reporting | Configure time out for detections requiring additional action | Not used Reporting | Turn off enhanced notifications | [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md) -Root | Turn off Windows Defender Antivirus | Not used +Root | Turn off Windows Defender Antivirus | Not used (This setting must be set to **Not configured** to ensure any installed third-party antivirus apps work correctly) Root | Define addresses to bypass proxy server | Not used Root | Define proxy auto-config (.pac) for connecting to the network | Not used Root | Define proxy server for connecting to the network | Not used diff --git a/windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md b/windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md index a03b3514c2..c9f657f6f9 100644 --- a/windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md +++ b/windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md @@ -25,7 +25,9 @@ Your environment needs the following hardware to run Application Guard. |--------|-----------| |64-bit CPU|A 64-bit computer is required for hypervisor and virtualization-based security (VBS). For more info about Hyper-V, see [Hyper-V on Windows Server 2016](https://docs.microsoft.com/en-us/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/about/). For more info about hypervisor, see [Hypervisor Specifications](https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/reference/tlfs).| |CPU virtualization extensions|Extended page tables, also called _Second Level Address Translation (SLAT)_

**-AND-**

One of the following virtualization extensions for VBS:

VT-x (Intel)

**-OR-**

AMD-V| -|Hardware memory|4 GB minimum, 8 GB recommended| +|Hardware memory|8 GB minimum, 16 GB recommended| +|Hard disk|5 GB free space, solid state disk (SSD) recommended| +|Input/Output Memory Management Unit (IOMMU) support|Not required, but strongly recommended| ## Software requirements Your environment needs the following hardware to run Application Guard. @@ -34,4 +36,4 @@ Your environment needs the following hardware to run Application Guard. |--------|-----------| |Operating system|Windows 10, Windows Insider Program (Enterprise edition, Build 16188 or later)| |Browser|Microsoft Edge and Internet Explorer| -|Management system|[Microsoft Intune](https://docs.microsoft.com/en-us/intune/)

**-OR-**

[System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/)

**-OR-**

[Group Policy](https://technet.microsoft.com/en-us/library/cc753298(v=ws.11).aspx)

**-OR-**

Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.| \ No newline at end of file +|Management system|[Microsoft Intune](https://docs.microsoft.com/en-us/intune/)

**-OR-**

[System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/)

**-OR-**

[Group Policy](https://technet.microsoft.com/en-us/library/cc753298(v=ws.11).aspx)

**-OR-**

Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.| diff --git a/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md index fb191cc3b3..82f32619ad 100644 --- a/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md @@ -52,10 +52,9 @@ Whenever a change or comment is made to an alert, it is recorded in the **Commen Added comments instantly appear on the pane. ## Suppress alerts +There might be scenarios where you need to suppress alerts from appearing in the Windows Defender ATP portal. Windows Defender ATP lets you create suppression rules for specific alerts that are known to be innocuous such as known tools or processes in your organization. -Windows Defender ATP lets you create suppression rules so you can limit the alerts you see in the **Alerts queue**. - -Suppression rules can be created from an existing alert. +Suppression rules can be created from an existing alert. They can be disabled and reenabled if needed. When a suppression rule is created, it will take effect from the point when the rule is created. The rule will not affect existing alerts already in the queue prior to the rule creation. The rule will only be applied on alerts that satisfy the conditions set after the rule is created. @@ -64,7 +63,9 @@ There are two contexts for a suppression rule that you can choose from: - **Suppress alert on this machine** - **Suppress alert in my organization** -The context of the rule lets you tailor the queue to ensure that only alerts you are interested in will appear. You can use the examples in the following table to help you choose the context for a suppression rule: +The context of the rule lets you tailor what gets surfaced into the portal and ensure that only real security alerts are surfaced into the portal. + +You can use the examples in the following table to help you choose the context for a suppression rule: | **Context** | **Definition** | **Example scenarios** | |:--------------------------------------|:------------------------------------------------------------------------------------------------------------------------------------------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| @@ -87,35 +88,28 @@ Create custom rules to control when alerts are suppressed, or resolved. You can > [!NOTE] > You cannot create a custom or blank suppression rule. You must start from an existing alert. + 4. Specify the conditions for when the rule is applied: - - Alert title - - Indicator of compromise (IOC) - - Suppression conditions + - Alert title + - Indicator of compromise (IOC) + - Suppression conditions > [!NOTE] - > The SHA1 of the alert cannot be modified -5. Specify the action and scope on the alert. You can automatically resolve an alert or hide it from the portal. Alerts that are automatically resolved will appear in the resolved section of the alerts queue. You can also specify to suppress the alert on the machine only or the whole organization. + > The SHA1 of the alert cannot be modified, however you can clear the SHA1 to remove it from the suppression conditions. + +5. Specify the action and scope on the alert.
+ You can automatically resolve an alert or hide it from the portal. Alerts that are automatically resolved will appear in the resolved section of the alerts queue. Alerts that are marked as hidden will be suppressed from the entire system, both on the machine's associated alerts and from the dashboard. You can also specify to suppress the alert on the machine only or the whole organization. 6. Click **Save and close**. -**See the list of suppression rules:** +### View the list of suppression rules -1. Click the settings icon ![The settings icon looks like a cogwheel or gear](images/settings.png) on the main menu bar at the top of the Windows Defender ATP screen. -2. Click **Suppression rules**. +1. Click **Alerts queue** > **Suppression rules**. - ![Click the settings icon and then Suppression rules to create and modify rules](images/atp-suppression-rules.png) - -The list of suppression rules shows all the rules that users in your organization have created. -![Suppression rules show the rule name or title, the context, the date, and an icon to delete the rule](images/rules-legend.png) - -Each rule shows: - -- (1) The title of the alert that is suppressed -- (2) Whether the alert was suppressed for a single machine (clicking the machine name will allow you to investigate the machine) or the entire organization -- (3) The date when the alert was suppressed -- (4) An option to delete the suppression rule, which will cause alerts with this title to be displayed in the queue from this point onwards. +2. The list of suppression rules shows all the rules that users in your organization have created. +You can select rules to open up the **Alert management** pane. From there, you can activate previously disabled rules. ## Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md)