From a5eb49416ffeb18810b3fb0a43999ee7a99e0f2a Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 17 Mar 2023 16:46:44 -0400 Subject: [PATCH 01/26] Remove unreleased SurfaceHub policies --- .../client-management/mdm/surfacehub-csp.md | 163 +----------------- 1 file changed, 1 insertion(+), 162 deletions(-) diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index 1925bbdccc..c16d7da169 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -4,7 +4,7 @@ description: Learn more about the SurfaceHub CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/17/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -28,10 +28,6 @@ The SurfaceHub configuration service provider (CSP) is used to configure Microso The following list shows the SurfaceHub configuration service provider nodes: - ./Vendor/MSFT/SurfaceHub - - [AutopilotSelfdeploy](#autopilotselfdeploy) - - [FriendlyName](#autopilotselfdeployfriendlyname) - - [Password](#autopilotselfdeploypassword) - - [UserPrincipalName](#autopilotselfdeployuserprincipalname) - [DeviceAccount](#deviceaccount) - [CalendarSyncEnabled](#deviceaccountcalendarsyncenabled) - [DomainName](#deviceaccountdomainname) @@ -93,163 +89,6 @@ The following list shows the SurfaceHub configuration service provider nodes: - [VtcAppPackageId](#propertiesvtcapppackageid) - -## AutopilotSelfdeploy - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | - - - -```Device -./Vendor/MSFT/SurfaceHub/AutopilotSelfdeploy -``` - - - - -Node for setting Autopilot self-deployment mode device account information. This information is stored and committed by the Autopilot client during the Enrollment Status Page phase of OOBE for Surface Hub devices that are using Autopilot self-deploying mode. These values should be set only during the first sync phase of enrollment and are ignored at any other time. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | node | -| Access Type | Get | -| Case Sensitive | True | - - - - - - - - - -### AutopilotSelfdeploy/FriendlyName - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | - - - -```Device -./Vendor/MSFT/SurfaceHub/AutopilotSelfdeploy/FriendlyName -``` - - - - -The device friendly name set during Autopilot self-deploying mode on Surface Hub. Get is allowed here but only returns a blank. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | chr (string) | -| Access Type | Get, Replace | - - - - - - - - - -### AutopilotSelfdeploy/Password - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | - - - -```Device -./Vendor/MSFT/SurfaceHub/AutopilotSelfdeploy/Password -``` - - - - -Password for the device account. Get is allowed here, but will always return a blank. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | chr (string) | -| Access Type | Get, Replace | - - - - - - - - - -### AutopilotSelfdeploy/UserPrincipalName - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | - - - -```Device -./Vendor/MSFT/SurfaceHub/AutopilotSelfdeploy/UserPrincipalName -``` - - - - -User principal name (UPN) of the device account. Autopilot on Surface Hub only supports Azure Active Directory, and this should specify the UPN of the device account. Get is allowed here but only returns a blank. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | chr (string) | -| Access Type | Get, Replace | - - - - - - - - ## DeviceAccount From e9df2acc54321f72407baa8dcd5de14292411558 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 17 Mar 2023 17:37:19 -0400 Subject: [PATCH 02/26] Update Surface Hub applicability article --- ...-in-policy-csp-supported-by-surface-hub.md | 625 +++++++++++++++--- 1 file changed, 536 insertions(+), 89 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md index ce20ebe3db..dda5d64123 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -1,99 +1,546 @@ --- -title: Policies in Policy CSP supported by Microsoft Surface Hub -description: Learn about the policies in Policy CSP supported by Microsoft Surface Hub. -ms.reviewer: +title: Policies in Policy CSP supported by Surface Hub +description: Learn about the policies in Policy CSP supported by Surface Hub. +author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.topic: article +ms.date: 03/17/2023 +ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage -author: vinaypamnani-msft -ms.localizationpriority: medium -ms.date: 07/22/2020 +ms.topic: reference --- -# Policies in Policy CSP supported by Microsoft Surface Hub + -- [ApplicationManagement/AllowAppStoreAutoUpdate](./policy-csp-applicationmanagement.md#allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](./policy-csp-applicationmanagement.md#allowdeveloperunlock) -- [Accounts/AllowMicrosoftAccountConnection](./policy-csp-accounts.md#allowmicrosoftaccountconnection) -- [Camera/AllowCamera](policy-csp-camera.md#allowcamera) -- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#showappcellularaccessui) -- [Cryptography/AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#allowfipsalgorithmpolicy) -- [Cryptography/TLSCipherSuites](policy-csp-cryptography.md#tlsciphersuites) -- [Defender/AllowArchiveScanning](policy-csp-defender.md#allowarchivescanning) -- [Defender/AllowBehaviorMonitoring](policy-csp-defender.md#allowbehaviormonitoring) -- [Defender/AllowCloudProtection](policy-csp-defender.md#allowcloudprotection) -- [Defender/AllowEmailScanning](policy-csp-defender.md#allowemailscanning) -- [Defender/AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md#allowfullscanonmappednetworkdrives) -- [Defender/AllowFullScanRemovableDriveScanning](policy-csp-defender.md#allowfullscanremovabledrivescanning) -- [Defender/AllowIOAVProtection](policy-csp-defender.md#allowioavprotection) -- [Defender/AllowOnAccessProtection](policy-csp-defender.md#allowonaccessprotection) -- [Defender/AllowRealtimeMonitoring](policy-csp-defender.md#allowrealtimemonitoring) -- [Defender/AllowScanningNetworkFiles](policy-csp-defender.md#allowscanningnetworkfiles) -- [Defender/AllowScriptScanning](policy-csp-defender.md#allowscriptscanning) -- [Defender/AllowUserUIAccess](policy-csp-defender.md#allowuseruiaccess) -- [Defender/AvgCPULoadFactor](policy-csp-defender.md#avgcpuloadfactor) -- [Defender/DaysToRetainCleanedMalware](policy-csp-defender.md#daystoretaincleanedmalware) -- [Defender/ExcludedExtensions](policy-csp-defender.md#excludedextensions) -- [Defender/ExcludedPaths](policy-csp-defender.md#excludedpaths) -- [Defender/ExcludedProcesses](policy-csp-defender.md#excludedprocesses) -- [Defender/PUAProtection](policy-csp-defender.md#puaprotection) -- [Defender/RealTimeScanDirection](policy-csp-defender.md#realtimescandirection) -- [Defender/ScanParameter](policy-csp-defender.md#scanparameter) -- [Defender/ScheduleQuickScanTime](policy-csp-defender.md#schedulequickscantime) -- [Defender/ScheduleScanDay](policy-csp-defender.md#schedulescanday) -- [Defender/ScheduleScanTime](policy-csp-defender.md#schedulescantime) -- [Defender/SignatureUpdateInterval](policy-csp-defender.md#signatureupdateinterval) -- [Defender/SubmitSamplesConsent](policy-csp-defender.md#submitsamplesconsent) -- [Defender/ThreatSeverityDefaultAction](policy-csp-defender.md#threatseveritydefaultaction) -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#doallowvpnpeercaching) -- [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#dodownloadmode) -- [DeliveryOptimization/DOGroupId](policy-csp-deliveryoptimization.md#dogroupid) -- [DeliveryOptimization/DOMaxCacheAge](policy-csp-deliveryoptimization.md#domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](policy-csp-deliveryoptimization.md#domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md) (Deprecated) -- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md) (Deprecated) -- [DeliveryOptimization/DOMinBackgroundQos](policy-csp-deliveryoptimization.md#dominbackgroundqos) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](policy-csp-deliveryoptimization.md#domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md) (Deprecated) -- [Desktop/PreventUserRedirectionOfProfileFolders](policy-csp-desktop.md#preventuserredirectionofprofilefolders) -- [RestrictedGroups/ConfigureGroupMembership](policy-csp-restrictedgroups.md#configuregroupmembership) -- [System/AllowLocation](policy-csp-system.md#allowlocation) -- [System/AllowStorageCard](policy-csp-system.md#allowstoragecard) -- [System/AllowTelemetry](policy-csp-system.md#allowtelemetry) -- [TextInput/AllowIMELogging](policy-csp-textinput.md#allowimelogging) -- [TextInput/AllowIMENetworkAccess](policy-csp-textinput.md#allowimenetworkaccess) -- [TextInput/AllowInputPanel](policy-csp-textinput.md#allowinputpanel) -- [TextInput/AllowJapaneseIMESurrogatePairCharacters](policy-csp-textinput.md#allowjapaneseimesurrogatepaircharacters) -- [TextInput/AllowJapaneseIVSCharacters](policy-csp-textinput.md#allowjapaneseivscharacters) -- [TextInput/AllowJapaneseNonPublishingStandardGlyph](policy-csp-textinput.md#allowjapanesenonpublishingstandardglyph) -- [TextInput/AllowJapaneseUserDictionary](policy-csp-textinput.md#allowjapaneseuserdictionary) -- [TextInput/AllowLanguageFeaturesUninstall](policy-csp-textinput.md#allowlanguagefeaturesuninstall) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md#excludejapaneseimeexceptjis0208) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#excludejapaneseimeexceptjis0208andeudc) -- [TextInput/ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#excludejapaneseimeexceptshiftjis) -- [TimeLanguageSettings/ConfigureTimeZone](policy-csp-timelanguagesettings.md#configuretimezone) -- [Wifi/AllowInternetSharing](policy-csp-wifi.md#allowinternetsharing) -- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#allowmanualwificonfiguration) -- [Wifi/AllowWiFi](policy-csp-wifi.md#allowwifi) -- [Wifi/AllowWiFiHotSpotReporting](policy-csp-wifi.md) (Deprecated) -- [Wifi/WLANScanMode](policy-csp-wifi.md#wlanscanmode) -- [Wifi/AllowWiFiDirect](policy-csp-wifi.md#allowwifidirect) -- [WirelessDisplay/AllowMdnsAdvertisement](policy-csp-wirelessdisplay.md#allowmdnsadvertisement) -- [WirelessDisplay/AllowMdnsDiscovery](policy-csp-wirelessdisplay.md#allowmdnsdiscovery) -- [WirelessDisplay/AllowProjectionFromPC](policy-csp-wirelessdisplay.md#allowprojectionfrompc) -- [WirelessDisplay/AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay.md#allowprojectionfrompcoverinfrastructure) -- [WirelessDisplay/AllowProjectionToPC](policy-csp-wirelessdisplay.md#allowprojectiontopc) -- [WirelessDisplay/AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay.md#allowprojectiontopcoverinfrastructure) -- [WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver](policy-csp-wirelessdisplay.md#allowuserinputfromwirelessdisplayreceiver) -- [WirelessDisplay/RequirePinForPairing](policy-csp-wirelessdisplay.md#requirepinforpairing) +# Policies in Policy CSP supported by Surface Hub -## Related topics +This article lists the policies in Policy CSP that are applicable for Surface Hub. -[Policy CSP](policy-configuration-service-provider.md) +## Accounts + +- [AllowMicrosoftAccountConnection](policy-csp-accounts.md) + +## ApplicationDefaults + +- [DefaultAssociationsConfiguration](policy-csp-applicationdefaults.md) + +## ApplicationManagement + +- [AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md) +- [AllowDeveloperUnlock](policy-csp-applicationmanagement.md) + +## Authentication + +- [AllowEAPCertSSO](policy-csp-authentication.md) +- [AllowFastReconnect](policy-csp-authentication.md) +- [AllowSecondaryAuthenticationDevice](policy-csp-authentication.md) +- [AllowAadPasswordReset](policy-csp-authentication.md) +- [EnableWebSignIn](policy-csp-authentication.md) +- [EnableFastFirstSignIn](policy-csp-authentication.md) + +## Bluetooth + +- [Bluetooth](policy-csp-bluetooth.md) +- [AllowAdvertising](policy-csp-bluetooth.md) +- [AllowDiscoverableMode](policy-csp-bluetooth.md) +- [AllowPrepairing](policy-csp-bluetooth.md) +- [AllowPromptedProximalConnections](policy-csp-bluetooth.md) +- [LocalDeviceName](policy-csp-bluetooth.md) +- [ServicesAllowedList](policy-csp-bluetooth.md) +- [SetMinimumEncryptionKeySize](policy-csp-bluetooth.md) + +## Browser + +- [AllowAddressBarDropdown](policy-csp-browser.md) +- [AllowAutofill](policy-csp-browser.md) +- [AllowBrowser](policy-csp-browser.md) +- [AllowCookies](policy-csp-browser.md) +- [AllowDeveloperTools](policy-csp-browser.md) +- [AllowDoNotTrack](policy-csp-browser.md) +- [AllowFlashClickToRun](policy-csp-browser.md) +- [AllowMicrosoftCompatibilityList](policy-csp-browser.md) +- [AllowPasswordManager](policy-csp-browser.md) +- [AllowPopups](policy-csp-browser.md) +- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md) +- [AllowSmartScreen](policy-csp-browser.md) +- [ClearBrowsingDataOnExit](policy-csp-browser.md) +- [ConfigureAdditionalSearchEngines](policy-csp-browser.md) +- [DisableLockdownOfStartPages](policy-csp-browser.md) +- [EnterpriseModeSiteList](policy-csp-browser.md) +- [HomePages](policy-csp-browser.md) +- [PreventSmartScreenPromptOverride](policy-csp-browser.md) +- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md) +- [PreventLiveTileDataCollection](policy-csp-browser.md) +- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md) +- [SetDefaultSearchEngine](policy-csp-browser.md) +- [AllowAddressBarDropdown](policy-csp-browser.md) +- [AllowAutofill](policy-csp-browser.md) +- [AllowBrowser](policy-csp-browser.md) +- [AllowCookies](policy-csp-browser.md) +- [AllowDeveloperTools](policy-csp-browser.md) +- [AllowDoNotTrack](policy-csp-browser.md) +- [AllowFlashClickToRun](policy-csp-browser.md) +- [AllowMicrosoftCompatibilityList](policy-csp-browser.md) +- [AllowPasswordManager](policy-csp-browser.md) +- [AllowPopups](policy-csp-browser.md) +- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md) +- [AllowSmartScreen](policy-csp-browser.md) +- [ClearBrowsingDataOnExit](policy-csp-browser.md) +- [ConfigureAdditionalSearchEngines](policy-csp-browser.md) +- [DisableLockdownOfStartPages](policy-csp-browser.md) +- [EnterpriseModeSiteList](policy-csp-browser.md) +- [HomePages](policy-csp-browser.md) +- [PreventSmartScreenPromptOverride](policy-csp-browser.md) +- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md) +- [PreventLiveTileDataCollection](policy-csp-browser.md) +- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md) +- [SetDefaultSearchEngine](policy-csp-browser.md) + +## Camera + +- [Camera](policy-csp-camera.md) +- [AllowCamera](policy-csp-camera.md) + +## Connectivity + +- [AllowBluetooth](policy-csp-connectivity.md) +- [AllowConnectedDevices](policy-csp-connectivity.md) + +## Cryptography + +- [Cryptography](policy-csp-cryptography.md) +- [AllowFipsAlgorithmPolicy](policy-csp-cryptography.md) +- [TLSCipherSuites](policy-csp-cryptography.md) + +## Defender + +- [Defender](policy-csp-defender.md) +- [AllowArchiveScanning](policy-csp-defender.md) +- [AllowBehaviorMonitoring](policy-csp-defender.md) +- [AllowCloudProtection](policy-csp-defender.md) +- [AllowEmailScanning](policy-csp-defender.md) +- [AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md) +- [AllowFullScanRemovableDriveScanning](policy-csp-defender.md) +- [AllowIntrusionPreventionSystem](policy-csp-defender.md) +- [AllowIOAVProtection](policy-csp-defender.md) +- [AllowOnAccessProtection](policy-csp-defender.md) +- [AllowRealtimeMonitoring](policy-csp-defender.md) +- [AllowScanningNetworkFiles](policy-csp-defender.md) +- [AllowScriptScanning](policy-csp-defender.md) +- [AllowUserUIAccess](policy-csp-defender.md) +- [AttackSurfaceReductionOnlyExclusions](policy-csp-defender.md) +- [AttackSurfaceReductionRules](policy-csp-defender.md) +- [AvgCPULoadFactor](policy-csp-defender.md) +- [CloudBlockLevel](policy-csp-defender.md) +- [CloudExtendedTimeout](policy-csp-defender.md) +- [ControlledFolderAccessAllowedApplications](policy-csp-defender.md) +- [CheckForSignaturesBeforeRunningScan](policy-csp-defender.md) +- [SecurityIntelligenceLocation](policy-csp-defender.md) +- [ControlledFolderAccessProtectedFolders](policy-csp-defender.md) +- [DaysToRetainCleanedMalware](policy-csp-defender.md) +- [DisableCatchupFullScan](policy-csp-defender.md) +- [DisableCatchupQuickScan](policy-csp-defender.md) +- [EnableControlledFolderAccess](policy-csp-defender.md) +- [EnableLowCPUPriority](policy-csp-defender.md) +- [EnableNetworkProtection](policy-csp-defender.md) +- [ExcludedPaths](policy-csp-defender.md) +- [ExcludedExtensions](policy-csp-defender.md) +- [ExcludedProcesses](policy-csp-defender.md) +- [PUAProtection](policy-csp-defender.md) +- [RealTimeScanDirection](policy-csp-defender.md) +- [ScanParameter](policy-csp-defender.md) +- [ScheduleQuickScanTime](policy-csp-defender.md) +- [ScheduleScanDay](policy-csp-defender.md) +- [ScheduleScanTime](policy-csp-defender.md) +- [SignatureUpdateFallbackOrder](policy-csp-defender.md) +- [SignatureUpdateFileSharesSources](policy-csp-defender.md) +- [SignatureUpdateInterval](policy-csp-defender.md) +- [SubmitSamplesConsent](policy-csp-defender.md) +- [ThreatSeverityDefaultAction](policy-csp-defender.md) + +## DeliveryOptimization + +- [DeliveryOptimization](policy-csp-deliveryoptimization.md) +- [DODownloadMode](policy-csp-deliveryoptimization.md) +- [DOGroupId](policy-csp-deliveryoptimization.md) +- [DOMaxCacheSize](policy-csp-deliveryoptimization.md) +- [DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md) +- [DOMaxCacheAge](policy-csp-deliveryoptimization.md) +- [DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md) +- [DOMinBackgroundQos](policy-csp-deliveryoptimization.md) +- [DOModifyCacheDrive](policy-csp-deliveryoptimization.md) +- [DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md) +- [DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md) +- [DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md) +- [DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md) +- [DOMinFileSizeToCache](policy-csp-deliveryoptimization.md) +- [DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md) +- [DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md) +- [DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md) +- [DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md) +- [DOCacheHost](policy-csp-deliveryoptimization.md) +- [DOCacheHostSource](policy-csp-deliveryoptimization.md) +- [DODisallowCacheServerDownloadsOnVPN](policy-csp-deliveryoptimization.md) +- [DOGroupIdSource](policy-csp-deliveryoptimization.md) +- [DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md) +- [DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md) +- [DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md) +- [DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md) +- [DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md) +- [DOVpnKeywords](policy-csp-deliveryoptimization.md) +- [DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md) +- [DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md) + +## Experience + +- [DoNotShowFeedbackNotifications](policy-csp-experience.md) + +## ExploitGuard + +- [ExploitGuard](policy-csp-exploitguard.md) +- [ExploitProtectionSettings](policy-csp-exploitguard.md) + +## LocalUsersAndGroups + +- [LocalUsersAndGroups](policy-csp-localusersandgroups.md) +- [Configure](policy-csp-localusersandgroups.md) + +## NetworkIsolation + +- [NetworkIsolation](policy-csp-networkisolation.md) +- [EnterpriseCloudResources](policy-csp-networkisolation.md) +- [EnterpriseInternalProxyServers](policy-csp-networkisolation.md) +- [EnterpriseIPRange](policy-csp-networkisolation.md) +- [EnterpriseIPRangesAreAuthoritative](policy-csp-networkisolation.md) +- [EnterpriseNetworkDomainNames](policy-csp-networkisolation.md) +- [EnterpriseProxyServers](policy-csp-networkisolation.md) +- [EnterpriseProxyServersAreAuthoritative](policy-csp-networkisolation.md) +- [NeutralResources](policy-csp-networkisolation.md) + +## Privacy + +- [DisableAdvertisingId](policy-csp-privacy.md) +- [LetAppsGetDiagnosticInfo](policy-csp-privacy.md) +- [LetAppsGetDiagnosticInfo_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsGetDiagnosticInfo_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsRunInBackground](policy-csp-privacy.md) +- [LetAppsRunInBackground_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsRunInBackground_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsRunInBackground_UserInControlOfTheseApps](policy-csp-privacy.md) +- [AllowInputPersonalization](policy-csp-privacy.md) +- [LetAppsAccessAccountInfo](policy-csp-privacy.md) +- [LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCalendar](policy-csp-privacy.md) +- [LetAppsAccessCalendar_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCalendar_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCalendar_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCallHistory](policy-csp-privacy.md) +- [LetAppsAccessCallHistory_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCallHistory_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCallHistory_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCamera](policy-csp-privacy.md) +- [LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessContacts](policy-csp-privacy.md) +- [LetAppsAccessContacts_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessContacts_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessContacts_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessEmail](policy-csp-privacy.md) +- [LetAppsAccessEmail_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessEmail_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessEmail_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessLocation](policy-csp-privacy.md) +- [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessMessaging](policy-csp-privacy.md) +- [LetAppsAccessMessaging_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessMessaging_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessMessaging_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessMicrophone](policy-csp-privacy.md) +- [LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessNotifications](policy-csp-privacy.md) +- [LetAppsAccessNotifications_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessNotifications_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessNotifications_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessPhone](policy-csp-privacy.md) +- [LetAppsAccessPhone_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessPhone_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessPhone_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessRadios](policy-csp-privacy.md) +- [LetAppsAccessRadios_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessRadios_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessRadios_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessTasks](policy-csp-privacy.md) +- [LetAppsAccessTasks_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessTasks_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessTasks_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessTrustedDevices](policy-csp-privacy.md) +- [LetAppsAccessTrustedDevices_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessTrustedDevices_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessTrustedDevices_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsSyncWithDevices](policy-csp-privacy.md) +- [LetAppsSyncWithDevices_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsSyncWithDevices_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsSyncWithDevices_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsActivateWithVoice](policy-csp-privacy.md) +- [LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md) + +## RestrictedGroups + +- [ConfigureGroupMembership](policy-csp-restrictedgroups.md) + +## Security + +- [RecoveryEnvironmentAuthentication](policy-csp-security.md) +- [RequireProvisioningPackageSignature](policy-csp-security.md) +- [RequireRetrieveHealthCertificateOnBoot](policy-csp-security.md) +- [RecoveryEnvironmentAuthentication](policy-csp-security.md) + +## Settings + +- [ConfigureTaskbarCalendar](policy-csp-settings.md) + +## Start + +- [Start](policy-csp-start.md) +- [ForceStartSize](policy-csp-start.md) +- [DisableContextMenus](policy-csp-start.md) +- [ShowOrHideMostUsedApps](policy-csp-start.md) +- [HideFrequentlyUsedApps](policy-csp-start.md) +- [HideRecentlyAddedApps](policy-csp-start.md) +- [HideRecentJumplists](policy-csp-start.md) +- [HideAppList](policy-csp-start.md) +- [HidePeopleBar](policy-csp-start.md) +- [StartLayout](policy-csp-start.md) +- [ConfigureStartPins](policy-csp-start.md) +- [HideRecommendedSection](policy-csp-start.md) +- [HideTaskViewButton](policy-csp-start.md) +- [DisableControlCenter](policy-csp-start.md) +- [Start](policy-csp-start.md) +- [AllowPinnedFolderDocuments](policy-csp-start.md) +- [AllowPinnedFolderDownloads](policy-csp-start.md) +- [AllowPinnedFolderFileExplorer](policy-csp-start.md) +- [AllowPinnedFolderHomeGroup](policy-csp-start.md) +- [AllowPinnedFolderMusic](policy-csp-start.md) +- [AllowPinnedFolderNetwork](policy-csp-start.md) +- [AllowPinnedFolderPersonalFolder](policy-csp-start.md) +- [AllowPinnedFolderPictures](policy-csp-start.md) +- [AllowPinnedFolderSettings](policy-csp-start.md) +- [AllowPinnedFolderVideos](policy-csp-start.md) +- [ForceStartSize](policy-csp-start.md) +- [DisableContextMenus](policy-csp-start.md) +- [ShowOrHideMostUsedApps](policy-csp-start.md) +- [HideFrequentlyUsedApps](policy-csp-start.md) +- [HideRecentlyAddedApps](policy-csp-start.md) +- [HideRecentJumplists](policy-csp-start.md) +- [HideAppList](policy-csp-start.md) +- [HideChangeAccountSettings](policy-csp-start.md) +- [HideLock](policy-csp-start.md) +- [HideSignOut](policy-csp-start.md) +- [HideSwitchAccount](policy-csp-start.md) +- [HideSleep](policy-csp-start.md) +- [HideHibernate](policy-csp-start.md) +- [HideShutDown](policy-csp-start.md) +- [HideRestart](policy-csp-start.md) +- [HideUserTile](policy-csp-start.md) +- [HidePowerButton](policy-csp-start.md) +- [ImportEdgeAssets](policy-csp-start.md) +- [NoPinningToTaskbar](policy-csp-start.md) +- [StartLayout](policy-csp-start.md) +- [ConfigureStartPins](policy-csp-start.md) +- [HideRecommendedSection](policy-csp-start.md) +- [SimplifyQuickSettings](policy-csp-start.md) +- [DisableEditingQuickSettings](policy-csp-start.md) +- [HideTaskViewButton](policy-csp-start.md) + +## Storage + +- [WPDDevicesDenyReadAccessPerUser](policy-csp-storage.md) +- [WPDDevicesDenyWriteAccessPerUser](policy-csp-storage.md) +- [WPDDevicesDenyReadAccessPerDevice](policy-csp-storage.md) +- [WPDDevicesDenyWriteAccessPerDevice](policy-csp-storage.md) + +## System + +- [AllowTelemetry](policy-csp-system.md) +- [AllowBuildPreview](policy-csp-system.md) +- [AllowExperimentation](policy-csp-system.md) +- [AllowFontProviders](policy-csp-system.md) +- [AllowLocation](policy-csp-system.md) +- [AllowStorageCard](policy-csp-system.md) +- [AllowTelemetry](policy-csp-system.md) + +## TextInput + +- [TextInput](policy-csp-textinput.md) +- [AllowIMELogging](policy-csp-textinput.md) +- [AllowIMENetworkAccess](policy-csp-textinput.md) +- [AllowInputPanel](policy-csp-textinput.md) +- [AllowJapaneseIMESurrogatePairCharacters](policy-csp-textinput.md) +- [AllowJapaneseIVSCharacters](policy-csp-textinput.md) +- [AllowJapaneseNonPublishingStandardGlyph](policy-csp-textinput.md) +- [AllowJapaneseUserDictionary](policy-csp-textinput.md) +- [AllowKeyboardTextSuggestions](policy-csp-textinput.md) +- [AllowHardwareKeyboardTextSuggestions](policy-csp-textinput.md) +- [AllowLanguageFeaturesUninstall](policy-csp-textinput.md) +- [AllowLinguisticDataCollection](policy-csp-textinput.md) +- [ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md) +- [ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md) +- [ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md) +- [EnableTouchKeyboardAutoInvokeInDesktopMode](policy-csp-textinput.md) +- [TouchKeyboardFullModeAvailability](policy-csp-textinput.md) +- [TouchKeyboardWideModeAvailability](policy-csp-textinput.md) +- [TouchKeyboardNarrowModeAvailability](policy-csp-textinput.md) +- [TouchKeyboardHandwritingModeAvailability](policy-csp-textinput.md) +- [TouchKeyboardSplitModeAvailability](policy-csp-textinput.md) +- [TouchKeyboardEmojiButtonAvailability](policy-csp-textinput.md) +- [ForceTouchKeyboardDockedState](policy-csp-textinput.md) +- [TouchKeyboardDictationButtonAvailability](policy-csp-textinput.md) +- [ConfigureSimplifiedChineseIMEVersion](policy-csp-textinput.md) +- [ConfigureTraditionalChineseIMEVersion](policy-csp-textinput.md) +- [ConfigureJapaneseIMEVersion](policy-csp-textinput.md) +- [ConfigureKoreanIMEVersion](policy-csp-textinput.md) +- [AllowTextInputSuggestionUpdate](policy-csp-textinput.md) + +## TimeLanguageSettings + +- [ConfigureTimeZone](policy-csp-timelanguagesettings.md) + +## Update + +- [Update](policy-csp-update.md) +- [ActiveHoursEnd](policy-csp-update.md) +- [ActiveHoursStart](policy-csp-update.md) +- [ActiveHoursMaxRange](policy-csp-update.md) +- [AutoRestartRequiredNotificationDismissal](policy-csp-update.md) +- [AutoRestartNotificationSchedule](policy-csp-update.md) +- [SetAutoRestartNotificationDisable](policy-csp-update.md) +- [ScheduleRestartWarning](policy-csp-update.md) +- [ScheduleImminentRestartWarning](policy-csp-update.md) +- [AllowAutoUpdate](policy-csp-update.md) +- [AllowNonMicrosoftSignedUpdate](policy-csp-update.md) +- [AutoRestartDeadlinePeriodInDays](policy-csp-update.md) +- [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](policy-csp-update.md) +- [EngagedRestartTransitionSchedule](policy-csp-update.md) +- [EngagedRestartSnoozeSchedule](policy-csp-update.md) +- [EngagedRestartDeadline](policy-csp-update.md) +- [EngagedRestartTransitionScheduleForFeatureUpdates](policy-csp-update.md) +- [EngagedRestartSnoozeScheduleForFeatureUpdates](policy-csp-update.md) +- [EngagedRestartDeadlineForFeatureUpdates](policy-csp-update.md) +- [DetectionFrequency](policy-csp-update.md) +- [ManagePreviewBuilds](policy-csp-update.md) +- [BranchReadinessLevel](policy-csp-update.md) +- [ProductVersion](policy-csp-update.md) +- [TargetReleaseVersion](policy-csp-update.md) +- [DisableWUfBSafeguards](policy-csp-update.md) +- [AllowUpdateService](policy-csp-update.md) +- [DeferFeatureUpdatesPeriodInDays](policy-csp-update.md) +- [DeferQualityUpdatesPeriodInDays](policy-csp-update.md) +- [DeferUpdatePeriod](policy-csp-update.md) +- [DeferUpgradePeriod](policy-csp-update.md) +- [ExcludeWUDriversInQualityUpdate](policy-csp-update.md) +- [PauseDeferrals](policy-csp-update.md) +- [PauseFeatureUpdates](policy-csp-update.md) +- [PauseQualityUpdates](policy-csp-update.md) +- [PauseFeatureUpdatesStartTime](policy-csp-update.md) +- [PauseQualityUpdatesStartTime](policy-csp-update.md) +- [PhoneUpdateRestrictions](policy-csp-update.md) +- [RequireDeferUpgrade](policy-csp-update.md) +- [AllowMUUpdateService](policy-csp-update.md) +- [RequireUpdateApproval](policy-csp-update.md) +- [ScheduledInstallDay](policy-csp-update.md) +- [ScheduledInstallTime](policy-csp-update.md) +- [ScheduledInstallEveryWeek](policy-csp-update.md) +- [ScheduledInstallFirstWeek](policy-csp-update.md) +- [ScheduledInstallSecondWeek](policy-csp-update.md) +- [ScheduledInstallThirdWeek](policy-csp-update.md) +- [ScheduledInstallFourthWeek](policy-csp-update.md) +- [UpdateServiceUrl](policy-csp-update.md) +- [UpdateServiceUrlAlternate](policy-csp-update.md) +- [FillEmptyContentUrls](policy-csp-update.md) +- [SetProxyBehaviorForUpdateDetection](policy-csp-update.md) +- [DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection](policy-csp-update.md) +- [SetPolicyDrivenUpdateSourceForFeatureUpdates](policy-csp-update.md) +- [SetPolicyDrivenUpdateSourceForQualityUpdates](policy-csp-update.md) +- [SetPolicyDrivenUpdateSourceForDriverUpdates](policy-csp-update.md) +- [SetPolicyDrivenUpdateSourceForOtherUpdates](policy-csp-update.md) +- [SetEDURestart](policy-csp-update.md) +- [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](policy-csp-update.md) +- [AllowTemporaryEnterpriseFeatureControl](policy-csp-update.md) +- [SetDisableUXWUAccess](policy-csp-update.md) +- [SetDisablePauseUXAccess](policy-csp-update.md) +- [UpdateNotificationLevel](policy-csp-update.md) +- [NoUpdateNotificationsDuringActiveHours](policy-csp-update.md) +- [IgnoreMOUpdateDownloadLimit](policy-csp-update.md) +- [IgnoreMOAppDownloadLimit](policy-csp-update.md) +- [DisableDualScan](policy-csp-update.md) +- [ConfigureFeatureUpdateUninstallPeriod](policy-csp-update.md) +- [AutomaticMaintenanceWakeUp](policy-csp-update.md) +- [ConfigureDeadlineForQualityUpdates](policy-csp-update.md) +- [ConfigureDeadlineForFeatureUpdates](policy-csp-update.md) +- [ConfigureDeadlineGracePeriod](policy-csp-update.md) +- [ConfigureDeadlineGracePeriodForFeatureUpdates](policy-csp-update.md) +- [ConfigureDeadlineNoAutoReboot](policy-csp-update.md) +- [ConfigureDeadlineNoAutoRebootForFeatureUpdates](policy-csp-update.md) +- [ConfigureDeadlineNoAutoRebootForQualityUpdates](policy-csp-update.md) + +## Wifi + +- [AllowInternetSharing](policy-csp-wifi.md) +- [AllowManualWiFiConfiguration](policy-csp-wifi.md) +- [AllowWiFi](policy-csp-wifi.md) +- [AllowWiFiDirect](policy-csp-wifi.md) +- [WLANScanMode](policy-csp-wifi.md) + +## WindowsDefenderSecurityCenter + +- [WindowsDefenderSecurityCenter](policy-csp-windowsdefendersecuritycenter.md) +- [CompanyName](policy-csp-windowsdefendersecuritycenter.md) +- [DisableAppBrowserUI](policy-csp-windowsdefendersecuritycenter.md) +- [DisableEnhancedNotifications](policy-csp-windowsdefendersecuritycenter.md) +- [DisableFamilyUI](policy-csp-windowsdefendersecuritycenter.md) +- [DisableAccountProtectionUI](policy-csp-windowsdefendersecuritycenter.md) +- [DisableClearTpmButton](policy-csp-windowsdefendersecuritycenter.md) +- [DisableDeviceSecurityUI](policy-csp-windowsdefendersecuritycenter.md) +- [DisableHealthUI](policy-csp-windowsdefendersecuritycenter.md) +- [DisableNetworkUI](policy-csp-windowsdefendersecuritycenter.md) +- [DisableNotifications](policy-csp-windowsdefendersecuritycenter.md) +- [DisableTpmFirmwareUpdateWarning](policy-csp-windowsdefendersecuritycenter.md) +- [DisableVirusUI](policy-csp-windowsdefendersecuritycenter.md) +- [DisallowExploitProtectionOverride](policy-csp-windowsdefendersecuritycenter.md) +- [Email](policy-csp-windowsdefendersecuritycenter.md) +- [EnableCustomizedToasts](policy-csp-windowsdefendersecuritycenter.md) +- [EnableInAppCustomization](policy-csp-windowsdefendersecuritycenter.md) +- [HideRansomwareDataRecovery](policy-csp-windowsdefendersecuritycenter.md) +- [HideSecureBoot](policy-csp-windowsdefendersecuritycenter.md) +- [HideTPMTroubleshooting](policy-csp-windowsdefendersecuritycenter.md) +- [HideWindowsSecurityNotificationAreaControl](policy-csp-windowsdefendersecuritycenter.md) +- [Phone](policy-csp-windowsdefendersecuritycenter.md) +- [URL](policy-csp-windowsdefendersecuritycenter.md) + +## WirelessDisplay + +- [WirelessDisplay](policy-csp-wirelessdisplay.md) +- [AllowProjectionFromPC](policy-csp-wirelessdisplay.md) +- [AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay.md) +- [AllowProjectionToPC](policy-csp-wirelessdisplay.md) +- [AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay.md) +- [AllowUserInputFromWirelessDisplayReceiver](policy-csp-wirelessdisplay.md) +- [RequirePinForPairing](policy-csp-wirelessdisplay.md) +- [AllowMdnsAdvertisement](policy-csp-wirelessdisplay.md) +- [AllowMdnsDiscovery](policy-csp-wirelessdisplay.md) +- [AllowMovementDetectionOnInfrastructure](policy-csp-wirelessdisplay.md) +- [AllowPCSenderToBeTCPClient](policy-csp-wirelessdisplay.md) +- [AllowPCReceiverToBeTCPServer](policy-csp-wirelessdisplay.md) + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) From a5bd9984a0806e7a3d6c5b208103a9c4e4d51371 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 17 Mar 2023 17:51:51 -0400 Subject: [PATCH 03/26] Sort policies --- ...-in-policy-csp-supported-by-surface-hub.md | 866 +++++++++--------- 1 file changed, 426 insertions(+), 440 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md index dda5d64123..f426bbd777 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -19,527 +19,513 @@ This article lists the policies in Policy CSP that are applicable for Surface Hu ## Accounts -- [AllowMicrosoftAccountConnection](policy-csp-accounts.md) +- [AllowMicrosoftAccountConnection](policy-csp-accounts.md#allowmicrosoftaccountconnection) ## ApplicationDefaults -- [DefaultAssociationsConfiguration](policy-csp-applicationdefaults.md) +- [DefaultAssociationsConfiguration](policy-csp-applicationdefaults.md#defaultassociationsconfiguration) ## ApplicationManagement -- [AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md) -- [AllowDeveloperUnlock](policy-csp-applicationmanagement.md) +- [AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#allowappstoreautoupdate) +- [AllowDeveloperUnlock](policy-csp-applicationmanagement.md#allowdeveloperunlock) ## Authentication -- [AllowEAPCertSSO](policy-csp-authentication.md) -- [AllowFastReconnect](policy-csp-authentication.md) -- [AllowSecondaryAuthenticationDevice](policy-csp-authentication.md) -- [AllowAadPasswordReset](policy-csp-authentication.md) -- [EnableWebSignIn](policy-csp-authentication.md) -- [EnableFastFirstSignIn](policy-csp-authentication.md) +- [AllowAadPasswordReset](policy-csp-authentication.md#allowaadpasswordreset) +- [AllowEAPCertSSO](policy-csp-authentication.md#alloweapcertsso) +- [AllowFastReconnect](policy-csp-authentication.md#allowfastreconnect) +- [AllowSecondaryAuthenticationDevice](policy-csp-authentication.md#allowsecondaryauthenticationdevice) +- [EnableFastFirstSignIn](policy-csp-authentication.md#enablefastfirstsignin) +- [EnableWebSignIn](policy-csp-authentication.md#enablewebsignin) ## Bluetooth -- [Bluetooth](policy-csp-bluetooth.md) -- [AllowAdvertising](policy-csp-bluetooth.md) -- [AllowDiscoverableMode](policy-csp-bluetooth.md) -- [AllowPrepairing](policy-csp-bluetooth.md) -- [AllowPromptedProximalConnections](policy-csp-bluetooth.md) -- [LocalDeviceName](policy-csp-bluetooth.md) -- [ServicesAllowedList](policy-csp-bluetooth.md) -- [SetMinimumEncryptionKeySize](policy-csp-bluetooth.md) +- [AllowAdvertising](policy-csp-bluetooth.md#allowadvertising) +- [AllowDiscoverableMode](policy-csp-bluetooth.md#allowdiscoverablemode) +- [AllowPrepairing](policy-csp-bluetooth.md#allowprepairing) +- [AllowPromptedProximalConnections](policy-csp-bluetooth.md#allowpromptedproximalconnections) +- [LocalDeviceName](policy-csp-bluetooth.md#localdevicename) +- [ServicesAllowedList](policy-csp-bluetooth.md#servicesallowedlist) +- [SetMinimumEncryptionKeySize](policy-csp-bluetooth.md#setminimumencryptionkeysize) ## Browser -- [AllowAddressBarDropdown](policy-csp-browser.md) -- [AllowAutofill](policy-csp-browser.md) -- [AllowBrowser](policy-csp-browser.md) -- [AllowCookies](policy-csp-browser.md) -- [AllowDeveloperTools](policy-csp-browser.md) -- [AllowDoNotTrack](policy-csp-browser.md) -- [AllowFlashClickToRun](policy-csp-browser.md) -- [AllowMicrosoftCompatibilityList](policy-csp-browser.md) -- [AllowPasswordManager](policy-csp-browser.md) -- [AllowPopups](policy-csp-browser.md) -- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md) -- [AllowSmartScreen](policy-csp-browser.md) -- [ClearBrowsingDataOnExit](policy-csp-browser.md) -- [ConfigureAdditionalSearchEngines](policy-csp-browser.md) -- [DisableLockdownOfStartPages](policy-csp-browser.md) -- [EnterpriseModeSiteList](policy-csp-browser.md) -- [HomePages](policy-csp-browser.md) -- [PreventSmartScreenPromptOverride](policy-csp-browser.md) -- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md) -- [PreventLiveTileDataCollection](policy-csp-browser.md) -- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md) -- [SetDefaultSearchEngine](policy-csp-browser.md) -- [AllowAddressBarDropdown](policy-csp-browser.md) -- [AllowAutofill](policy-csp-browser.md) -- [AllowBrowser](policy-csp-browser.md) -- [AllowCookies](policy-csp-browser.md) -- [AllowDeveloperTools](policy-csp-browser.md) -- [AllowDoNotTrack](policy-csp-browser.md) -- [AllowFlashClickToRun](policy-csp-browser.md) -- [AllowMicrosoftCompatibilityList](policy-csp-browser.md) -- [AllowPasswordManager](policy-csp-browser.md) -- [AllowPopups](policy-csp-browser.md) -- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md) -- [AllowSmartScreen](policy-csp-browser.md) -- [ClearBrowsingDataOnExit](policy-csp-browser.md) -- [ConfigureAdditionalSearchEngines](policy-csp-browser.md) -- [DisableLockdownOfStartPages](policy-csp-browser.md) -- [EnterpriseModeSiteList](policy-csp-browser.md) -- [HomePages](policy-csp-browser.md) -- [PreventSmartScreenPromptOverride](policy-csp-browser.md) -- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md) -- [PreventLiveTileDataCollection](policy-csp-browser.md) -- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md) -- [SetDefaultSearchEngine](policy-csp-browser.md) +- [AllowAddressBarDropdown](policy-csp-browser.md#allowaddressbardropdown) +- [AllowAddressBarDropdown](policy-csp-browser.md#allowaddressbardropdown) +- [AllowAutofill](policy-csp-browser.md#allowautofill) +- [AllowAutofill](policy-csp-browser.md#allowautofill) +- [AllowBrowser](policy-csp-browser.md#allowbrowser) +- [AllowBrowser](policy-csp-browser.md#allowbrowser) +- [AllowCookies](policy-csp-browser.md#allowcookies) +- [AllowCookies](policy-csp-browser.md#allowcookies) +- [AllowDeveloperTools](policy-csp-browser.md#allowdevelopertools) +- [AllowDeveloperTools](policy-csp-browser.md#allowdevelopertools) +- [AllowDoNotTrack](policy-csp-browser.md#allowdonottrack) +- [AllowDoNotTrack](policy-csp-browser.md#allowdonottrack) +- [AllowFlashClickToRun](policy-csp-browser.md#allowflashclicktorun) +- [AllowFlashClickToRun](policy-csp-browser.md#allowflashclicktorun) +- [AllowMicrosoftCompatibilityList](policy-csp-browser.md#allowmicrosoftcompatibilitylist) +- [AllowMicrosoftCompatibilityList](policy-csp-browser.md#allowmicrosoftcompatibilitylist) +- [AllowPasswordManager](policy-csp-browser.md#allowpasswordmanager) +- [AllowPasswordManager](policy-csp-browser.md#allowpasswordmanager) +- [AllowPopups](policy-csp-browser.md#allowpopups) +- [AllowPopups](policy-csp-browser.md#allowpopups) +- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#allowsearchsuggestionsinaddressbar) +- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#allowsearchsuggestionsinaddressbar) +- [AllowSmartScreen](policy-csp-browser.md#allowsmartscreen) +- [AllowSmartScreen](policy-csp-browser.md#allowsmartscreen) +- [ClearBrowsingDataOnExit](policy-csp-browser.md#clearbrowsingdataonexit) +- [ClearBrowsingDataOnExit](policy-csp-browser.md#clearbrowsingdataonexit) +- [ConfigureAdditionalSearchEngines](policy-csp-browser.md#configureadditionalsearchengines) +- [ConfigureAdditionalSearchEngines](policy-csp-browser.md#configureadditionalsearchengines) +- [DisableLockdownOfStartPages](policy-csp-browser.md#disablelockdownofstartpages) +- [DisableLockdownOfStartPages](policy-csp-browser.md#disablelockdownofstartpages) +- [EnterpriseModeSiteList](policy-csp-browser.md#enterprisemodesitelist) +- [EnterpriseModeSiteList](policy-csp-browser.md#enterprisemodesitelist) +- [HomePages](policy-csp-browser.md#homepages) +- [HomePages](policy-csp-browser.md#homepages) +- [PreventLiveTileDataCollection](policy-csp-browser.md#preventlivetiledatacollection) +- [PreventLiveTileDataCollection](policy-csp-browser.md#preventlivetiledatacollection) +- [PreventSmartScreenPromptOverride](policy-csp-browser.md#preventsmartscreenpromptoverride) +- [PreventSmartScreenPromptOverride](policy-csp-browser.md#preventsmartscreenpromptoverride) +- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md#preventsmartscreenpromptoverrideforfiles) +- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md#preventsmartscreenpromptoverrideforfiles) +- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md#preventusinglocalhostipaddressforwebrtc) +- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md#preventusinglocalhostipaddressforwebrtc) +- [SetDefaultSearchEngine](policy-csp-browser.md#setdefaultsearchengine) +- [SetDefaultSearchEngine](policy-csp-browser.md#setdefaultsearchengine) ## Camera -- [Camera](policy-csp-camera.md) -- [AllowCamera](policy-csp-camera.md) +- [AllowCamera](policy-csp-camera.md#allowcamera) ## Connectivity -- [AllowBluetooth](policy-csp-connectivity.md) -- [AllowConnectedDevices](policy-csp-connectivity.md) +- [AllowBluetooth](policy-csp-connectivity.md#allowbluetooth) +- [AllowConnectedDevices](policy-csp-connectivity.md#allowconnecteddevices) ## Cryptography -- [Cryptography](policy-csp-cryptography.md) -- [AllowFipsAlgorithmPolicy](policy-csp-cryptography.md) -- [TLSCipherSuites](policy-csp-cryptography.md) +- [AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#allowfipsalgorithmpolicy) +- [TLSCipherSuites](policy-csp-cryptography.md#tlsciphersuites) ## Defender -- [Defender](policy-csp-defender.md) -- [AllowArchiveScanning](policy-csp-defender.md) -- [AllowBehaviorMonitoring](policy-csp-defender.md) -- [AllowCloudProtection](policy-csp-defender.md) -- [AllowEmailScanning](policy-csp-defender.md) -- [AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md) -- [AllowFullScanRemovableDriveScanning](policy-csp-defender.md) -- [AllowIntrusionPreventionSystem](policy-csp-defender.md) -- [AllowIOAVProtection](policy-csp-defender.md) -- [AllowOnAccessProtection](policy-csp-defender.md) -- [AllowRealtimeMonitoring](policy-csp-defender.md) -- [AllowScanningNetworkFiles](policy-csp-defender.md) -- [AllowScriptScanning](policy-csp-defender.md) -- [AllowUserUIAccess](policy-csp-defender.md) -- [AttackSurfaceReductionOnlyExclusions](policy-csp-defender.md) -- [AttackSurfaceReductionRules](policy-csp-defender.md) -- [AvgCPULoadFactor](policy-csp-defender.md) -- [CloudBlockLevel](policy-csp-defender.md) -- [CloudExtendedTimeout](policy-csp-defender.md) -- [ControlledFolderAccessAllowedApplications](policy-csp-defender.md) -- [CheckForSignaturesBeforeRunningScan](policy-csp-defender.md) -- [SecurityIntelligenceLocation](policy-csp-defender.md) -- [ControlledFolderAccessProtectedFolders](policy-csp-defender.md) -- [DaysToRetainCleanedMalware](policy-csp-defender.md) -- [DisableCatchupFullScan](policy-csp-defender.md) -- [DisableCatchupQuickScan](policy-csp-defender.md) -- [EnableControlledFolderAccess](policy-csp-defender.md) -- [EnableLowCPUPriority](policy-csp-defender.md) -- [EnableNetworkProtection](policy-csp-defender.md) -- [ExcludedPaths](policy-csp-defender.md) -- [ExcludedExtensions](policy-csp-defender.md) -- [ExcludedProcesses](policy-csp-defender.md) -- [PUAProtection](policy-csp-defender.md) -- [RealTimeScanDirection](policy-csp-defender.md) -- [ScanParameter](policy-csp-defender.md) -- [ScheduleQuickScanTime](policy-csp-defender.md) -- [ScheduleScanDay](policy-csp-defender.md) -- [ScheduleScanTime](policy-csp-defender.md) -- [SignatureUpdateFallbackOrder](policy-csp-defender.md) -- [SignatureUpdateFileSharesSources](policy-csp-defender.md) -- [SignatureUpdateInterval](policy-csp-defender.md) -- [SubmitSamplesConsent](policy-csp-defender.md) -- [ThreatSeverityDefaultAction](policy-csp-defender.md) +- [AllowArchiveScanning](policy-csp-defender.md#allowarchivescanning) +- [AllowBehaviorMonitoring](policy-csp-defender.md#allowbehaviormonitoring) +- [AllowCloudProtection](policy-csp-defender.md#allowcloudprotection) +- [AllowEmailScanning](policy-csp-defender.md#allowemailscanning) +- [AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md#allowfullscanonmappednetworkdrives) +- [AllowFullScanRemovableDriveScanning](policy-csp-defender.md#allowfullscanremovabledrivescanning) +- [AllowIntrusionPreventionSystem](policy-csp-defender.md#allowintrusionpreventionsystem) +- [AllowIOAVProtection](policy-csp-defender.md#allowioavprotection) +- [AllowOnAccessProtection](policy-csp-defender.md#allowonaccessprotection) +- [AllowRealtimeMonitoring](policy-csp-defender.md#allowrealtimemonitoring) +- [AllowScanningNetworkFiles](policy-csp-defender.md#allowscanningnetworkfiles) +- [AllowScriptScanning](policy-csp-defender.md#allowscriptscanning) +- [AllowUserUIAccess](policy-csp-defender.md#allowuseruiaccess) +- [AttackSurfaceReductionOnlyExclusions](policy-csp-defender.md#attacksurfacereductiononlyexclusions) +- [AttackSurfaceReductionRules](policy-csp-defender.md#attacksurfacereductionrules) +- [AvgCPULoadFactor](policy-csp-defender.md#avgcpuloadfactor) +- [CheckForSignaturesBeforeRunningScan](policy-csp-defender.md#checkforsignaturesbeforerunningscan) +- [CloudBlockLevel](policy-csp-defender.md#cloudblocklevel) +- [CloudExtendedTimeout](policy-csp-defender.md#cloudextendedtimeout) +- [ControlledFolderAccessAllowedApplications](policy-csp-defender.md#controlledfolderaccessallowedapplications) +- [ControlledFolderAccessProtectedFolders](policy-csp-defender.md#controlledfolderaccessprotectedfolders) +- [DaysToRetainCleanedMalware](policy-csp-defender.md#daystoretaincleanedmalware) +- [DisableCatchupFullScan](policy-csp-defender.md#disablecatchupfullscan) +- [DisableCatchupQuickScan](policy-csp-defender.md#disablecatchupquickscan) +- [EnableControlledFolderAccess](policy-csp-defender.md#enablecontrolledfolderaccess) +- [EnableLowCPUPriority](policy-csp-defender.md#enablelowcpupriority) +- [EnableNetworkProtection](policy-csp-defender.md#enablenetworkprotection) +- [ExcludedExtensions](policy-csp-defender.md#excludedextensions) +- [ExcludedPaths](policy-csp-defender.md#excludedpaths) +- [ExcludedProcesses](policy-csp-defender.md#excludedprocesses) +- [PUAProtection](policy-csp-defender.md#puaprotection) +- [RealTimeScanDirection](policy-csp-defender.md#realtimescandirection) +- [ScanParameter](policy-csp-defender.md#scanparameter) +- [ScheduleQuickScanTime](policy-csp-defender.md#schedulequickscantime) +- [ScheduleScanDay](policy-csp-defender.md#schedulescanday) +- [ScheduleScanTime](policy-csp-defender.md#schedulescantime) +- [SecurityIntelligenceLocation](policy-csp-defender.md#securityintelligencelocation) +- [SignatureUpdateFallbackOrder](policy-csp-defender.md#signatureupdatefallbackorder) +- [SignatureUpdateFileSharesSources](policy-csp-defender.md#signatureupdatefilesharessources) +- [SignatureUpdateInterval](policy-csp-defender.md#signatureupdateinterval) +- [SubmitSamplesConsent](policy-csp-defender.md#submitsamplesconsent) +- [ThreatSeverityDefaultAction](policy-csp-defender.md#threatseveritydefaultaction) ## DeliveryOptimization -- [DeliveryOptimization](policy-csp-deliveryoptimization.md) -- [DODownloadMode](policy-csp-deliveryoptimization.md) -- [DOGroupId](policy-csp-deliveryoptimization.md) -- [DOMaxCacheSize](policy-csp-deliveryoptimization.md) -- [DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md) -- [DOMaxCacheAge](policy-csp-deliveryoptimization.md) -- [DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md) -- [DOMinBackgroundQos](policy-csp-deliveryoptimization.md) -- [DOModifyCacheDrive](policy-csp-deliveryoptimization.md) -- [DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md) -- [DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md) -- [DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md) -- [DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md) -- [DOMinFileSizeToCache](policy-csp-deliveryoptimization.md) -- [DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md) -- [DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md) -- [DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md) -- [DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md) -- [DOCacheHost](policy-csp-deliveryoptimization.md) -- [DOCacheHostSource](policy-csp-deliveryoptimization.md) -- [DODisallowCacheServerDownloadsOnVPN](policy-csp-deliveryoptimization.md) -- [DOGroupIdSource](policy-csp-deliveryoptimization.md) -- [DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md) -- [DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md) -- [DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md) -- [DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md) -- [DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md) -- [DOVpnKeywords](policy-csp-deliveryoptimization.md) -- [DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md) -- [DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md) +- [DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#doabsolutemaxcachesize) +- [DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#doallowvpnpeercaching) +- [DOCacheHost](policy-csp-deliveryoptimization.md#docachehost) +- [DOCacheHostSource](policy-csp-deliveryoptimization.md#docachehostsource) +- [DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md#dodelaybackgrounddownloadfromhttp) +- [DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#dodelaycacheserverfallbackbackground) +- [DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#dodelaycacheserverfallbackforeground) +- [DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md#dodelayforegrounddownloadfromhttp) +- [DODisallowCacheServerDownloadsOnVPN](policy-csp-deliveryoptimization.md#dodisallowcacheserverdownloadsonvpn) +- [DODownloadMode](policy-csp-deliveryoptimization.md#dodownloadmode) +- [DOGroupId](policy-csp-deliveryoptimization.md#dogroupid) +- [DOGroupIdSource](policy-csp-deliveryoptimization.md#dogroupidsource) +- [DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#domaxbackgrounddownloadbandwidth) +- [DOMaxCacheAge](policy-csp-deliveryoptimization.md#domaxcacheage) +- [DOMaxCacheSize](policy-csp-deliveryoptimization.md#domaxcachesize) +- [DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#domaxforegrounddownloadbandwidth) +- [DOMinBackgroundQos](policy-csp-deliveryoptimization.md#dominbackgroundqos) +- [DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md#dominbatterypercentageallowedtoupload) +- [DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#domindisksizeallowedtopeer) +- [DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#dominfilesizetocache) +- [DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#dominramallowedtopeer) +- [DOModifyCacheDrive](policy-csp-deliveryoptimization.md#domodifycachedrive) +- [DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#domonthlyuploaddatacap) +- [DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md#dopercentagemaxbackgroundbandwidth) +- [DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md#dopercentagemaxforegroundbandwidth) +- [DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md#dorestrictpeerselectionby) +- [DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitbackgrounddownloadbandwidth) +- [DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitforegrounddownloadbandwidth) +- [DOVpnKeywords](policy-csp-deliveryoptimization.md#dovpnkeywords) ## Experience -- [DoNotShowFeedbackNotifications](policy-csp-experience.md) +- [DoNotShowFeedbackNotifications](policy-csp-experience.md#donotshowfeedbacknotifications) ## ExploitGuard -- [ExploitGuard](policy-csp-exploitguard.md) -- [ExploitProtectionSettings](policy-csp-exploitguard.md) +- [ExploitProtectionSettings](policy-csp-exploitguard.md#exploitprotectionsettings) ## LocalUsersAndGroups -- [LocalUsersAndGroups](policy-csp-localusersandgroups.md) -- [Configure](policy-csp-localusersandgroups.md) +- [Configure](policy-csp-localusersandgroups.md#configure) ## NetworkIsolation -- [NetworkIsolation](policy-csp-networkisolation.md) -- [EnterpriseCloudResources](policy-csp-networkisolation.md) -- [EnterpriseInternalProxyServers](policy-csp-networkisolation.md) -- [EnterpriseIPRange](policy-csp-networkisolation.md) -- [EnterpriseIPRangesAreAuthoritative](policy-csp-networkisolation.md) -- [EnterpriseNetworkDomainNames](policy-csp-networkisolation.md) -- [EnterpriseProxyServers](policy-csp-networkisolation.md) -- [EnterpriseProxyServersAreAuthoritative](policy-csp-networkisolation.md) -- [NeutralResources](policy-csp-networkisolation.md) +- [EnterpriseCloudResources](policy-csp-networkisolation.md#enterprisecloudresources) +- [EnterpriseInternalProxyServers](policy-csp-networkisolation.md#enterpriseinternalproxyservers) +- [EnterpriseIPRange](policy-csp-networkisolation.md#enterpriseiprange) +- [EnterpriseIPRangesAreAuthoritative](policy-csp-networkisolation.md#enterpriseiprangesareauthoritative) +- [EnterpriseNetworkDomainNames](policy-csp-networkisolation.md#enterprisenetworkdomainnames) +- [EnterpriseProxyServers](policy-csp-networkisolation.md#enterpriseproxyservers) +- [EnterpriseProxyServersAreAuthoritative](policy-csp-networkisolation.md#enterpriseproxyserversareauthoritative) +- [NeutralResources](policy-csp-networkisolation.md#neutralresources) ## Privacy -- [DisableAdvertisingId](policy-csp-privacy.md) -- [LetAppsGetDiagnosticInfo](policy-csp-privacy.md) -- [LetAppsGetDiagnosticInfo_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsGetDiagnosticInfo_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsRunInBackground](policy-csp-privacy.md) -- [LetAppsRunInBackground_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsRunInBackground_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsRunInBackground_UserInControlOfTheseApps](policy-csp-privacy.md) -- [AllowInputPersonalization](policy-csp-privacy.md) -- [LetAppsAccessAccountInfo](policy-csp-privacy.md) -- [LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsAccessCalendar](policy-csp-privacy.md) -- [LetAppsAccessCalendar_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsAccessCalendar_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsAccessCalendar_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsAccessCallHistory](policy-csp-privacy.md) -- [LetAppsAccessCallHistory_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsAccessCallHistory_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsAccessCallHistory_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsAccessCamera](policy-csp-privacy.md) -- [LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsAccessContacts](policy-csp-privacy.md) -- [LetAppsAccessContacts_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsAccessContacts_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsAccessContacts_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsAccessEmail](policy-csp-privacy.md) -- [LetAppsAccessEmail_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsAccessEmail_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsAccessEmail_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsAccessLocation](policy-csp-privacy.md) -- [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsAccessMessaging](policy-csp-privacy.md) -- [LetAppsAccessMessaging_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsAccessMessaging_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsAccessMessaging_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsAccessMicrophone](policy-csp-privacy.md) -- [LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsAccessNotifications](policy-csp-privacy.md) -- [LetAppsAccessNotifications_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsAccessNotifications_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsAccessNotifications_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsAccessPhone](policy-csp-privacy.md) -- [LetAppsAccessPhone_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsAccessPhone_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsAccessPhone_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsAccessRadios](policy-csp-privacy.md) -- [LetAppsAccessRadios_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsAccessRadios_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsAccessRadios_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsAccessTasks](policy-csp-privacy.md) -- [LetAppsAccessTasks_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsAccessTasks_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsAccessTasks_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsAccessTrustedDevices](policy-csp-privacy.md) -- [LetAppsAccessTrustedDevices_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsAccessTrustedDevices_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsAccessTrustedDevices_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsSyncWithDevices](policy-csp-privacy.md) -- [LetAppsSyncWithDevices_ForceAllowTheseApps](policy-csp-privacy.md) -- [LetAppsSyncWithDevices_ForceDenyTheseApps](policy-csp-privacy.md) -- [LetAppsSyncWithDevices_UserInControlOfTheseApps](policy-csp-privacy.md) -- [LetAppsActivateWithVoice](policy-csp-privacy.md) -- [LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md) +- [AllowInputPersonalization](policy-csp-privacy.md#allowinputpersonalization) +- [DisableAdvertisingId](policy-csp-privacy.md#disableadvertisingid) +- [LetAppsAccessAccountInfo](policy-csp-privacy.md#letappsaccessaccountinfo) +- [LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo-forceallowtheseapps) +- [LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo-forcedenytheseapps) +- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo-userincontroloftheseapps) +- [LetAppsAccessCalendar](policy-csp-privacy.md#letappsaccesscalendar) +- [LetAppsAccessCalendar_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscalendar-forceallowtheseapps) +- [LetAppsAccessCalendar_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscalendar-forcedenytheseapps) +- [LetAppsAccessCalendar_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscalendar-userincontroloftheseapps) +- [LetAppsAccessCallHistory](policy-csp-privacy.md#letappsaccesscallhistory) +- [LetAppsAccessCallHistory_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscallhistory-forceallowtheseapps) +- [LetAppsAccessCallHistory_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscallhistory-forcedenytheseapps) +- [LetAppsAccessCallHistory_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscallhistory-userincontroloftheseapps) +- [LetAppsAccessCamera](policy-csp-privacy.md#letappsaccesscamera) +- [LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscamera-forceallowtheseapps) +- [LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscamera-forcedenytheseapps) +- [LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscamera-userincontroloftheseapps) +- [LetAppsAccessContacts](policy-csp-privacy.md#letappsaccesscontacts) +- [LetAppsAccessContacts_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscontacts-forceallowtheseapps) +- [LetAppsAccessContacts_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscontacts-forcedenytheseapps) +- [LetAppsAccessContacts_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscontacts-userincontroloftheseapps) +- [LetAppsAccessEmail](policy-csp-privacy.md#letappsaccessemail) +- [LetAppsAccessEmail_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessemail-forceallowtheseapps) +- [LetAppsAccessEmail_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessemail-forcedenytheseapps) +- [LetAppsAccessEmail_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessemail-userincontroloftheseapps) +- [LetAppsAccessLocation](policy-csp-privacy.md#letappsaccesslocation) +- [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesslocation-forceallowtheseapps) +- [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesslocation-forcedenytheseapps) +- [LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesslocation-userincontroloftheseapps) +- [LetAppsAccessMessaging](policy-csp-privacy.md#letappsaccessmessaging) +- [LetAppsAccessMessaging_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmessaging-forceallowtheseapps) +- [LetAppsAccessMessaging_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmessaging-forcedenytheseapps) +- [LetAppsAccessMessaging_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessmessaging-userincontroloftheseapps) +- [LetAppsAccessMicrophone](policy-csp-privacy.md#letappsaccessmicrophone) +- [LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmicrophone-forceallowtheseapps) +- [LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmicrophone-forcedenytheseapps) +- [LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessmicrophone-userincontroloftheseapps) +- [LetAppsAccessNotifications](policy-csp-privacy.md#letappsaccessnotifications) +- [LetAppsAccessNotifications_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessnotifications-forceallowtheseapps) +- [LetAppsAccessNotifications_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessnotifications-forcedenytheseapps) +- [LetAppsAccessNotifications_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessnotifications-userincontroloftheseapps) +- [LetAppsAccessPhone](policy-csp-privacy.md#letappsaccessphone) +- [LetAppsAccessPhone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessphone-forceallowtheseapps) +- [LetAppsAccessPhone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessphone-forcedenytheseapps) +- [LetAppsAccessPhone_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessphone-userincontroloftheseapps) +- [LetAppsAccessRadios](policy-csp-privacy.md#letappsaccessradios) +- [LetAppsAccessRadios_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessradios-forceallowtheseapps) +- [LetAppsAccessRadios_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessradios-forcedenytheseapps) +- [LetAppsAccessRadios_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessradios-userincontroloftheseapps) +- [LetAppsAccessTasks](policy-csp-privacy.md#letappsaccesstasks) +- [LetAppsAccessTasks_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesstasks-forceallowtheseapps) +- [LetAppsAccessTasks_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesstasks-forcedenytheseapps) +- [LetAppsAccessTasks_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesstasks-userincontroloftheseapps) +- [LetAppsAccessTrustedDevices](policy-csp-privacy.md#letappsaccesstrusteddevices) +- [LetAppsAccessTrustedDevices_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices-forceallowtheseapps) +- [LetAppsAccessTrustedDevices_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices-forcedenytheseapps) +- [LetAppsAccessTrustedDevices_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices-userincontroloftheseapps) +- [LetAppsActivateWithVoice](policy-csp-privacy.md#letappsactivatewithvoice) +- [LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#letappsactivatewithvoiceabovelock) +- [LetAppsGetDiagnosticInfo](policy-csp-privacy.md#letappsgetdiagnosticinfo) +- [LetAppsGetDiagnosticInfo_ForceAllowTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo-forceallowtheseapps) +- [LetAppsGetDiagnosticInfo_ForceDenyTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo-forcedenytheseapps) +- [LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo-userincontroloftheseapps) +- [LetAppsRunInBackground](policy-csp-privacy.md#letappsruninbackground) +- [LetAppsRunInBackground_ForceAllowTheseApps](policy-csp-privacy.md#letappsruninbackground-forceallowtheseapps) +- [LetAppsRunInBackground_ForceDenyTheseApps](policy-csp-privacy.md#letappsruninbackground-forcedenytheseapps) +- [LetAppsRunInBackground_UserInControlOfTheseApps](policy-csp-privacy.md#letappsruninbackground-userincontroloftheseapps) +- [LetAppsSyncWithDevices](policy-csp-privacy.md#letappssyncwithdevices) +- [LetAppsSyncWithDevices_ForceAllowTheseApps](policy-csp-privacy.md#letappssyncwithdevices-forceallowtheseapps) +- [LetAppsSyncWithDevices_ForceDenyTheseApps](policy-csp-privacy.md#letappssyncwithdevices-forcedenytheseapps) +- [LetAppsSyncWithDevices_UserInControlOfTheseApps](policy-csp-privacy.md#letappssyncwithdevices-userincontroloftheseapps) ## RestrictedGroups -- [ConfigureGroupMembership](policy-csp-restrictedgroups.md) +- [ConfigureGroupMembership](policy-csp-restrictedgroups.md#configuregroupmembership) ## Security -- [RecoveryEnvironmentAuthentication](policy-csp-security.md) -- [RequireProvisioningPackageSignature](policy-csp-security.md) -- [RequireRetrieveHealthCertificateOnBoot](policy-csp-security.md) -- [RecoveryEnvironmentAuthentication](policy-csp-security.md) +- [RecoveryEnvironmentAuthentication](policy-csp-security.md#recoveryenvironmentauthentication) +- [RecoveryEnvironmentAuthentication](policy-csp-security.md#recoveryenvironmentauthentication) +- [RequireProvisioningPackageSignature](policy-csp-security.md#requireprovisioningpackagesignature) +- [RequireRetrieveHealthCertificateOnBoot](policy-csp-security.md#requireretrievehealthcertificateonboot) ## Settings -- [ConfigureTaskbarCalendar](policy-csp-settings.md) +- [ConfigureTaskbarCalendar](policy-csp-settings.md#configuretaskbarcalendar) ## Start -- [Start](policy-csp-start.md) -- [ForceStartSize](policy-csp-start.md) -- [DisableContextMenus](policy-csp-start.md) -- [ShowOrHideMostUsedApps](policy-csp-start.md) -- [HideFrequentlyUsedApps](policy-csp-start.md) -- [HideRecentlyAddedApps](policy-csp-start.md) -- [HideRecentJumplists](policy-csp-start.md) -- [HideAppList](policy-csp-start.md) -- [HidePeopleBar](policy-csp-start.md) -- [StartLayout](policy-csp-start.md) -- [ConfigureStartPins](policy-csp-start.md) -- [HideRecommendedSection](policy-csp-start.md) -- [HideTaskViewButton](policy-csp-start.md) -- [DisableControlCenter](policy-csp-start.md) -- [Start](policy-csp-start.md) -- [AllowPinnedFolderDocuments](policy-csp-start.md) -- [AllowPinnedFolderDownloads](policy-csp-start.md) -- [AllowPinnedFolderFileExplorer](policy-csp-start.md) -- [AllowPinnedFolderHomeGroup](policy-csp-start.md) -- [AllowPinnedFolderMusic](policy-csp-start.md) -- [AllowPinnedFolderNetwork](policy-csp-start.md) -- [AllowPinnedFolderPersonalFolder](policy-csp-start.md) -- [AllowPinnedFolderPictures](policy-csp-start.md) -- [AllowPinnedFolderSettings](policy-csp-start.md) -- [AllowPinnedFolderVideos](policy-csp-start.md) -- [ForceStartSize](policy-csp-start.md) -- [DisableContextMenus](policy-csp-start.md) -- [ShowOrHideMostUsedApps](policy-csp-start.md) -- [HideFrequentlyUsedApps](policy-csp-start.md) -- [HideRecentlyAddedApps](policy-csp-start.md) -- [HideRecentJumplists](policy-csp-start.md) -- [HideAppList](policy-csp-start.md) -- [HideChangeAccountSettings](policy-csp-start.md) -- [HideLock](policy-csp-start.md) -- [HideSignOut](policy-csp-start.md) -- [HideSwitchAccount](policy-csp-start.md) -- [HideSleep](policy-csp-start.md) -- [HideHibernate](policy-csp-start.md) -- [HideShutDown](policy-csp-start.md) -- [HideRestart](policy-csp-start.md) -- [HideUserTile](policy-csp-start.md) -- [HidePowerButton](policy-csp-start.md) -- [ImportEdgeAssets](policy-csp-start.md) -- [NoPinningToTaskbar](policy-csp-start.md) -- [StartLayout](policy-csp-start.md) -- [ConfigureStartPins](policy-csp-start.md) -- [HideRecommendedSection](policy-csp-start.md) -- [SimplifyQuickSettings](policy-csp-start.md) -- [DisableEditingQuickSettings](policy-csp-start.md) -- [HideTaskViewButton](policy-csp-start.md) +- [AllowPinnedFolderDocuments](policy-csp-start.md#allowpinnedfolderdocuments) +- [AllowPinnedFolderDownloads](policy-csp-start.md#allowpinnedfolderdownloads) +- [AllowPinnedFolderFileExplorer](policy-csp-start.md#allowpinnedfolderfileexplorer) +- [AllowPinnedFolderHomeGroup](policy-csp-start.md#allowpinnedfolderhomegroup) +- [AllowPinnedFolderMusic](policy-csp-start.md#allowpinnedfoldermusic) +- [AllowPinnedFolderNetwork](policy-csp-start.md#allowpinnedfoldernetwork) +- [AllowPinnedFolderPersonalFolder](policy-csp-start.md#allowpinnedfolderpersonalfolder) +- [AllowPinnedFolderPictures](policy-csp-start.md#allowpinnedfolderpictures) +- [AllowPinnedFolderSettings](policy-csp-start.md#allowpinnedfoldersettings) +- [AllowPinnedFolderVideos](policy-csp-start.md#allowpinnedfoldervideos) +- [ConfigureStartPins](policy-csp-start.md#configurestartpins) +- [ConfigureStartPins](policy-csp-start.md#configurestartpins) +- [DisableContextMenus](policy-csp-start.md#disablecontextmenus) +- [DisableContextMenus](policy-csp-start.md#disablecontextmenus) +- [DisableControlCenter](policy-csp-start.md#disablecontrolcenter) +- [DisableEditingQuickSettings](policy-csp-start.md#disableeditingquicksettings) +- [ForceStartSize](policy-csp-start.md#forcestartsize) +- [ForceStartSize](policy-csp-start.md#forcestartsize) +- [HideAppList](policy-csp-start.md#hideapplist) +- [HideAppList](policy-csp-start.md#hideapplist) +- [HideChangeAccountSettings](policy-csp-start.md#hidechangeaccountsettings) +- [HideFrequentlyUsedApps](policy-csp-start.md#hidefrequentlyusedapps) +- [HideFrequentlyUsedApps](policy-csp-start.md#hidefrequentlyusedapps) +- [HideHibernate](policy-csp-start.md#hidehibernate) +- [HideLock](policy-csp-start.md#hidelock) +- [HidePeopleBar](policy-csp-start.md#hidepeoplebar) +- [HidePowerButton](policy-csp-start.md#hidepowerbutton) +- [HideRecentJumplists](policy-csp-start.md#hiderecentjumplists) +- [HideRecentJumplists](policy-csp-start.md#hiderecentjumplists) +- [HideRecentlyAddedApps](policy-csp-start.md#hiderecentlyaddedapps) +- [HideRecentlyAddedApps](policy-csp-start.md#hiderecentlyaddedapps) +- [HideRecommendedSection](policy-csp-start.md#hiderecommendedsection) +- [HideRecommendedSection](policy-csp-start.md#hiderecommendedsection) +- [HideRestart](policy-csp-start.md#hiderestart) +- [HideShutDown](policy-csp-start.md#hideshutdown) +- [HideSignOut](policy-csp-start.md#hidesignout) +- [HideSleep](policy-csp-start.md#hidesleep) +- [HideSwitchAccount](policy-csp-start.md#hideswitchaccount) +- [HideTaskViewButton](policy-csp-start.md#hidetaskviewbutton) +- [HideTaskViewButton](policy-csp-start.md#hidetaskviewbutton) +- [HideUserTile](policy-csp-start.md#hideusertile) +- [ImportEdgeAssets](policy-csp-start.md#importedgeassets) +- [NoPinningToTaskbar](policy-csp-start.md#nopinningtotaskbar) +- [ShowOrHideMostUsedApps](policy-csp-start.md#showorhidemostusedapps) +- [ShowOrHideMostUsedApps](policy-csp-start.md#showorhidemostusedapps) +- [SimplifyQuickSettings](policy-csp-start.md#simplifyquicksettings) +- [StartLayout](policy-csp-start.md#startlayout) +- [StartLayout](policy-csp-start.md#startlayout) ## Storage -- [WPDDevicesDenyReadAccessPerUser](policy-csp-storage.md) -- [WPDDevicesDenyWriteAccessPerUser](policy-csp-storage.md) -- [WPDDevicesDenyReadAccessPerDevice](policy-csp-storage.md) -- [WPDDevicesDenyWriteAccessPerDevice](policy-csp-storage.md) +- [WPDDevicesDenyReadAccessPerDevice](policy-csp-storage.md#wpddevicesdenyreadaccessperdevice) +- [WPDDevicesDenyReadAccessPerUser](policy-csp-storage.md#wpddevicesdenyreadaccessperuser) +- [WPDDevicesDenyWriteAccessPerDevice](policy-csp-storage.md#wpddevicesdenywriteaccessperdevice) +- [WPDDevicesDenyWriteAccessPerUser](policy-csp-storage.md#wpddevicesdenywriteaccessperuser) ## System -- [AllowTelemetry](policy-csp-system.md) -- [AllowBuildPreview](policy-csp-system.md) -- [AllowExperimentation](policy-csp-system.md) -- [AllowFontProviders](policy-csp-system.md) -- [AllowLocation](policy-csp-system.md) -- [AllowStorageCard](policy-csp-system.md) -- [AllowTelemetry](policy-csp-system.md) +- [AllowBuildPreview](policy-csp-system.md#allowbuildpreview) +- [AllowExperimentation](policy-csp-system.md#allowexperimentation) +- [AllowFontProviders](policy-csp-system.md#allowfontproviders) +- [AllowLocation](policy-csp-system.md#allowlocation) +- [AllowStorageCard](policy-csp-system.md#allowstoragecard) +- [AllowTelemetry](policy-csp-system.md#allowtelemetry) +- [AllowTelemetry](policy-csp-system.md#allowtelemetry) ## TextInput -- [TextInput](policy-csp-textinput.md) -- [AllowIMELogging](policy-csp-textinput.md) -- [AllowIMENetworkAccess](policy-csp-textinput.md) -- [AllowInputPanel](policy-csp-textinput.md) -- [AllowJapaneseIMESurrogatePairCharacters](policy-csp-textinput.md) -- [AllowJapaneseIVSCharacters](policy-csp-textinput.md) -- [AllowJapaneseNonPublishingStandardGlyph](policy-csp-textinput.md) -- [AllowJapaneseUserDictionary](policy-csp-textinput.md) -- [AllowKeyboardTextSuggestions](policy-csp-textinput.md) -- [AllowHardwareKeyboardTextSuggestions](policy-csp-textinput.md) -- [AllowLanguageFeaturesUninstall](policy-csp-textinput.md) -- [AllowLinguisticDataCollection](policy-csp-textinput.md) -- [ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md) -- [ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md) -- [ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md) -- [EnableTouchKeyboardAutoInvokeInDesktopMode](policy-csp-textinput.md) -- [TouchKeyboardFullModeAvailability](policy-csp-textinput.md) -- [TouchKeyboardWideModeAvailability](policy-csp-textinput.md) -- [TouchKeyboardNarrowModeAvailability](policy-csp-textinput.md) -- [TouchKeyboardHandwritingModeAvailability](policy-csp-textinput.md) -- [TouchKeyboardSplitModeAvailability](policy-csp-textinput.md) -- [TouchKeyboardEmojiButtonAvailability](policy-csp-textinput.md) -- [ForceTouchKeyboardDockedState](policy-csp-textinput.md) -- [TouchKeyboardDictationButtonAvailability](policy-csp-textinput.md) -- [ConfigureSimplifiedChineseIMEVersion](policy-csp-textinput.md) -- [ConfigureTraditionalChineseIMEVersion](policy-csp-textinput.md) -- [ConfigureJapaneseIMEVersion](policy-csp-textinput.md) -- [ConfigureKoreanIMEVersion](policy-csp-textinput.md) -- [AllowTextInputSuggestionUpdate](policy-csp-textinput.md) +- [AllowHardwareKeyboardTextSuggestions](policy-csp-textinput.md#allowhardwarekeyboardtextsuggestions) +- [AllowIMELogging](policy-csp-textinput.md#allowimelogging) +- [AllowIMENetworkAccess](policy-csp-textinput.md#allowimenetworkaccess) +- [AllowInputPanel](policy-csp-textinput.md#allowinputpanel) +- [AllowJapaneseIMESurrogatePairCharacters](policy-csp-textinput.md#allowjapaneseimesurrogatepaircharacters) +- [AllowJapaneseIVSCharacters](policy-csp-textinput.md#allowjapaneseivscharacters) +- [AllowJapaneseNonPublishingStandardGlyph](policy-csp-textinput.md#allowjapanesenonpublishingstandardglyph) +- [AllowJapaneseUserDictionary](policy-csp-textinput.md#allowjapaneseuserdictionary) +- [AllowKeyboardTextSuggestions](policy-csp-textinput.md#allowkeyboardtextsuggestions) +- [AllowLanguageFeaturesUninstall](policy-csp-textinput.md#allowlanguagefeaturesuninstall) +- [AllowLinguisticDataCollection](policy-csp-textinput.md#allowlinguisticdatacollection) +- [AllowTextInputSuggestionUpdate](policy-csp-textinput.md#allowtextinputsuggestionupdate) +- [ConfigureJapaneseIMEVersion](policy-csp-textinput.md#configurejapaneseimeversion) +- [ConfigureKoreanIMEVersion](policy-csp-textinput.md#configurekoreanimeversion) +- [ConfigureSimplifiedChineseIMEVersion](policy-csp-textinput.md#configuresimplifiedchineseimeversion) +- [ConfigureTraditionalChineseIMEVersion](policy-csp-textinput.md#configuretraditionalchineseimeversion) +- [EnableTouchKeyboardAutoInvokeInDesktopMode](policy-csp-textinput.md#enabletouchkeyboardautoinvokeindesktopmode) +- [ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md#excludejapaneseimeexceptjis0208) +- [ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#excludejapaneseimeexceptjis0208andeudc) +- [ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#excludejapaneseimeexceptshiftjis) +- [ForceTouchKeyboardDockedState](policy-csp-textinput.md#forcetouchkeyboarddockedstate) +- [TouchKeyboardDictationButtonAvailability](policy-csp-textinput.md#touchkeyboarddictationbuttonavailability) +- [TouchKeyboardEmojiButtonAvailability](policy-csp-textinput.md#touchkeyboardemojibuttonavailability) +- [TouchKeyboardFullModeAvailability](policy-csp-textinput.md#touchkeyboardfullmodeavailability) +- [TouchKeyboardHandwritingModeAvailability](policy-csp-textinput.md#touchkeyboardhandwritingmodeavailability) +- [TouchKeyboardNarrowModeAvailability](policy-csp-textinput.md#touchkeyboardnarrowmodeavailability) +- [TouchKeyboardSplitModeAvailability](policy-csp-textinput.md#touchkeyboardsplitmodeavailability) +- [TouchKeyboardWideModeAvailability](policy-csp-textinput.md#touchkeyboardwidemodeavailability) ## TimeLanguageSettings -- [ConfigureTimeZone](policy-csp-timelanguagesettings.md) +- [ConfigureTimeZone](policy-csp-timelanguagesettings.md#configuretimezone) ## Update -- [Update](policy-csp-update.md) -- [ActiveHoursEnd](policy-csp-update.md) -- [ActiveHoursStart](policy-csp-update.md) -- [ActiveHoursMaxRange](policy-csp-update.md) -- [AutoRestartRequiredNotificationDismissal](policy-csp-update.md) -- [AutoRestartNotificationSchedule](policy-csp-update.md) -- [SetAutoRestartNotificationDisable](policy-csp-update.md) -- [ScheduleRestartWarning](policy-csp-update.md) -- [ScheduleImminentRestartWarning](policy-csp-update.md) -- [AllowAutoUpdate](policy-csp-update.md) -- [AllowNonMicrosoftSignedUpdate](policy-csp-update.md) -- [AutoRestartDeadlinePeriodInDays](policy-csp-update.md) -- [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](policy-csp-update.md) -- [EngagedRestartTransitionSchedule](policy-csp-update.md) -- [EngagedRestartSnoozeSchedule](policy-csp-update.md) -- [EngagedRestartDeadline](policy-csp-update.md) -- [EngagedRestartTransitionScheduleForFeatureUpdates](policy-csp-update.md) -- [EngagedRestartSnoozeScheduleForFeatureUpdates](policy-csp-update.md) -- [EngagedRestartDeadlineForFeatureUpdates](policy-csp-update.md) -- [DetectionFrequency](policy-csp-update.md) -- [ManagePreviewBuilds](policy-csp-update.md) -- [BranchReadinessLevel](policy-csp-update.md) -- [ProductVersion](policy-csp-update.md) -- [TargetReleaseVersion](policy-csp-update.md) -- [DisableWUfBSafeguards](policy-csp-update.md) -- [AllowUpdateService](policy-csp-update.md) -- [DeferFeatureUpdatesPeriodInDays](policy-csp-update.md) -- [DeferQualityUpdatesPeriodInDays](policy-csp-update.md) -- [DeferUpdatePeriod](policy-csp-update.md) -- [DeferUpgradePeriod](policy-csp-update.md) -- [ExcludeWUDriversInQualityUpdate](policy-csp-update.md) -- [PauseDeferrals](policy-csp-update.md) -- [PauseFeatureUpdates](policy-csp-update.md) -- [PauseQualityUpdates](policy-csp-update.md) -- [PauseFeatureUpdatesStartTime](policy-csp-update.md) -- [PauseQualityUpdatesStartTime](policy-csp-update.md) -- [PhoneUpdateRestrictions](policy-csp-update.md) -- [RequireDeferUpgrade](policy-csp-update.md) -- [AllowMUUpdateService](policy-csp-update.md) -- [RequireUpdateApproval](policy-csp-update.md) -- [ScheduledInstallDay](policy-csp-update.md) -- [ScheduledInstallTime](policy-csp-update.md) -- [ScheduledInstallEveryWeek](policy-csp-update.md) -- [ScheduledInstallFirstWeek](policy-csp-update.md) -- [ScheduledInstallSecondWeek](policy-csp-update.md) -- [ScheduledInstallThirdWeek](policy-csp-update.md) -- [ScheduledInstallFourthWeek](policy-csp-update.md) -- [UpdateServiceUrl](policy-csp-update.md) -- [UpdateServiceUrlAlternate](policy-csp-update.md) -- [FillEmptyContentUrls](policy-csp-update.md) -- [SetProxyBehaviorForUpdateDetection](policy-csp-update.md) -- [DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection](policy-csp-update.md) -- [SetPolicyDrivenUpdateSourceForFeatureUpdates](policy-csp-update.md) -- [SetPolicyDrivenUpdateSourceForQualityUpdates](policy-csp-update.md) -- [SetPolicyDrivenUpdateSourceForDriverUpdates](policy-csp-update.md) -- [SetPolicyDrivenUpdateSourceForOtherUpdates](policy-csp-update.md) -- [SetEDURestart](policy-csp-update.md) -- [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](policy-csp-update.md) -- [AllowTemporaryEnterpriseFeatureControl](policy-csp-update.md) -- [SetDisableUXWUAccess](policy-csp-update.md) -- [SetDisablePauseUXAccess](policy-csp-update.md) -- [UpdateNotificationLevel](policy-csp-update.md) -- [NoUpdateNotificationsDuringActiveHours](policy-csp-update.md) -- [IgnoreMOUpdateDownloadLimit](policy-csp-update.md) -- [IgnoreMOAppDownloadLimit](policy-csp-update.md) -- [DisableDualScan](policy-csp-update.md) -- [ConfigureFeatureUpdateUninstallPeriod](policy-csp-update.md) -- [AutomaticMaintenanceWakeUp](policy-csp-update.md) -- [ConfigureDeadlineForQualityUpdates](policy-csp-update.md) -- [ConfigureDeadlineForFeatureUpdates](policy-csp-update.md) -- [ConfigureDeadlineGracePeriod](policy-csp-update.md) -- [ConfigureDeadlineGracePeriodForFeatureUpdates](policy-csp-update.md) -- [ConfigureDeadlineNoAutoReboot](policy-csp-update.md) -- [ConfigureDeadlineNoAutoRebootForFeatureUpdates](policy-csp-update.md) -- [ConfigureDeadlineNoAutoRebootForQualityUpdates](policy-csp-update.md) +- [ActiveHoursEnd](policy-csp-update.md#activehoursend) +- [ActiveHoursMaxRange](policy-csp-update.md#activehoursmaxrange) +- [ActiveHoursStart](policy-csp-update.md#activehoursstart) +- [AllowAutoUpdate](policy-csp-update.md#allowautoupdate) +- [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](policy-csp-update.md#allowautowindowsupdatedownloadovermeterednetwork) +- [AllowMUUpdateService](policy-csp-update.md#allowmuupdateservice) +- [AllowNonMicrosoftSignedUpdate](policy-csp-update.md#allownonmicrosoftsignedupdate) +- [AllowTemporaryEnterpriseFeatureControl](policy-csp-update.md#allowtemporaryenterprisefeaturecontrol) +- [AllowUpdateService](policy-csp-update.md#allowupdateservice) +- [AutomaticMaintenanceWakeUp](policy-csp-update.md#automaticmaintenancewakeup) +- [AutoRestartDeadlinePeriodInDays](policy-csp-update.md#autorestartdeadlineperiodindays) +- [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](policy-csp-update.md#autorestartdeadlineperiodindaysforfeatureupdates) +- [AutoRestartNotificationSchedule](policy-csp-update.md#autorestartnotificationschedule) +- [AutoRestartRequiredNotificationDismissal](policy-csp-update.md#autorestartrequirednotificationdismissal) +- [BranchReadinessLevel](policy-csp-update.md#branchreadinesslevel) +- [ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#configuredeadlineforfeatureupdates) +- [ConfigureDeadlineForQualityUpdates](policy-csp-update.md#configuredeadlineforqualityupdates) +- [ConfigureDeadlineGracePeriod](policy-csp-update.md#configuredeadlinegraceperiod) +- [ConfigureDeadlineGracePeriodForFeatureUpdates](policy-csp-update.md#configuredeadlinegraceperiodforfeatureupdates) +- [ConfigureDeadlineNoAutoReboot](policy-csp-update.md#configuredeadlinenoautoreboot) +- [ConfigureDeadlineNoAutoRebootForFeatureUpdates](policy-csp-update.md#configuredeadlinenoautorebootforfeatureupdates) +- [ConfigureDeadlineNoAutoRebootForQualityUpdates](policy-csp-update.md#configuredeadlinenoautorebootforqualityupdates) +- [ConfigureFeatureUpdateUninstallPeriod](policy-csp-update.md#configurefeatureupdateuninstallperiod) +- [DeferFeatureUpdatesPeriodInDays](policy-csp-update.md#deferfeatureupdatesperiodindays) +- [DeferQualityUpdatesPeriodInDays](policy-csp-update.md#deferqualityupdatesperiodindays) +- [DeferUpdatePeriod](policy-csp-update.md#deferupdateperiod) +- [DeferUpgradePeriod](policy-csp-update.md#deferupgradeperiod) +- [DetectionFrequency](policy-csp-update.md#detectionfrequency) +- [DisableDualScan](policy-csp-update.md#disabledualscan) +- [DisableWUfBSafeguards](policy-csp-update.md#disablewufbsafeguards) +- [DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection](policy-csp-update.md#donotenforceenterprisetlscertpinningforupdatedetection) +- [EngagedRestartDeadline](policy-csp-update.md#engagedrestartdeadline) +- [EngagedRestartDeadlineForFeatureUpdates](policy-csp-update.md#engagedrestartdeadlineforfeatureupdates) +- [EngagedRestartSnoozeSchedule](policy-csp-update.md#engagedrestartsnoozeschedule) +- [EngagedRestartSnoozeScheduleForFeatureUpdates](policy-csp-update.md#engagedrestartsnoozescheduleforfeatureupdates) +- [EngagedRestartTransitionSchedule](policy-csp-update.md#engagedrestarttransitionschedule) +- [EngagedRestartTransitionScheduleForFeatureUpdates](policy-csp-update.md#engagedrestarttransitionscheduleforfeatureupdates) +- [ExcludeWUDriversInQualityUpdate](policy-csp-update.md#excludewudriversinqualityupdate) +- [FillEmptyContentUrls](policy-csp-update.md#fillemptycontenturls) +- [IgnoreMOAppDownloadLimit](policy-csp-update.md#ignoremoappdownloadlimit) +- [IgnoreMOUpdateDownloadLimit](policy-csp-update.md#ignoremoupdatedownloadlimit) +- [ManagePreviewBuilds](policy-csp-update.md#managepreviewbuilds) +- [NoUpdateNotificationsDuringActiveHours](policy-csp-update.md#noupdatenotificationsduringactivehours) +- [PauseDeferrals](policy-csp-update.md#pausedeferrals) +- [PauseFeatureUpdates](policy-csp-update.md#pausefeatureupdates) +- [PauseFeatureUpdatesStartTime](policy-csp-update.md#pausefeatureupdatesstarttime) +- [PauseQualityUpdates](policy-csp-update.md#pausequalityupdates) +- [PauseQualityUpdatesStartTime](policy-csp-update.md#pausequalityupdatesstarttime) +- [PhoneUpdateRestrictions](policy-csp-update.md#phoneupdaterestrictions) +- [ProductVersion](policy-csp-update.md#productversion) +- [RequireDeferUpgrade](policy-csp-update.md#requiredeferupgrade) +- [RequireUpdateApproval](policy-csp-update.md#requireupdateapproval) +- [ScheduledInstallDay](policy-csp-update.md#scheduledinstallday) +- [ScheduledInstallEveryWeek](policy-csp-update.md#scheduledinstalleveryweek) +- [ScheduledInstallFirstWeek](policy-csp-update.md#scheduledinstallfirstweek) +- [ScheduledInstallFourthWeek](policy-csp-update.md#scheduledinstallfourthweek) +- [ScheduledInstallSecondWeek](policy-csp-update.md#scheduledinstallsecondweek) +- [ScheduledInstallThirdWeek](policy-csp-update.md#scheduledinstallthirdweek) +- [ScheduledInstallTime](policy-csp-update.md#scheduledinstalltime) +- [ScheduleImminentRestartWarning](policy-csp-update.md#scheduleimminentrestartwarning) +- [ScheduleRestartWarning](policy-csp-update.md#schedulerestartwarning) +- [SetAutoRestartNotificationDisable](policy-csp-update.md#setautorestartnotificationdisable) +- [SetDisablePauseUXAccess](policy-csp-update.md#setdisablepauseuxaccess) +- [SetDisableUXWUAccess](policy-csp-update.md#setdisableuxwuaccess) +- [SetEDURestart](policy-csp-update.md#setedurestart) +- [SetPolicyDrivenUpdateSourceForDriverUpdates](policy-csp-update.md#setpolicydrivenupdatesourcefordriverupdates) +- [SetPolicyDrivenUpdateSourceForFeatureUpdates](policy-csp-update.md#setpolicydrivenupdatesourceforfeatureupdates) +- [SetPolicyDrivenUpdateSourceForOtherUpdates](policy-csp-update.md#setpolicydrivenupdatesourceforotherupdates) +- [SetPolicyDrivenUpdateSourceForQualityUpdates](policy-csp-update.md#setpolicydrivenupdatesourceforqualityupdates) +- [SetProxyBehaviorForUpdateDetection](policy-csp-update.md#setproxybehaviorforupdatedetection) +- [TargetReleaseVersion](policy-csp-update.md#targetreleaseversion) +- [UpdateNotificationLevel](policy-csp-update.md#updatenotificationlevel) +- [UpdateServiceUrl](policy-csp-update.md#updateserviceurl) +- [UpdateServiceUrlAlternate](policy-csp-update.md#updateserviceurlalternate) ## Wifi -- [AllowInternetSharing](policy-csp-wifi.md) -- [AllowManualWiFiConfiguration](policy-csp-wifi.md) -- [AllowWiFi](policy-csp-wifi.md) -- [AllowWiFiDirect](policy-csp-wifi.md) -- [WLANScanMode](policy-csp-wifi.md) +- [AllowInternetSharing](policy-csp-wifi.md#allowinternetsharing) +- [AllowManualWiFiConfiguration](policy-csp-wifi.md#allowmanualwificonfiguration) +- [AllowWiFi](policy-csp-wifi.md#allowwifi) +- [AllowWiFiDirect](policy-csp-wifi.md#allowwifidirect) +- [WLANScanMode](policy-csp-wifi.md#wlanscanmode) ## WindowsDefenderSecurityCenter -- [WindowsDefenderSecurityCenter](policy-csp-windowsdefendersecuritycenter.md) -- [CompanyName](policy-csp-windowsdefendersecuritycenter.md) -- [DisableAppBrowserUI](policy-csp-windowsdefendersecuritycenter.md) -- [DisableEnhancedNotifications](policy-csp-windowsdefendersecuritycenter.md) -- [DisableFamilyUI](policy-csp-windowsdefendersecuritycenter.md) -- [DisableAccountProtectionUI](policy-csp-windowsdefendersecuritycenter.md) -- [DisableClearTpmButton](policy-csp-windowsdefendersecuritycenter.md) -- [DisableDeviceSecurityUI](policy-csp-windowsdefendersecuritycenter.md) -- [DisableHealthUI](policy-csp-windowsdefendersecuritycenter.md) -- [DisableNetworkUI](policy-csp-windowsdefendersecuritycenter.md) -- [DisableNotifications](policy-csp-windowsdefendersecuritycenter.md) -- [DisableTpmFirmwareUpdateWarning](policy-csp-windowsdefendersecuritycenter.md) -- [DisableVirusUI](policy-csp-windowsdefendersecuritycenter.md) -- [DisallowExploitProtectionOverride](policy-csp-windowsdefendersecuritycenter.md) -- [Email](policy-csp-windowsdefendersecuritycenter.md) -- [EnableCustomizedToasts](policy-csp-windowsdefendersecuritycenter.md) -- [EnableInAppCustomization](policy-csp-windowsdefendersecuritycenter.md) -- [HideRansomwareDataRecovery](policy-csp-windowsdefendersecuritycenter.md) -- [HideSecureBoot](policy-csp-windowsdefendersecuritycenter.md) -- [HideTPMTroubleshooting](policy-csp-windowsdefendersecuritycenter.md) -- [HideWindowsSecurityNotificationAreaControl](policy-csp-windowsdefendersecuritycenter.md) -- [Phone](policy-csp-windowsdefendersecuritycenter.md) -- [URL](policy-csp-windowsdefendersecuritycenter.md) +- [CompanyName](policy-csp-windowsdefendersecuritycenter.md#companyname) +- [DisableAccountProtectionUI](policy-csp-windowsdefendersecuritycenter.md#disableaccountprotectionui) +- [DisableAppBrowserUI](policy-csp-windowsdefendersecuritycenter.md#disableappbrowserui) +- [DisableClearTpmButton](policy-csp-windowsdefendersecuritycenter.md#disablecleartpmbutton) +- [DisableDeviceSecurityUI](policy-csp-windowsdefendersecuritycenter.md#disabledevicesecurityui) +- [DisableEnhancedNotifications](policy-csp-windowsdefendersecuritycenter.md#disableenhancednotifications) +- [DisableFamilyUI](policy-csp-windowsdefendersecuritycenter.md#disablefamilyui) +- [DisableHealthUI](policy-csp-windowsdefendersecuritycenter.md#disablehealthui) +- [DisableNetworkUI](policy-csp-windowsdefendersecuritycenter.md#disablenetworkui) +- [DisableNotifications](policy-csp-windowsdefendersecuritycenter.md#disablenotifications) +- [DisableTpmFirmwareUpdateWarning](policy-csp-windowsdefendersecuritycenter.md#disabletpmfirmwareupdatewarning) +- [DisableVirusUI](policy-csp-windowsdefendersecuritycenter.md#disablevirusui) +- [DisallowExploitProtectionOverride](policy-csp-windowsdefendersecuritycenter.md#disallowexploitprotectionoverride) +- [Email](policy-csp-windowsdefendersecuritycenter.md#email) +- [EnableCustomizedToasts](policy-csp-windowsdefendersecuritycenter.md#enablecustomizedtoasts) +- [EnableInAppCustomization](policy-csp-windowsdefendersecuritycenter.md#enableinappcustomization) +- [HideRansomwareDataRecovery](policy-csp-windowsdefendersecuritycenter.md#hideransomwaredatarecovery) +- [HideSecureBoot](policy-csp-windowsdefendersecuritycenter.md#hidesecureboot) +- [HideTPMTroubleshooting](policy-csp-windowsdefendersecuritycenter.md#hidetpmtroubleshooting) +- [HideWindowsSecurityNotificationAreaControl](policy-csp-windowsdefendersecuritycenter.md#hidewindowssecuritynotificationareacontrol) +- [Phone](policy-csp-windowsdefendersecuritycenter.md#phone) +- [URL](policy-csp-windowsdefendersecuritycenter.md#url) ## WirelessDisplay -- [WirelessDisplay](policy-csp-wirelessdisplay.md) -- [AllowProjectionFromPC](policy-csp-wirelessdisplay.md) -- [AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay.md) -- [AllowProjectionToPC](policy-csp-wirelessdisplay.md) -- [AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay.md) -- [AllowUserInputFromWirelessDisplayReceiver](policy-csp-wirelessdisplay.md) -- [RequirePinForPairing](policy-csp-wirelessdisplay.md) -- [AllowMdnsAdvertisement](policy-csp-wirelessdisplay.md) -- [AllowMdnsDiscovery](policy-csp-wirelessdisplay.md) -- [AllowMovementDetectionOnInfrastructure](policy-csp-wirelessdisplay.md) -- [AllowPCSenderToBeTCPClient](policy-csp-wirelessdisplay.md) -- [AllowPCReceiverToBeTCPServer](policy-csp-wirelessdisplay.md) +- [AllowMdnsAdvertisement](policy-csp-wirelessdisplay.md#allowmdnsadvertisement) +- [AllowMdnsDiscovery](policy-csp-wirelessdisplay.md#allowmdnsdiscovery) +- [AllowMovementDetectionOnInfrastructure](policy-csp-wirelessdisplay.md#allowmovementdetectiononinfrastructure) +- [AllowPCReceiverToBeTCPServer](policy-csp-wirelessdisplay.md#allowpcreceivertobetcpserver) +- [AllowPCSenderToBeTCPClient](policy-csp-wirelessdisplay.md#allowpcsendertobetcpclient) +- [AllowProjectionFromPC](policy-csp-wirelessdisplay.md#allowprojectionfrompc) +- [AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay.md#allowprojectionfrompcoverinfrastructure) +- [AllowProjectionToPC](policy-csp-wirelessdisplay.md#allowprojectiontopc) +- [AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay.md#allowprojectiontopcoverinfrastructure) +- [AllowUserInputFromWirelessDisplayReceiver](policy-csp-wirelessdisplay.md#allowuserinputfromwirelessdisplayreceiver) +- [RequirePinForPairing](policy-csp-wirelessdisplay.md#requirepinforpairing) ## Related articles From 42da51b1ea6a8e336e2276b24a74a3c3008f0e85 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 17 Mar 2023 18:05:45 -0400 Subject: [PATCH 04/26] Fix bookmark links --- ...-in-policy-csp-supported-by-surface-hub.md | 102 +++++++++--------- 1 file changed, 51 insertions(+), 51 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md index f426bbd777..5abbb6fc17 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -215,75 +215,75 @@ This article lists the policies in Policy CSP that are applicable for Surface Hu - [AllowInputPersonalization](policy-csp-privacy.md#allowinputpersonalization) - [DisableAdvertisingId](policy-csp-privacy.md#disableadvertisingid) - [LetAppsAccessAccountInfo](policy-csp-privacy.md#letappsaccessaccountinfo) -- [LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo-forceallowtheseapps) -- [LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo-forcedenytheseapps) -- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo-userincontroloftheseapps) +- [LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo_forceallowtheseapps) +- [LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo_forcedenytheseapps) +- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo_userincontroloftheseapps) - [LetAppsAccessCalendar](policy-csp-privacy.md#letappsaccesscalendar) -- [LetAppsAccessCalendar_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscalendar-forceallowtheseapps) -- [LetAppsAccessCalendar_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscalendar-forcedenytheseapps) -- [LetAppsAccessCalendar_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscalendar-userincontroloftheseapps) +- [LetAppsAccessCalendar_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscalendar_forceallowtheseapps) +- [LetAppsAccessCalendar_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscalendar_forcedenytheseapps) +- [LetAppsAccessCalendar_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscalendar_userincontroloftheseapps) - [LetAppsAccessCallHistory](policy-csp-privacy.md#letappsaccesscallhistory) -- [LetAppsAccessCallHistory_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscallhistory-forceallowtheseapps) -- [LetAppsAccessCallHistory_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscallhistory-forcedenytheseapps) -- [LetAppsAccessCallHistory_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscallhistory-userincontroloftheseapps) +- [LetAppsAccessCallHistory_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscallhistory_forceallowtheseapps) +- [LetAppsAccessCallHistory_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscallhistory_forcedenytheseapps) +- [LetAppsAccessCallHistory_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscallhistory_userincontroloftheseapps) - [LetAppsAccessCamera](policy-csp-privacy.md#letappsaccesscamera) -- [LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscamera-forceallowtheseapps) -- [LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscamera-forcedenytheseapps) -- [LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscamera-userincontroloftheseapps) +- [LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscamera_forceallowtheseapps) +- [LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscamera_forcedenytheseapps) +- [LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscamera_userincontroloftheseapps) - [LetAppsAccessContacts](policy-csp-privacy.md#letappsaccesscontacts) -- [LetAppsAccessContacts_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscontacts-forceallowtheseapps) -- [LetAppsAccessContacts_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscontacts-forcedenytheseapps) -- [LetAppsAccessContacts_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscontacts-userincontroloftheseapps) +- [LetAppsAccessContacts_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscontacts_forceallowtheseapps) +- [LetAppsAccessContacts_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscontacts_forcedenytheseapps) +- [LetAppsAccessContacts_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscontacts_userincontroloftheseapps) - [LetAppsAccessEmail](policy-csp-privacy.md#letappsaccessemail) -- [LetAppsAccessEmail_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessemail-forceallowtheseapps) -- [LetAppsAccessEmail_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessemail-forcedenytheseapps) -- [LetAppsAccessEmail_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessemail-userincontroloftheseapps) +- [LetAppsAccessEmail_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessemail_forceallowtheseapps) +- [LetAppsAccessEmail_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessemail_forcedenytheseapps) +- [LetAppsAccessEmail_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessemail_userincontroloftheseapps) - [LetAppsAccessLocation](policy-csp-privacy.md#letappsaccesslocation) -- [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesslocation-forceallowtheseapps) -- [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesslocation-forcedenytheseapps) -- [LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesslocation-userincontroloftheseapps) +- [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesslocation_forceallowtheseapps) +- [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesslocation_forcedenytheseapps) +- [LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesslocation_userincontroloftheseapps) - [LetAppsAccessMessaging](policy-csp-privacy.md#letappsaccessmessaging) -- [LetAppsAccessMessaging_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmessaging-forceallowtheseapps) -- [LetAppsAccessMessaging_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmessaging-forcedenytheseapps) -- [LetAppsAccessMessaging_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessmessaging-userincontroloftheseapps) +- [LetAppsAccessMessaging_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmessaging_forceallowtheseapps) +- [LetAppsAccessMessaging_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmessaging_forcedenytheseapps) +- [LetAppsAccessMessaging_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessmessaging_userincontroloftheseapps) - [LetAppsAccessMicrophone](policy-csp-privacy.md#letappsaccessmicrophone) -- [LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmicrophone-forceallowtheseapps) -- [LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmicrophone-forcedenytheseapps) -- [LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessmicrophone-userincontroloftheseapps) +- [LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forceallowtheseapps) +- [LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forcedenytheseapps) +- [LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_userincontroloftheseapps) - [LetAppsAccessNotifications](policy-csp-privacy.md#letappsaccessnotifications) -- [LetAppsAccessNotifications_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessnotifications-forceallowtheseapps) -- [LetAppsAccessNotifications_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessnotifications-forcedenytheseapps) -- [LetAppsAccessNotifications_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessnotifications-userincontroloftheseapps) +- [LetAppsAccessNotifications_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessnotifications_forceallowtheseapps) +- [LetAppsAccessNotifications_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessnotifications_forcedenytheseapps) +- [LetAppsAccessNotifications_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessnotifications_userincontroloftheseapps) - [LetAppsAccessPhone](policy-csp-privacy.md#letappsaccessphone) -- [LetAppsAccessPhone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessphone-forceallowtheseapps) -- [LetAppsAccessPhone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessphone-forcedenytheseapps) -- [LetAppsAccessPhone_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessphone-userincontroloftheseapps) +- [LetAppsAccessPhone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessphone_forceallowtheseapps) +- [LetAppsAccessPhone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessphone_forcedenytheseapps) +- [LetAppsAccessPhone_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessphone_userincontroloftheseapps) - [LetAppsAccessRadios](policy-csp-privacy.md#letappsaccessradios) -- [LetAppsAccessRadios_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessradios-forceallowtheseapps) -- [LetAppsAccessRadios_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessradios-forcedenytheseapps) -- [LetAppsAccessRadios_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessradios-userincontroloftheseapps) +- [LetAppsAccessRadios_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessradios_forceallowtheseapps) +- [LetAppsAccessRadios_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessradios_forcedenytheseapps) +- [LetAppsAccessRadios_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessradios_userincontroloftheseapps) - [LetAppsAccessTasks](policy-csp-privacy.md#letappsaccesstasks) -- [LetAppsAccessTasks_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesstasks-forceallowtheseapps) -- [LetAppsAccessTasks_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesstasks-forcedenytheseapps) -- [LetAppsAccessTasks_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesstasks-userincontroloftheseapps) +- [LetAppsAccessTasks_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesstasks_forceallowtheseapps) +- [LetAppsAccessTasks_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesstasks_forcedenytheseapps) +- [LetAppsAccessTasks_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesstasks_userincontroloftheseapps) - [LetAppsAccessTrustedDevices](policy-csp-privacy.md#letappsaccesstrusteddevices) -- [LetAppsAccessTrustedDevices_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices-forceallowtheseapps) -- [LetAppsAccessTrustedDevices_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices-forcedenytheseapps) -- [LetAppsAccessTrustedDevices_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices-userincontroloftheseapps) +- [LetAppsAccessTrustedDevices_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices_forceallowtheseapps) +- [LetAppsAccessTrustedDevices_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices_forcedenytheseapps) +- [LetAppsAccessTrustedDevices_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices_userincontroloftheseapps) - [LetAppsActivateWithVoice](policy-csp-privacy.md#letappsactivatewithvoice) - [LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#letappsactivatewithvoiceabovelock) - [LetAppsGetDiagnosticInfo](policy-csp-privacy.md#letappsgetdiagnosticinfo) -- [LetAppsGetDiagnosticInfo_ForceAllowTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo-forceallowtheseapps) -- [LetAppsGetDiagnosticInfo_ForceDenyTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo-forcedenytheseapps) -- [LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo-userincontroloftheseapps) +- [LetAppsGetDiagnosticInfo_ForceAllowTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo_forceallowtheseapps) +- [LetAppsGetDiagnosticInfo_ForceDenyTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo_forcedenytheseapps) +- [LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo_userincontroloftheseapps) - [LetAppsRunInBackground](policy-csp-privacy.md#letappsruninbackground) -- [LetAppsRunInBackground_ForceAllowTheseApps](policy-csp-privacy.md#letappsruninbackground-forceallowtheseapps) -- [LetAppsRunInBackground_ForceDenyTheseApps](policy-csp-privacy.md#letappsruninbackground-forcedenytheseapps) -- [LetAppsRunInBackground_UserInControlOfTheseApps](policy-csp-privacy.md#letappsruninbackground-userincontroloftheseapps) +- [LetAppsRunInBackground_ForceAllowTheseApps](policy-csp-privacy.md#letappsruninbackground_forceallowtheseapps) +- [LetAppsRunInBackground_ForceDenyTheseApps](policy-csp-privacy.md#letappsruninbackground_forcedenytheseapps) +- [LetAppsRunInBackground_UserInControlOfTheseApps](policy-csp-privacy.md#letappsruninbackground_userincontroloftheseapps) - [LetAppsSyncWithDevices](policy-csp-privacy.md#letappssyncwithdevices) -- [LetAppsSyncWithDevices_ForceAllowTheseApps](policy-csp-privacy.md#letappssyncwithdevices-forceallowtheseapps) -- [LetAppsSyncWithDevices_ForceDenyTheseApps](policy-csp-privacy.md#letappssyncwithdevices-forcedenytheseapps) -- [LetAppsSyncWithDevices_UserInControlOfTheseApps](policy-csp-privacy.md#letappssyncwithdevices-userincontroloftheseapps) +- [LetAppsSyncWithDevices_ForceAllowTheseApps](policy-csp-privacy.md#letappssyncwithdevices_forceallowtheseapps) +- [LetAppsSyncWithDevices_ForceDenyTheseApps](policy-csp-privacy.md#letappssyncwithdevices_forcedenytheseapps) +- [LetAppsSyncWithDevices_UserInControlOfTheseApps](policy-csp-privacy.md#letappssyncwithdevices_userincontroloftheseapps) ## RestrictedGroups From f234cd3e7a92496ce144b7c3b044be0472422c5d Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 20 Mar 2023 10:14:38 -0400 Subject: [PATCH 05/26] Update TOC --- windows/client-management/mdm/toc.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 3a88cd3e96..bded40d8ed 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -37,21 +37,21 @@ items: href: configuration-service-provider-ddf.md - name: Policy CSP support scenarios items: - - name: ADMX policies in Policy CSP + - name: Policies that are ADMX-backed href: policies-in-policy-csp-admx-backed.md - - name: Policies in Policy CSP supported by Group Policy + - name: Policies supported by Group Policy href: policies-in-policy-csp-supported-by-group-policy.md - - name: Policies in Policy CSP supported by HoloLens 2 + - name: Policies supported by HoloLens 2 href: policies-in-policy-csp-supported-by-hololens2.md - - name: Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite + - name: Policies supported by HoloLens (1st gen) Commercial Suite href: policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md - - name: Policies in Policy CSP supported by HoloLens (1st gen) Development Edition + - name: Policies supported by HoloLens (1st gen) Development Edition href: policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md - - name: Policies in Policy CSP supported by Windows 10 IoT Core + - name: Policies supported by Windows 10 IoT Core href: policies-in-policy-csp-supported-by-iot-core.md - - name: Policies in Policy CSP supported by Microsoft Surface Hub + - name: Policies supported by Microsoft Surface Hub href: policies-in-policy-csp-supported-by-surface-hub.md - - name: Policy CSPs that can be set using Exchange Active Sync (EAS) + - name: Policies that can be set using Exchange Active Sync (EAS) href: policies-in-policy-csp-that-can-be-set-using-eas.md - name: Policy CSP areas expanded: true From d60b9559e018d1ababace77a6bbb6fa26f9b9b2a Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 23 Mar 2023 12:13:46 -0400 Subject: [PATCH 06/26] 2303 CSP Updates --- .../client-management/mdm/bitlocker-csp.md | 32 +- .../mdm/bitlocker-ddf-file.md | 64 +- windows/client-management/mdm/defender-csp.md | 95 +- windows/client-management/mdm/defender-ddf.md | 77 +- .../mdm/devicepreparation-csp.md | 84 +- .../mdm/devicepreparation-ddf-file.md | 47 +- windows/client-management/mdm/firewall-csp.md | 1153 ++++++++++++- .../mdm/firewall-ddf-file.md | 819 ++++++++- .../mdm/passportforwork-csp.md | 59 +- .../mdm/passportforwork-ddf.md | 45 +- .../mdm/personaldataencryption-csp.md | 279 ++- .../mdm/personaldataencryption-ddf-file.md | 184 +- .../mdm/policies-in-policy-csp-admx-backed.md | 4 +- ...in-policy-csp-supported-by-group-policy.md | 18 +- ...-in-policy-csp-supported-by-surface-hub.md | 4 +- .../mdm/policy-csp-abovelock.md | 4 +- .../mdm/policy-csp-accounts.md | 8 +- .../mdm/policy-csp-admx-addremoveprograms.md | 19 +- .../mdm/policy-csp-admx-appcompat.md | 5 +- .../mdm/policy-csp-admx-auditsettings.md | 3 +- .../mdm/policy-csp-admx-ciphersuiteorder.md | 4 +- .../mdm/policy-csp-admx-controlpanel.md | 5 +- .../policy-csp-admx-controlpaneldisplay.md | 20 +- .../policy-csp-admx-credentialproviders.md | 4 +- .../mdm/policy-csp-admx-credssp.md | 44 +- .../mdm/policy-csp-admx-ctrlaltdel.md | 4 +- .../mdm/policy-csp-admx-datacollection.md | 4 +- .../mdm/policy-csp-admx-dcom.md | 4 +- .../mdm/policy-csp-admx-desktop.md | 14 +- .../mdm/policy-csp-admx-deviceinstallation.md | 7 +- .../mdm/policy-csp-admx-diskquota.md | 6 +- .../mdm/policy-csp-admx-errorreporting.md | 5 +- .../mdm/policy-csp-admx-eventlog.md | 4 +- .../mdm/policy-csp-admx-eventviewer.md | 4 +- .../mdm/policy-csp-admx-explorer.md | 4 +- .../mdm/policy-csp-admx-filesys.md | 9 +- .../mdm/policy-csp-admx-folderredirection.md | 4 +- .../mdm/policy-csp-admx-framepanes.md | 8 +- .../mdm/policy-csp-admx-grouppolicy.md | 27 +- .../mdm/policy-csp-admx-help.md | 6 +- .../mdm/policy-csp-admx-iis.md | 3 +- .../mdm/policy-csp-admx-kdc.md | 12 +- .../mdm/policy-csp-admx-kerberos.md | 3 +- .../mdm/policy-csp-admx-leakdiagnostic.md | 6 +- .../mdm/policy-csp-admx-logon.md | 10 +- ...icy-csp-admx-microsoftdefenderantivirus.md | 45 +- .../mdm/policy-csp-admx-mmc.md | 10 +- .../mdm/policy-csp-admx-mmcsnapins.md | 4 +- .../mdm/policy-csp-admx-msapolicy.md | 3 +- .../mdm/policy-csp-admx-msdt.md | 3 +- .../mdm/policy-csp-admx-msi.md | 10 +- .../mdm/policy-csp-admx-nca.md | 6 +- .../mdm/policy-csp-admx-ncsi.md | 5 +- .../mdm/policy-csp-admx-netlogon.md | 27 +- .../mdm/policy-csp-admx-networkconnections.md | 8 +- .../mdm/policy-csp-admx-offlinefiles.md | 16 +- .../mdm/policy-csp-admx-peertopeercaching.md | 7 +- .../mdm/policy-csp-admx-printing.md | 13 +- .../mdm/policy-csp-admx-printing2.md | 6 +- .../mdm/policy-csp-admx-programs.md | 12 +- .../mdm/policy-csp-admx-pushtoinstall.md | 4 +- .../mdm/policy-csp-admx-rpc.md | 4 +- .../mdm/policy-csp-admx-sam.md | 18 +- .../mdm/policy-csp-admx-settingsync.md | 20 +- .../mdm/policy-csp-admx-sharedfolders.md | 8 +- ...csp-admx-shellcommandpromptregedittools.md | 4 +- .../mdm/policy-csp-admx-smartcard.md | 10 +- .../mdm/policy-csp-admx-srmfci.md | 4 +- .../mdm/policy-csp-admx-startmenu.md | 37 +- .../mdm/policy-csp-admx-taskbar.md | 4 +- .../mdm/policy-csp-admx-tcpip.md | 4 +- .../mdm/policy-csp-admx-terminalserver.md | 43 +- .../mdm/policy-csp-admx-tpm.md | 4 +- ...y-csp-admx-userexperiencevirtualization.md | 131 +- .../mdm/policy-csp-admx-userprofiles.md | 8 +- .../mdm/policy-csp-admx-w32time.md | 4 +- .../mdm/policy-csp-admx-wcm.md | 8 +- .../mdm/policy-csp-admx-windowsexplorer.md | 23 +- .../mdm/policy-csp-admx-winlogon.md | 7 +- .../mdm/policy-csp-admx-workfoldersclient.md | 4 +- .../mdm/policy-csp-applicationdefaults.md | 21 +- .../mdm/policy-csp-applicationmanagement.md | 9 +- .../mdm/policy-csp-appvirtualization.md | 4 +- .../client-management/mdm/policy-csp-audit.md | 119 +- .../mdm/policy-csp-authentication.md | 59 +- .../client-management/mdm/policy-csp-bits.md | 119 +- .../mdm/policy-csp-bluetooth.md | 4 +- .../mdm/policy-csp-browser.md | 216 ++- .../mdm/policy-csp-cellular.md | 66 +- .../mdm/policy-csp-clouddesktop.md | 12 +- .../mdm/policy-csp-connectivity.md | 10 +- .../mdm/policy-csp-dataprotection.md | 4 +- .../mdm/policy-csp-defender.md | 177 +- .../mdm/policy-csp-deliveryoptimization.md | 18 +- .../mdm/policy-csp-desktop.md | 4 +- .../mdm/policy-csp-desktopappinstaller.md | 104 +- .../mdm/policy-csp-deviceguard.md | 70 +- .../mdm/policy-csp-deviceinstallation.md | 40 +- .../mdm/policy-csp-devicelock.md | 221 ++- .../mdm/policy-csp-display.md | 74 +- .../mdm/policy-csp-education.md | 12 +- .../mdm/policy-csp-enterprisecloudprint.md | 14 +- .../mdm/policy-csp-experience.md | 91 +- .../mdm/policy-csp-exploitguard.md | 4 +- .../mdm/policy-csp-federatedauthentication.md | 4 +- .../mdm/policy-csp-humanpresence.md | 242 ++- .../mdm/policy-csp-internetexplorer.md | 58 +- .../mdm/policy-csp-kerberos.md | 41 +- .../mdm/policy-csp-licensing.md | 16 +- ...policy-csp-localpoliciessecurityoptions.md | 102 +- .../mdm/policy-csp-localusersandgroups.md | 14 +- .../mdm/policy-csp-multitasking.md | 20 +- .../mdm/policy-csp-networkisolation.md | 86 +- .../mdm/policy-csp-networklistmanager.md | 10 +- .../mdm/policy-csp-notifications.md | 69 +- .../client-management/mdm/policy-csp-power.md | 116 +- .../mdm/policy-csp-printers.md | 36 +- .../mdm/policy-csp-privacy.md | 1530 +++++++++++++++-- .../mdm/policy-csp-remoteassistance.md | 4 +- .../mdm/policy-csp-remotedesktop.md | 4 +- .../mdm/policy-csp-remotemanagement.md | 4 +- .../mdm/policy-csp-remoteshell.md | 6 +- .../mdm/policy-csp-restrictedgroups.md | 4 +- .../mdm/policy-csp-search.md | 38 +- .../mdm/policy-csp-security.md | 6 +- .../mdm/policy-csp-settings.md | 30 +- .../mdm/policy-csp-settingssync.md | 7 +- .../mdm/policy-csp-smartscreen.md | 23 +- .../client-management/mdm/policy-csp-start.md | 84 +- .../mdm/policy-csp-stickers.md | 6 +- .../mdm/policy-csp-system.md | 74 +- .../mdm/policy-csp-taskmanager.md | 4 +- .../mdm/policy-csp-textinput.md | 32 +- .../mdm/policy-csp-update.md | 769 +++++++-- .../mdm/policy-csp-userrights.md | 101 +- ...olicy-csp-virtualizationbasedtechnology.md | 12 +- .../mdm/policy-csp-webthreatdefense.md | 5 +- .../client-management/mdm/policy-csp-wifi.md | 6 +- ...olicy-csp-windowsdefendersecuritycenter.md | 72 +- .../mdm/policy-csp-windowsinkworkspace.md | 10 +- .../mdm/policy-csp-windowslogon.md | 18 +- .../mdm/policy-csp-windowspowershell.md | 3 +- windows/client-management/mdm/reboot-csp.md | 44 +- .../client-management/mdm/reboot-ddf-file.md | 33 +- .../mdm/rootcacertificates-csp.md | 98 +- .../mdm/rootcacertificates-ddf-file.md | 7 +- windows/client-management/mdm/supl-csp.md | 8 +- .../client-management/mdm/supl-ddf-file.md | 8 +- 148 files changed, 7519 insertions(+), 1565 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index b3bbbac0bc..b34bc4709f 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -4,7 +4,7 @@ description: Learn more about the BitLocker CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -176,7 +176,7 @@ require reinstallation of Windows. > [!NOTE] > This policy takes effect only if "RequireDeviceEncryption" policy is set to 1. -The expected values for this policy are +The expected values for this policy are: 1 = This is the default, when the policy is not set. **Warning** prompt and encryption notification is allowed. 0 = Disables the warning prompt and encryption notification. Starting in Windows 10, next major update, @@ -317,11 +317,16 @@ Supported Values: 0 - Numeric Recovery Passwords rotation OFF. -This policy setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress. +This policy setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive. -- If you enable this policy setting you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10 (Version 1511). +- If you enable this policy setting, all removable data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access. -- If you disable or do not configure this policy setting, BitLocker will use AES with the same bit strength (128-bit or 256-bit) as the "Choose drive encryption method and cipher strength (Windows Vista, Windows Server 2008, Windows 7)" and "Choose drive encryption method and cipher strength" policy settings (in that order), if they are set. If none of the policies are set, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by the setup script." +If the "Deny write access to devices configured in another organization" option is selected, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the "Provide the unique identifiers for your organization" policy setting. + +- If you disable or do not configure this policy setting, all removable data drives on the computer will be mounted with read and write access. + +> [!NOTE] +> This policy setting can be overridden by the policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" policy setting is enabled this policy setting will be ignored. @@ -369,11 +374,12 @@ Sample value for this node to enable this policy and set the encryption methods | Name | Value | |:--|:--| -| Name | EncryptionMethodWithXts_Name | -| Friendly Name | Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later) | +| Name | RDVDenyWriteAccess_Name | +| Friendly Name | Deny write access to removable drives not protected by BitLocker | | Location | Computer Configuration | -| Path | Windows Components > BitLocker Drive Encryption | -| Registry Key Name | SOFTWARE\Policies\Microsoft\FVE | +| Path | Windows Components > BitLocker Drive Encryption > Removable Data Drives | +| Registry Key Name | System\CurrentControlSet\Policies\Microsoft\FVE | +| Registry Value Name | RDVDenyWriteAccess | | ADMX File Name | VolumeEncryption.admx | @@ -1578,10 +1584,10 @@ The Windows touch keyboard (such as that used by tablets) isn't available in the - If this policy is not enabled, the Windows Recovery Environment must be enabled on tablets to support the entry of the BitLocker recovery password. When the Windows Recovery Environment is not enabled and this policy is not enabled, you cannot turn on BitLocker on a device that uses the Windows touch keyboard. -**Note** that if you do not enable this policy setting, options in the "Require additional authentication at startup" policy might not be available on such devices. These options include -- Configure TPM startup PIN Required/Allowed -- Configure TPM startup key and PIN Required/Allowed -- Configure use of passwords for operating system drives. +**Note** that if you do not enable this policy setting, options in the "Require additional authentication at startup" policy might not be available on such devices. These options include: + - Configure TPM startup PIN: Required/Allowed + - Configure TPM startup key and PIN: Required/Allowed + - Configure use of passwords for operating system drives. diff --git a/windows/client-management/mdm/bitlocker-ddf-file.md b/windows/client-management/mdm/bitlocker-ddf-file.md index 081ef8b6f2..206cf3acd1 100644 --- a/windows/client-management/mdm/bitlocker-ddf-file.md +++ b/windows/client-management/mdm/bitlocker-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/22/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -149,7 +149,7 @@ The following XML file contains the device description framework (DDF) for the B If you disable or do not configure this policy setting, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by any setup script.” The format is string. Sample value for this node to enable this policy and set the encryption methods is: - + EncryptionMethodWithXtsOsDropDown_Name = Select the encryption method for operating system drives. EncryptionMethodWithXtsFdvDropDown_Name = Select the encryption method for fixed data drives. @@ -179,7 +179,7 @@ The following XML file contains the device description framework (DDF) for the B - + @@ -201,7 +201,7 @@ The following XML file contains the device description framework (DDF) for the B Note: If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard. The format is string. Sample value for this node to enable this policy is: - + ConfigureNonTPMStartupKeyUsage_Name = Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive) All of the below settings are for computers with a TPM. @@ -257,7 +257,7 @@ The following XML file contains the device description framework (DDF) for the B NOTE: If minimum PIN length is set below 6 digits, Windows will attempt to update the TPM 2.0 lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset. The format is string. Sample value for this node to enable this policy is: - + Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: @@ -298,7 +298,7 @@ The following XML file contains the device description framework (DDF) for the B Note: Not all characters and languages are supported in pre-boot. It is strongly recommended that you test that the characters you use for the custom message or URL appear correctly on the pre-boot recovery screen. The format is string. Sample value for this node to enable this policy is: - + The possible values for 'xx' are: 0 = Empty @@ -351,7 +351,7 @@ The following XML file contains the device description framework (DDF) for the B If this policy setting is disabled or not configured, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS. The format is string. Sample value for this node to enable this policy is: - + The possible values for 'xx' are: true = Explicitly allow @@ -409,7 +409,7 @@ The following XML file contains the device description framework (DDF) for the B If you enable this policy setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives. The format is string. Sample value for this node to enable this policy is: - + The possible values for 'xx' are: true = Explicitly allow @@ -461,7 +461,7 @@ The following XML file contains the device description framework (DDF) for the B If you disable or do not configure this policy setting, all fixed data drives on the computer will be mounted with read and write access. The format is string. Sample value for this node to enable this policy is: - + Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: @@ -502,7 +502,7 @@ The following XML file contains the device description framework (DDF) for the B Note: This policy setting can be overridden by the group policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" group policy setting is enabled this policy setting will be ignored. The format is string. Sample value for this node to enable this policy is: - + The possible values for 'xx' are: true = Explicitly allow @@ -582,11 +582,11 @@ The following XML file contains the device description framework (DDF) for the B require reinstallation of Windows. Note: This policy takes effect only if "RequireDeviceEncryption" policy is set to 1. The format is integer. - The expected values for this policy are: + The expected values for this policy are: 1 = This is the default, when the policy is not set. Warning prompt and encryption notification is allowed. - 0 = Disables the warning prompt and encryption notification. Starting in Windows 10, next major update, - the value 0 only takes affect on Azure Active Directory joined devices. + 0 = Disables the warning prompt and encryption notification. Starting in Windows 10, next major update, + the value 0 only takes affect on Azure Active Directory joined devices. Windows will attempt to silently enable BitLocker for value 0. If you want to disable this policy use the following SyncML: @@ -630,7 +630,7 @@ The following XML file contains the device description framework (DDF) for the B If "AllowWarningForOtherDiskEncryption" is not set, or is set to "1", "RequireDeviceEncryption" policy will not try to encrypt drive(s) if a standard user is the current logged on user in the system. - The expected values for this policy are: + The expected values for this policy are: 1 = "RequireDeviceEncryption" policy will try to enable encryption on all fixed drives even if a current logged in user is standard user. 0 = This is the default, when the policy is not set. If current logged on user is a standard user, "RequireDeviceEncryption" policy @@ -687,17 +687,17 @@ The following XML file contains the device description framework (DDF) for the B 0 Allows Admin to configure Numeric Recovery Password Rotation upon use for OS and fixed drives on AAD and Hybrid domain joined devices. - When not configured, Rotation is turned on by default for AAD only and off on Hybrid. The Policy will be effective only when + When not configured, Rotation is turned on by default for AAD only and off on Hybrid. The Policy will be effective only when Active Directory back up for recovery password is configured to required. For OS drive: Turn on "Do not enable Bitlocker until recovery information is stored to AD DS for operating system drives" For Fixed drives: Turn on "Do not enable Bitlocker until recovery information is stored to AD DS for fixed data drives" - + Supported Values: 0 - Numeric Recovery Passwords rotation OFF. 1 - Numeric Recovery Passwords Rotation upon use ON for AAD joined devices. Default value 2 - Numeric Recovery Passwords Rotation upon use ON for both AAD and Hybrid devices - + If you want to disable this policy use the following SyncML: - + 112./Device/Vendor/MSFT/BitLocker/ConfigureRecoveryPasswordRotationint0 @@ -739,20 +739,20 @@ The following XML file contains the device description framework (DDF) for the B Allows admin to push one-time rotation of all numeric recovery passwords for OS and Fixed Data drives on an Azure Active Directory or hybrid-joined device. This policy is Execute type and rotates all numeric passwords when issued from MDM tools. - + The policy only comes into effect when Active Directory backup for a recovery password is configured to "required." * For OS drives, enable "Do not enable BitLocker until recovery information is stored to Active Directory Domain Services for operating system drives." *For fixed drives, enable "Do not enable BitLocker until recovery information is stored to Active Directory Domain Services for fixed data drives." - - Client returns status DM_S_ACCEPTED_FOR_PROCESSING to indicate the rotation has started. Server can query status with the following status nodes: - -* status\RotateRecoveryPasswordsStatus + + Client returns status DM_S_ACCEPTED_FOR_PROCESSING to indicate the rotation has started. Server can query status with the following status nodes: + +* status\RotateRecoveryPasswordsStatus * status\RotateRecoveryPasswordsRequestID + - - + Supported Values: String form of request ID. Example format of request ID is GUID. Server can choose the format as needed according to the management tools.\ - + 113./Device/Vendor/MSFT/BitLocker/RotateRecoveryPasswordschr @@ -824,10 +824,10 @@ Supported Values: String form of request ID. Example format of request ID is GUI - This Node reports the status of RotateRecoveryPasswords request. + This Node reports the status of RotateRecoveryPasswords request. Status code can be one of the following: - NotStarted(2), Pending (1), Pass (0), Other error codes in case of failure - + NotStarted(2), Pending (1), Pass (0), Other error codes in case of failure + @@ -853,10 +853,10 @@ Supported Values: String form of request ID. Example format of request ID is GUI - This Node reports the RequestID corresponding to RotateRecoveryPasswordsStatus. + This Node reports the RequestID corresponding to RotateRecoveryPasswordsStatus. This node needs to be queried in synchronization with RotateRecoveryPasswordsStatus - To ensure the status is correctly matched to the request ID. - + To ensure the status is correctly matched to the request ID. + diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 40d679359a..fe160a4fe0 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -4,7 +4,7 @@ description: Learn more about the Defender CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -58,6 +58,7 @@ The following list shows the Defender configuration service provider nodes: - [EnableFileHashComputation](#configurationenablefilehashcomputation) - [EngineUpdatesChannel](#configurationengineupdateschannel) - [HideExclusionsFromLocalAdmins](#configurationhideexclusionsfromlocaladmins) + - [HideExclusionsFromLocalUsers](#configurationhideexclusionsfromlocalusers) - [IntelTDTEnabled](#configurationinteltdtenabled) - [MeteredConnectionUpdates](#configurationmeteredconnectionupdates) - [PassiveRemediation](#configurationpassiveremediation) @@ -65,6 +66,7 @@ The following list shows the Defender configuration service provider nodes: - [RandomizeScheduleTaskTimes](#configurationrandomizescheduletasktimes) - [ScanOnlyIfIdleEnabled](#configurationscanonlyifidleenabled) - [SchedulerRandomizationTime](#configurationschedulerrandomizationtime) + - [SecuredDevicesConfiguration](#configurationsecureddevicesconfiguration) - [SecurityIntelligenceUpdatesChannel](#configurationsecurityintelligenceupdateschannel) - [SupportLogLocation](#configurationsupportloglocation) - [TamperProtection](#configurationtamperprotection) @@ -1622,7 +1624,7 @@ Enable this policy to specify when devices receive Microsoft Defender engine upd -This policy setting controls whether or not exclusions are visible to local admins. For end users (that are not local admins) exclusions are not visible, whether or not this setting is enabled. +This policy setting controls whether or not exclusions are visible to local admins. To control local users exclusions visibility use HideExclusionsFromLocalUsers. If HideExclusionsFromLocalAdmins is set then HideExclusionsFromLocalUsers will be implicitly set. @@ -1656,6 +1658,55 @@ This policy setting controls whether or not exclusions are visible to local admi + +### Configuration/HideExclusionsFromLocalUsers + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/HideExclusionsFromLocalUsers +``` + + + + +This policy setting controls whether or not exclusions are visible to local users. If HideExclusionsFromLocalAdmins is set then this policy will be implicitly set. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | If you enable this setting, local users will no longer be able to see the exclusion list in Windows Security App or via PowerShell. | +| 0 (Default) | If you disable or do not configure this setting, local users will be able to see exclusions in the Windows Security App and via PowerShell. | + + + + + + + + ### Configuration/IntelTDTEnabled @@ -1696,6 +1747,7 @@ This policy setting configures the Intel TDT integration level for Intel TDT-cap | Value | Description | |:--|:--| | 0 (Default) | If you do not configure this setting, the default value will be applied. The default value is controlled by Microsoft security intelligence updates. Microsoft will enable Intel TDT if there is a known threat. | +| 1 | If you configure this setting to enabled, Intel TDT integration will turn on. | | 2 | If you configure this setting to disabled, Intel TDT integration will turn off. | @@ -1996,6 +2048,45 @@ This setting allows you to configure the scheduler randomization in hours. The r + +### Configuration/SecuredDevicesConfiguration + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/SecuredDevicesConfiguration +``` + + + + +Defines what are the devices primary ids that should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration is not set the default value will be applied, meaning all of the supported devices will be secured. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + ### Configuration/SecurityIntelligenceUpdatesChannel diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md index b540c17da8..4a653a572d 100644 --- a/windows/client-management/mdm/defender-ddf.md +++ b/windows/client-management/mdm/defender-ddf.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/17/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -1852,7 +1852,7 @@ The following XML file contains the device description framework (DDF) for the D 0 - This policy setting controls whether or not exclusions are visible to local admins. For end users (that are not local admins) exclusions are not visible, whether or not this setting is enabled. + This policy setting controls whether or not exclusions are visible to local admins. To control local users exlcusions visibility use HideExclusionsFromLocalUsers. If HideExclusionsFromLocalAdmins is set then HideExclusionsFromLocalUsers will be implicitly set. @@ -1881,6 +1881,45 @@ The following XML file contains the device description framework (DDF) for the D + + HideExclusionsFromLocalUsers + + + + + + + + 0 + This policy setting controls whether or not exclusions are visible to local users. If HideExclusionsFromLocalAdmins is set then this policy will be implicitly set. + + + + + + + + + + + + + + 10.0.17763 + 1.3 + + + + 1 + If you enable this setting, local users will no longer be able to see the exclusion list in Windows Security App or via PowerShell. + + + 0 + If you disable or do not configure this setting, local users will be able to see exclusions in the Windows Security App and via PowerShell. + + + + ThrottleForScheduledScanOnly @@ -2010,6 +2049,36 @@ The following XML file contains the device description framework (DDF) for the D + + SecuredDevicesConfiguration + + + + + + + + Defines what are the devices primary ids that should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration is not set the default value will be applied, meaning all of the supported devices will be secured. + + + + + + + + + + + + + + 10.0.17763 + 1.3 + + + + + DataDuplicationLocalRetentionPeriod @@ -2197,6 +2266,10 @@ The following XML file contains the device description framework (DDF) for the D 0 If you do not configure this setting, the default value will be applied. The default value is controlled by Microsoft security intelligence updates. Microsoft will enable Intel TDT if there is a known threat. + + 1 + If you configure this setting to enabled, Intel TDT integration will turn on. + 2 If you configure this setting to disabled, Intel TDT integration will turn off. diff --git a/windows/client-management/mdm/devicepreparation-csp.md b/windows/client-management/mdm/devicepreparation-csp.md index 35028e068e..e32d2c6c9a 100644 --- a/windows/client-management/mdm/devicepreparation-csp.md +++ b/windows/client-management/mdm/devicepreparation-csp.md @@ -4,7 +4,7 @@ description: Learn more about the DevicePreparation CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -31,6 +31,8 @@ The following list shows the DevicePreparation configuration service provider no - [ClassID](#bootstrapperagentclassid) - [ExecutionContext](#bootstrapperagentexecutioncontext) - [InstallationStatusUri](#bootstrapperagentinstallationstatusuri) + - [MDMProvider](#mdmprovider) + - [Progress](#mdmproviderprogress) - [PageEnabled](#pageenabled) - [PageSettings](#pagesettings) - [PageStatus](#pagestatus) @@ -192,6 +194,84 @@ This node holds a URI that can be queried for the status of the Bootstrapper Age + +## MDMProvider + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/DevicePreparation/MDMProvider +``` + + + + +The subnode configures the settings for the MDMProvider. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +### MDMProvider/Progress + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/DevicePreparation/MDMProvider/Progress +``` + + + + +Noode for reporting progress status as opaque data. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Get, Replace | + + + + + + + + ## PageEnabled @@ -297,7 +377,7 @@ This node configures specific settings for the Device Preparation page. -This node provides status of the Device Preparation page. Values are an enum: 0 = Disabled; 1 = Enabled; 2 = InProgress; 3 = Succeeded; 4 = Failed. +This node provides status of the Device Preparation page. Values are an enum: 0 = Disabled; 1 = Enabled; 2 = InProgress; 3 = ExitedOnSuccess; 4 = ExitedOnFailure. diff --git a/windows/client-management/mdm/devicepreparation-ddf-file.md b/windows/client-management/mdm/devicepreparation-ddf-file.md index e10e6a1a49..c2a8a4aa4e 100644 --- a/windows/client-management/mdm/devicepreparation-ddf-file.md +++ b/windows/client-management/mdm/devicepreparation-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/17/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -89,7 +89,7 @@ The following XML file contains the device description framework (DDF) for the D - This node provides status of the Device Preparation page. Values are an enum: 0 = Disabled; 1 = Enabled; 2 = InProgress; 3 = Succeeded; 4 = Failed. + This node provides status of the Device Preparation page. Values are an enum: 0 = Disabled; 1 = Enabled; 2 = InProgress; 3 = ExitedOnSuccess; 4 = ExitedOnFailure. @@ -243,6 +243,49 @@ The following XML file contains the device description framework (DDF) for the D + + MDMProvider + + + + + The subnode configures the settings for the MDMProvider. + + + + + + + + + + + + + + + Progress + + + + + + Noode for reporting progress status as opaque data. + + + + + + + + + + + + + + + ``` diff --git a/windows/client-management/mdm/firewall-csp.md b/windows/client-management/mdm/firewall-csp.md index e0917186af..c5b31e1372 100644 --- a/windows/client-management/mdm/firewall-csp.md +++ b/windows/client-management/mdm/firewall-csp.md @@ -4,7 +4,7 @@ description: Learn more about the Firewall CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -104,19 +104,41 @@ The following list shows the Firewall configuration service provider nodes: - [Enabled](#mdmstorehypervfirewallrulesfirewallrulenameenabled) - [LocalAddressRanges](#mdmstorehypervfirewallrulesfirewallrulenamelocaladdressranges) - [LocalPortRanges](#mdmstorehypervfirewallrulesfirewallrulenamelocalportranges) - - [Name](#mdmstorehypervfirewallrulesfirewallrulenamename) - [Priority](#mdmstorehypervfirewallrulesfirewallrulenamepriority) + - [Profiles](#mdmstorehypervfirewallrulesfirewallrulenameprofiles) - [Protocol](#mdmstorehypervfirewallrulesfirewallrulenameprotocol) - [RemoteAddressRanges](#mdmstorehypervfirewallrulesfirewallrulenameremoteaddressranges) - [RemotePortRanges](#mdmstorehypervfirewallrulesfirewallrulenameremoteportranges) - [Status](#mdmstorehypervfirewallrulesfirewallrulenamestatus) - [VMCreatorId](#mdmstorehypervfirewallrulesfirewallrulenamevmcreatorid) + - [HyperVLoopbackRules](#mdmstorehypervloopbackrules) + - [{RuleName}](#mdmstorehypervloopbackrulesrulename) + - [DestinationVMCreatorId](#mdmstorehypervloopbackrulesrulenamedestinationvmcreatorid) + - [Enabled](#mdmstorehypervloopbackrulesrulenameenabled) + - [PortRanges](#mdmstorehypervloopbackrulesrulenameportranges) + - [SourceVMCreatorId](#mdmstorehypervloopbackrulesrulenamesourcevmcreatorid) - [HyperVVMSettings](#mdmstorehypervvmsettings) - [{VMCreatorId}](#mdmstorehypervvmsettingsvmcreatorid) + - [AllowHostPolicyMerge](#mdmstorehypervvmsettingsvmcreatoridallowhostpolicymerge) - [DefaultInboundAction](#mdmstorehypervvmsettingsvmcreatoriddefaultinboundaction) - [DefaultOutboundAction](#mdmstorehypervvmsettingsvmcreatoriddefaultoutboundaction) + - [DomainProfile](#mdmstorehypervvmsettingsvmcreatoriddomainprofile) + - [AllowLocalPolicyMerge](#mdmstorehypervvmsettingsvmcreatoriddomainprofileallowlocalpolicymerge) + - [DefaultInboundAction](#mdmstorehypervvmsettingsvmcreatoriddomainprofiledefaultinboundaction) + - [DefaultOutboundAction](#mdmstorehypervvmsettingsvmcreatoriddomainprofiledefaultoutboundaction) + - [EnableFirewall](#mdmstorehypervvmsettingsvmcreatoriddomainprofileenablefirewall) - [EnableFirewall](#mdmstorehypervvmsettingsvmcreatoridenablefirewall) - [EnableLoopback](#mdmstorehypervvmsettingsvmcreatoridenableloopback) + - [PrivateProfile](#mdmstorehypervvmsettingsvmcreatoridprivateprofile) + - [AllowLocalPolicyMerge](#mdmstorehypervvmsettingsvmcreatoridprivateprofileallowlocalpolicymerge) + - [DefaultInboundAction](#mdmstorehypervvmsettingsvmcreatoridprivateprofiledefaultinboundaction) + - [DefaultOutboundAction](#mdmstorehypervvmsettingsvmcreatoridprivateprofiledefaultoutboundaction) + - [EnableFirewall](#mdmstorehypervvmsettingsvmcreatoridprivateprofileenablefirewall) + - [PublicProfile](#mdmstorehypervvmsettingsvmcreatoridpublicprofile) + - [AllowLocalPolicyMerge](#mdmstorehypervvmsettingsvmcreatoridpublicprofileallowlocalpolicymerge) + - [DefaultInboundAction](#mdmstorehypervvmsettingsvmcreatoridpublicprofiledefaultinboundaction) + - [DefaultOutboundAction](#mdmstorehypervvmsettingsvmcreatoridpublicprofiledefaultoutboundaction) + - [EnableFirewall](#mdmstorehypervvmsettingsvmcreatoridpublicprofileenablefirewall) - [PrivateProfile](#mdmstoreprivateprofile) - [AllowLocalIpsecPolicyMerge](#mdmstoreprivateprofileallowlocalipsecpolicymerge) - [AllowLocalPolicyMerge](#mdmstoreprivateprofileallowlocalpolicymerge) @@ -1093,7 +1115,7 @@ This value is used as an on/off switch. If this value is on and EnableFirewall i | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later
:heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -1131,7 +1153,7 @@ This value is used as an on/off switch. If this value is on and EnableFirewall i | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later
:heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -1170,7 +1192,7 @@ A list of dynamic keyword addresses for use within firewall rules. Dynamic keywo | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later
:heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -1212,7 +1234,7 @@ A unique GUID string identifier for this dynamic keyword address. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later
:heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -1258,7 +1280,7 @@ An IPv6 address range in the format of "start address - end address" with no spa | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later
:heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -1307,7 +1329,7 @@ If this flag is set to TRUE, then the 'keyword' field of this object is expected | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later
:heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -2078,7 +2100,7 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the |:--|:--| | Format | chr (string) | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: `,`) | +| Allowed Values | Regular Expression: `^[0-9,-]+$` | @@ -2303,7 +2325,7 @@ Specifies the profiles to which the rule belongs: Domain, Private, Public. See [ | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later
:heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -2422,7 +2444,7 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the |:--|:--| | Format | chr (string) | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: `,`) | +| Allowed Values | Regular Expression: `^[0-9,-]+$` | @@ -3354,7 +3376,7 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the |:--|:--| | Format | chr (string) | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: `,`) | +| Allowed Values | Regular Expression: `^[0-9,-]+$` | @@ -3363,44 +3385,6 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the - -##### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Name - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | - - - -```Device -./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules/{FirewallRuleName}/Name -``` - - - - - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | chr (string) | -| Access Type | Add, Delete, Get, Replace | - - - - - - - - ##### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Priority @@ -3441,6 +3425,56 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the + +##### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Profiles + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules/{FirewallRuleName}/Profiles +``` + + + + +Specifies the profiles to which the rule belongs: Domain, Private, Public. See [FW_PROFILE_TYPE](/openspecs/windows_protocols/ms-fasp/7704e238-174d-4a5e-b809-5f3787dd8acc) for the bitmasks that are used to identify profile types. If not specified, the default is All. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get, Replace | + + + +**Allowed values**: + +| Flag | Description | +|:--|:--| +| 0x1 | FW_PROFILE_TYPE_DOMAIN: This value represents the profile for networks that are connected to domains. | +| 0x2 | FW_PROFILE_TYPE_STANDARD: This value represents the standard profile for networks. These networks are classified as private by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are behind Network Address Translation (NAT) devices, routers, and other edge devices, and they are in a private location, such as a home or an office. AND FW_PROFILE_TYPE_PRIVATE: This value represents the profile for private networks, which is represented by the same value as that used for FW_PROFILE_TYPE_STANDARD. | +| 0x4 | FW_PROFILE_TYPE_PUBLIC: This value represents the profile for public networks. These networks are classified as public by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are those at airports, coffee shops, and other public places where the peers in the network or the network administrator are not trusted. | +| 0x7FFFFFFF | FW_PROFILE_TYPE_ALL: This value represents all these network sets and any future network sets. | + + + + + + + + ##### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Protocol @@ -3557,7 +3591,7 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the |:--|:--| | Format | chr (string) | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: `,`) | +| Allowed Values | Regular Expression: `^[0-9,-]+$` | @@ -3645,6 +3679,255 @@ This field specifies the VM Creator ID that this rule is applicable to. A NULL G + +### MdmStore/HyperVLoopbackRules + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules +``` + + + + +A list of rules controlling loopback traffic through the Windows Firewall. This enforcement is only for traffic from one container to another or to the host device. These rules are all allow rules. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +#### MdmStore/HyperVLoopbackRules/{RuleName} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName} +``` + + + + +Unique alpha numeric identifier for the rule. The rule name must not include a forward slash (/). + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get, Replace | +| Atomic Required | True | +| Dynamic Node Naming | ServerGeneratedUniqueIdentifier | +| Allowed Values | Regular Expression: `^[^|/]*$` | + + + + + + + + + +##### MdmStore/HyperVLoopbackRules/{RuleName}/DestinationVMCreatorId + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/DestinationVMCreatorId +``` + + + + +This field specifies the VM Creator ID of the destination of traffic that this rule applies to. If not specified, this applies to All. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Regular Expression: `\{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\}` | + + + + + + + + + +##### MdmStore/HyperVLoopbackRules/{RuleName}/Enabled + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/Enabled +``` + + + + +Indicates whether the rule is enabled or disabled. If the rule must be enabled, this value must be set to true. If not specified - a new rule is disabled by default. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disabled. | +| 1 | Enabled. | + + + + + + + + + +##### MdmStore/HyperVLoopbackRules/{RuleName}/PortRanges + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/PortRanges +``` + + + + +Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the default is All. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Regular Expression: `^[0-9,-]+$` | + + + + + + + + + +##### MdmStore/HyperVLoopbackRules/{RuleName}/SourceVMCreatorId + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/SourceVMCreatorId +``` + + + + +This field specifies the VM Creator ID of the source of the traffic that this rule applies to. If not specified, this applies to All. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Regular Expression: `\{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\}` | + + + + + + + + ### MdmStore/HyperVVMSettings @@ -3726,6 +4009,55 @@ VM Creator ID that these settings apply to. Valid format is a GUID. + +##### MdmStore/HyperVVMSettings/{VMCreatorId}/AllowHostPolicyMerge + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/AllowHostPolicyMerge +``` + + + + +This value is used as an on/off switch. If this value is true, applicable host firewall rules and settings will be applied to Hyper-V firewall. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Get, Replace | +| Default Value | true | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false | AllowHostPolicyMerge Off. | +| true (Default) | AllowHostPolicyMerge On. | + + + + + + + + ##### MdmStore/HyperVVMSettings/{VMCreatorId}/DefaultInboundAction @@ -3743,7 +4075,7 @@ VM Creator ID that these settings apply to. Valid format is a GUID. -This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. +This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree. @@ -3793,7 +4125,7 @@ This value is the action that the firewall does by default (and evaluates at the -This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. +This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree. @@ -3826,6 +4158,243 @@ This value is the action that the firewall does by default (and evaluates at the + +##### MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/AllowLocalPolicyMerge + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/AllowLocalPolicyMerge +``` + + + + +This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Replace | +| Default Value | true | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false | AllowLocalPolicyMerge Off. | +| true (Default) | AllowLocalPolicyMerge On. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/DefaultInboundAction + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/DefaultInboundAction +``` + + + + +This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get, Replace | +| Default Value | 1 | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Allow Inbound By Default. | +| 1 (Default) | Block Inbound By Default. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/DefaultOutboundAction + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/DefaultOutboundAction +``` + + + + +This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get, Replace | +| Default Value | 0 | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Allow Outbound By Default. | +| 1 | Block Outbound By Default. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/EnableFirewall + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/EnableFirewall +``` + + + + +This value is an on/off switch for the firewall and advanced security enforcement. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Replace | +| Default Value | true | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false | Disable Firewall. | +| true (Default) | Enable Firewall. | + + + + + + + + ##### MdmStore/HyperVVMSettings/{VMCreatorId}/EnableFirewall @@ -3843,7 +4412,7 @@ This value is the action that the firewall does by default (and evaluates at the -This value is an on/off switch for the firewall and advanced security enforcement. +This value is an on/off switch for the firewall and advanced security enforcement. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree. @@ -3892,7 +4461,7 @@ This value is an on/off switch for the firewall and advanced security enforcemen -This value is an on/off switch for loopback traffic. This determines if this VM type is able to send/receive loopback traffic. +This value is an on/off switch for loopback traffic. This determines if this VM is able to send/receive loopback traffic to other VMs or the host. @@ -3924,6 +4493,480 @@ This value is an on/off switch for loopback traffic. This determines if this VM + +##### MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/AllowLocalPolicyMerge + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/AllowLocalPolicyMerge +``` + + + + +This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Replace | +| Default Value | true | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false | AllowLocalPolicyMerge Off. | +| true (Default) | AllowLocalPolicyMerge On. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/DefaultInboundAction + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/DefaultInboundAction +``` + + + + +This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get, Replace | +| Default Value | 1 | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Allow Inbound By Default. | +| 1 (Default) | Block Inbound By Default. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/DefaultOutboundAction + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/DefaultOutboundAction +``` + + + + +This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get, Replace | +| Default Value | 0 | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Allow Outbound By Default. | +| 1 | Block Outbound By Default. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/EnableFirewall + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/EnableFirewall +``` + + + + +This value is an on/off switch for the firewall and advanced security enforcement. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Replace | +| Default Value | true | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false | Disable Firewall. | +| true (Default) | Enable Firewall. | + + + + + + + + + +##### MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/AllowLocalPolicyMerge + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/AllowLocalPolicyMerge +``` + + + + +This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Replace | +| Default Value | true | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false | AllowLocalPolicyMerge Off. | +| true (Default) | AllowLocalPolicyMerge On. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/DefaultInboundAction + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/DefaultInboundAction +``` + + + + +This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get, Replace | +| Default Value | 1 | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Allow Inbound By Default. | +| 1 (Default) | Block Inbound By Default. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/DefaultOutboundAction + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/DefaultOutboundAction +``` + + + + +This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get, Replace | +| Default Value | 0 | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Allow Outbound By Default. | +| 1 | Block Outbound By Default. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/EnableFirewall + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/EnableFirewall +``` + + + + +This value is an on/off switch for the firewall and advanced security enforcement. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Replace | +| Default Value | true | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false | Disable Firewall. | +| true (Default) | Enable Firewall. | + + + + + + + + ### MdmStore/PrivateProfile diff --git a/windows/client-management/mdm/firewall-ddf-file.md b/windows/client-management/mdm/firewall-ddf-file.md index a55d7cb441..4eb6ee5f96 100644 --- a/windows/client-management/mdm/firewall-ddf-file.md +++ b/windows/client-management/mdm/firewall-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/27/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -2855,7 +2855,7 @@ The following XML file contains the device description framework (DDF) for the F true - This value is an on/off switch for the firewall and advanced security enforcement. + This value is an on/off switch for the firewall and advanced security enforcement. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree. @@ -2888,7 +2888,7 @@ The following XML file contains the device description framework (DDF) for the F 0 - This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. + This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree. @@ -2934,7 +2934,7 @@ The following XML file contains the device description framework (DDF) for the F 1 - This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. + This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree. @@ -2979,7 +2979,7 @@ The following XML file contains the device description framework (DDF) for the F false - This value is an on/off switch for loopback traffic. This determines if this VM type is able to send/receive loopback traffic. + This value is an on/off switch for loopback traffic. This determines if this VM is able to send/receive loopback traffic to other VMs or the host. @@ -3004,6 +3004,606 @@ The following XML file contains the device description framework (DDF) for the F + + AllowHostPolicyMerge + + + + + + true + This value is used as an on/off switch. If this value is true, applicable host firewall rules and settings will be applied to Hyper-V firewall. + + + + + + + + + + + + + + + false + AllowHostPolicyMerge Off + + + true + AllowHostPolicyMerge On + + + + + + DomainProfile + + + + + + + + + + + + + + + + + + + EnableFirewall + + + + + true + This value is an on/off switch for the firewall and advanced security enforcement. + + + + + + + + + + + + + + + false + Disable Firewall + + + true + Enable Firewall + + + + + + DefaultOutboundAction + + + + + + 0 + This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. + + + + + + + + + + + + + + + 0 + Allow Outbound By Default + + + 1 + Block Outbound By Default + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + DefaultInboundAction + + + + + + 1 + This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. + + + + + + + + + + + + + + + 0 + Allow Inbound By Default + + + 1 + Block Inbound By Default + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + AllowLocalPolicyMerge + + + + + true + This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions. + + + + + + + + + + + + + + + false + AllowLocalPolicyMerge Off + + + true + AllowLocalPolicyMerge On + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + + PrivateProfile + + + + + + + + + + + + + + + + + + + EnableFirewall + + + + + true + This value is an on/off switch for the firewall and advanced security enforcement. + + + + + + + + + + + + + + + false + Disable Firewall + + + true + Enable Firewall + + + + + + DefaultOutboundAction + + + + + + 0 + This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. + + + + + + + + + + + + + + + 0 + Allow Outbound By Default + + + 1 + Block Outbound By Default + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + DefaultInboundAction + + + + + + 1 + This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. + + + + + + + + + + + + + + + 0 + Allow Inbound By Default + + + 1 + Block Inbound By Default + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + AllowLocalPolicyMerge + + + + + true + This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions. + + + + + + + + + + + + + + + false + AllowLocalPolicyMerge Off + + + true + AllowLocalPolicyMerge On + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + + PublicProfile + + + + + + + + + + + + + + + + + + + EnableFirewall + + + + + true + This value is an on/off switch for the firewall and advanced security enforcement. + + + + + + + + + + + + + + + false + Disable Firewall + + + true + Enable Firewall + + + + + + DefaultOutboundAction + + + + + + 0 + This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. + + + + + + + + + + + + + + + 0 + Allow Outbound By Default + + + 1 + Block Outbound By Default + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + DefaultInboundAction + + + + + + 1 + This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. + + + + + + + + + + + + + + + 0 + Allow Inbound By Default + + + 1 + Block Inbound By Default + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + AllowLocalPolicyMerge + + + + + true + This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions. + + + + + + + + + + + + + + + false + AllowLocalPolicyMerge Off + + + true + AllowLocalPolicyMerge On + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + @@ -3231,7 +3831,8 @@ ServiceName - + + ^[0-9,-]+$ @@ -3258,7 +3859,8 @@ ServiceName - + + ^[0-9,-]+$ @@ -3396,7 +3998,7 @@ An IPv6 address range in the format of "start address - end address" with no spa - 99.9.99999 + 10.0.22000, 10.0.19044.1706, 10.0.19043.1706, 10.0.19042.1706 1.0 @@ -4022,7 +4624,8 @@ An IPv6 address range in the format of "start address - end address" with no spa - + + ^[0-9,-]+$ @@ -4081,7 +4684,8 @@ An IPv6 address range in the format of "start address - end address" with no spa - + + ^[0-9,-]+$ @@ -4197,16 +4801,15 @@ If not specified - a new rule is disabled by default. - Name + Profiles - - + Specifies the profiles to which the rule belongs: Domain, Private, Public. See FW_PROFILE_TYPE for the bitmasks that are used to identify profile types. If not specified, the default is All. - + @@ -4217,6 +4820,192 @@ If not specified - a new rule is disabled by default. + + + 0x1 + FW_PROFILE_TYPE_DOMAIN: This value represents the profile for networks that are connected to domains. + + + 0x2 + FW_PROFILE_TYPE_STANDARD: This value represents the standard profile for networks. These networks are classified as private by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are behind Network Address Translation (NAT) devices, routers, and other edge devices, and they are in a private location, such as a home or an office. AND FW_PROFILE_TYPE_PRIVATE: This value represents the profile for private networks, which is represented by the same value as that used for FW_PROFILE_TYPE_STANDARD. + + + 0x4 + FW_PROFILE_TYPE_PUBLIC: This value represents the profile for public networks. These networks are classified as public by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are those at airports, coffee shops, and other public places where the peers in the network or the network administrator are not trusted. + + + 0x7FFFFFFF + FW_PROFILE_TYPE_ALL: This value represents all these network sets and any future network sets. + + + + + + + + HyperVLoopbackRules + + + + + A list of rules controlling loopback traffic through the Windows Firewall. This enforcement is only for traffic from one container to another or to the host device. These rules are all allow rules. + + + + + + + + + + + + + + + + + + + + + + + + Unique alpha numeric identifier for the rule. The rule name must not include a forward slash (/). + + + + + + + + + + RuleName + + + + + + + + ^[^|/]*$ + + + + + SourceVMCreatorId + + + + + + + + This field specifies the VM Creator ID of the source of the traffic that this rule applies to. If not specified, this applies to All. + + + + + + + + + + + + + + \{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\} + + + + + DestinationVMCreatorId + + + + + + + + This field specifies the VM Creator ID of the destination of traffic that this rule applies to. If not specified, this applies to All. + + + + + + + + + + + + + + \{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\} + + + + + PortRanges + + + + + + + + Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the default is All. + + + + + + + + + + + + + + ^[0-9,-]+$ + + + + + + Enabled + + + + + + Indicates whether the rule is enabled or disabled. If the rule must be enabled, this value must be set to true. If not specified - a new rule is disabled by default. + + + + + + + + + + + + + + + 0 + Disabled + + + 1 + Enabled + + @@ -4240,7 +5029,7 @@ If not specified - a new rule is disabled by default. - 99.9.99999 + 10.0.22000, 10.0.19044.1706, 10.0.19043.1706, 10.0.19042.1706 1.0 diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index 34cd8ae204..a937496bd1 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -4,7 +4,7 @@ description: Learn more about the PassportForWork CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,9 @@ ms.topic: reference # PassportForWork CSP +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + The PassportForWork configuration service provider is used to provision Windows Hello for Business (formerly Microsoft Passport for Work). It allows you to log in to Windows using your Active Directory or Azure Active Directory account and replace passwords, smartcards, and virtual smart cards. @@ -30,6 +33,7 @@ The following list shows the PassportForWork configuration service provider node - ./Device/Vendor/MSFT/PassportForWork - [{TenantId}](#devicetenantid) - [Policies](#devicetenantidpolicies) + - [DisablePostLogonProvisioning](#devicetenantidpoliciesdisablepostlogonprovisioning) - [EnablePinRecovery](#devicetenantidpoliciesenablepinrecovery) - [ExcludeSecurityDevices](#devicetenantidpoliciesexcludesecuritydevices) - [TPM12](#devicetenantidpoliciesexcludesecuritydevicestpm12) @@ -160,6 +164,55 @@ Root node for policies. + +#### Device/{TenantId}/Policies/DisablePostLogonProvisioning + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/PassportForWork/{TenantId}/Policies/DisablePostLogonProvisioning +``` + + + + +Do not start Windows Hello provisioning after sign-in. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Add, Delete, Get, Replace | +| Default Value | False | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false (Default) | Disabled. | +| true | Enabled. | + + + + + + + + #### Device/{TenantId}/Policies/EnablePinRecovery @@ -1187,8 +1240,8 @@ Enhanced Sign-in Security (ESS) isolates both biometric template data and matchi | Value | Description | |:--|:--| -| 0 | Enhanced sign-in security will be disabled on all systems. If a user already has a secure Windows Hello enrollment, they will lose their enrollment and must reset PIN, and they will have the option to re-enroll in normal face and fingerprint. Peripheral usage will be enabled by disabling Enhanced sign-in security. OS will not attempt to start secure components, even if the secure hardware and software components are present. (not recommended). | -| 1 (Default) | Enhanced sign-in security will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. For systems with one secure modality (face or fingerprint) and one insecure modality (fingerprint or face), only the secure sensor can be used for sign-in and the insecure sensor(s) will be blocked. This includes peripheral devices, which are unsupported and will be unusable. (default and recommended for highest security). | +| 0 | ESS will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of peripheral Windows Hello capable devices will be allowed, subject to current feature limitations. In addition, with this setting, ESS will be enabled on devices with a mixture of biometric devices, such as an ESS capable FPR and a non-ESS capable camera. (not recommended). | +| 1 (Default) | ESS will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of any peripheral biometric device will be blocked and not available for Windows Hello. (default and recommended for highest security). | diff --git a/windows/client-management/mdm/passportforwork-ddf.md b/windows/client-management/mdm/passportforwork-ddf.md index 89dbc41c22..28991ea21c 100644 --- a/windows/client-management/mdm/passportforwork-ddf.md +++ b/windows/client-management/mdm/passportforwork-ddf.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/24/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -814,6 +814,45 @@ If you disable or do not configure this policy setting, the PIN recovery secret + + DisablePostLogonProvisioning + + + + + + + + False + Do not start Windows Hello provisioning after sign-in. + + + + + + + + + + + + + + 99.9.99999 + 1.6 + + + + false + Disabled + + + true + Enabled + + + + UseCertificateForOnPremAuth @@ -1507,11 +1546,11 @@ Note that enhanced anti-spoofing for Windows Hello face authentication is not re 0 - Enhanced sign-in security will be disabled on all systems. If a user already has a secure Windows Hello enrollment, they will lose their enrollment and must reset PIN, and they will have the option to re-enroll in normal face and fingerprint. Peripheral usage will be enabled by disabling Enhanced sign-in security. OS will not attempt to start secure components, even if the secure hardware and software components are present. (not recommended) + ESS will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of peripheral Windows Hello capable devices will be allowed, subject to current feature limitations. In addition, with this setting, ESS will be enabled on devices with a mixture of biometric devices, such as an ESS capable FPR and a non-ESS capable camera. (not recommended) 1 - Enhanced sign-in security will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. For systems with one secure modality (face or fingerprint) and one insecure modality (fingerprint or face), only the secure sensor can be used for sign-in and the insecure sensor(s) will be blocked. This includes peripheral devices, which are unsupported and will be unusable. (default and recommended for highest security) + ESS will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of any peripheral biometric device will be blocked and not available for Windows Hello. (default and recommended for highest security) diff --git a/windows/client-management/mdm/personaldataencryption-csp.md b/windows/client-management/mdm/personaldataencryption-csp.md index b7227416df..af0cf9f34d 100644 --- a/windows/client-management/mdm/personaldataencryption-csp.md +++ b/windows/client-management/mdm/personaldataencryption-csp.md @@ -4,7 +4,7 @@ description: Learn more about the PDE CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -26,7 +26,13 @@ The following list shows the PDE configuration service provider nodes: - ./User/Vendor/MSFT/PDE - [EnablePersonalDataEncryption](#enablepersonaldataencryption) + - [ProtectFolders](#protectfolders) + - [ProtectDesktop](#protectfoldersprotectdesktop) + - [ProtectDocuments](#protectfoldersprotectdocuments) + - [ProtectPictures](#protectfoldersprotectpictures) - [Status](#status) + - [FolderProtectionStatus](#statusfolderprotectionstatus) + - [FoldersProtected](#statusfoldersprotected) - [PersonalDataEncryptionStatus](#statuspersonaldataencryptionstatus) @@ -79,6 +85,188 @@ The [UserDataProtectionManager Class](/uwp/api/windows.security.dataprotection.u + +## ProtectFolders + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```User +./User/Vendor/MSFT/PDE/ProtectFolders +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +### ProtectFolders/ProtectDesktop + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```User +./User/Vendor/MSFT/PDE/ProtectFolders/ProtectDesktop +``` + + + + +Allows the Admin to enable PDE on Desktop folder. Set to '1' to set this policy. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. | +| 1 | Enable PDE on the folder. | + + + + + + + + + +### ProtectFolders/ProtectDocuments + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```User +./User/Vendor/MSFT/PDE/ProtectFolders/ProtectDocuments +``` + + + + +Allows the Admin to enable PDE on Documents folder. Set to '1' to set this policy. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. | +| 1 | Enable PDE on the folder. | + + + + + + + + + +### ProtectFolders/ProtectPictures + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```User +./User/Vendor/MSFT/PDE/ProtectFolders/ProtectPictures +``` + + + + +Allows the Admin to enable PDE on Pictures folder. Set to '1' to set this policy. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. | +| 1 | Enable PDE on the folder. | + + + + + + + + ## Status @@ -121,6 +309,95 @@ Reports the current status of Personal Data Encryption (PDE) for the user. + +### Status/FolderProtectionStatus + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```User +./User/Vendor/MSFT/PDE/Status/FolderProtectionStatus +``` + + + + +This node reports folder protection status for a user. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Protection not started. | +| 1 | Protection is completed with no failures. | +| 2 | Protection in progress. | +| 3 | Protection failed. | + + + + + + + + + +### Status/FoldersProtected + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```User +./User/Vendor/MSFT/PDE/Status/FoldersProtected +``` + + + + +This node reports all folders (full path to each folder) that have been protected. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Get | + + + + + + + + ### Status/PersonalDataEncryptionStatus diff --git a/windows/client-management/mdm/personaldataencryption-ddf-file.md b/windows/client-management/mdm/personaldataencryption-ddf-file.md index 9550cce774..b5425cab46 100644 --- a/windows/client-management/mdm/personaldataencryption-ddf-file.md +++ b/windows/client-management/mdm/personaldataencryption-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/17/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -83,6 +83,128 @@ The following XML file contains the device description framework (DDF) for the P + + ProtectFolders + + + + + + + + + + + + + + + + + + + ProtectDocuments + + + + + + + + Allows the Admin to enable PDE on Documents folder. Set to '1' to set this policy. + + + + + + + + + + + + + + + 0 + Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. + + + 1 + Enable PDE on the folder. + + + + + + ProtectDesktop + + + + + + + + Allows the Admin to enable PDE on Desktop folder. Set to '1' to set this policy. + + + + + + + + + + + + + + + 0 + Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. + + + 1 + Enable PDE on the folder. + + + + + + ProtectPictures + + + + + + + + Allows the Admin to enable PDE on Pictures folder. Set to '1' to set this policy. + + + + + + + + + + + + + + + 0 + Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. + + + 1 + Enable PDE on the folder. + + + + + Status @@ -123,6 +245,66 @@ The following XML file contains the device description framework (DDF) for the P + + FolderProtectionStatus + + + + + This node reports folder protection status for a user. + + + + + + + + + + + + + + + 0 + Protection not started. + + + 1 + Protection is completed with no failures. + + + 2 + Protection in progress. + + + 3 + Protection failed. + + + + + + FoldersProtected + + + + + This node reports all folders (full path to each folder) that have been protected. + + + + + + + + + + + + + + diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index c45d67308a..08332c2601 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -4,7 +4,7 @@ description: Learn about the ADMX-backed policies in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/18/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -2303,7 +2303,9 @@ This article lists the ADMX-backed policies in Policy CSP. - [EnableSettings](policy-csp-desktopappinstaller.md) - [EnableExperimentalFeatures](policy-csp-desktopappinstaller.md) - [EnableLocalManifestFiles](policy-csp-desktopappinstaller.md) +- [EnableBypassCertificatePinningForMicrosoftStore](policy-csp-desktopappinstaller.md) - [EnableHashOverride](policy-csp-desktopappinstaller.md) +- [EnableLocalArchiveMalwareScanOverride](policy-csp-desktopappinstaller.md) - [EnableDefaultSource](policy-csp-desktopappinstaller.md) - [EnableMicrosoftStoreSource](policy-csp-desktopappinstaller.md) - [SourceAutoUpdateInterval](policy-csp-desktopappinstaller.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md index 2b636d3e4f..6aba70d787 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Group Policy. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/03/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -340,6 +340,10 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [ClearTextPassword](policy-csp-devicelock.md) - [PasswordComplexity](policy-csp-devicelock.md) - [PasswordHistorySize](policy-csp-devicelock.md) +- [AccountLockoutThreshold](policy-csp-devicelock.md) +- [AccountLockoutDuration](policy-csp-devicelock.md) +- [ResetAccountLockoutCounterAfter](policy-csp-devicelock.md) +- [AllowAdministratorLockout](policy-csp-devicelock.md) ## Display @@ -400,6 +404,10 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [ForceInstantLock](policy-csp-humanpresence.md) - [ForceLockTimeout](policy-csp-humanpresence.md) - [ForceInstantDim](policy-csp-humanpresence.md) +- [ForceDisableWakeWhenBatterySaverOn](policy-csp-humanpresence.md) +- [ForceAllowWakeWhenExternalDisplayConnected](policy-csp-humanpresence.md) +- [ForceAllowLockWhenExternalDisplayConnected](policy-csp-humanpresence.md) +- [ForceAllowDimWhenExternalDisplayConnected](policy-csp-humanpresence.md) ## Kerberos @@ -511,6 +519,7 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [DisallowNotificationMirroring](policy-csp-notifications.md) - [DisallowTileNotification](policy-csp-notifications.md) +- [EnableExpandedToastNotifications](policy-csp-notifications.md) - [DisallowCloudNotification](policy-csp-notifications.md) - [WnsEndpoint](policy-csp-notifications.md) @@ -574,6 +583,10 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [LetAppsAccessGraphicsCaptureWithoutBorder_ForceAllowTheseApps](policy-csp-privacy.md) - [LetAppsAccessGraphicsCaptureWithoutBorder_ForceDenyTheseApps](policy-csp-privacy.md) - [LetAppsAccessGraphicsCaptureWithoutBorder_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessHumanPresence](policy-csp-privacy.md) +- [LetAppsAccessHumanPresence_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessHumanPresence_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessHumanPresence_UserInControlOfTheseApps](policy-csp-privacy.md) - [LetAppsAccessLocation](policy-csp-privacy.md) - [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md) - [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md) @@ -676,6 +689,7 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [StartLayout](policy-csp-start.md) - [ConfigureStartPins](policy-csp-start.md) - [HideRecommendedSection](policy-csp-start.md) +- [HideRecoPersonalizedSites](policy-csp-start.md) - [HideTaskViewButton](policy-csp-start.md) - [DisableControlCenter](policy-csp-start.md) - [ForceStartSize](policy-csp-start.md) @@ -686,6 +700,7 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [StartLayout](policy-csp-start.md) - [ConfigureStartPins](policy-csp-start.md) - [HideRecommendedSection](policy-csp-start.md) +- [HideRecoPersonalizedSites](policy-csp-start.md) - [SimplifyQuickSettings](policy-csp-start.md) - [DisableEditingQuickSettings](policy-csp-start.md) - [HideTaskViewButton](policy-csp-start.md) @@ -869,6 +884,7 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [DenyLogOnAsBatchJob](policy-csp-userrights.md) - [LogOnAsService](policy-csp-userrights.md) - [IncreaseProcessWorkingSet](policy-csp-userrights.md) +- [DenyServiceLogonRight](policy-csp-userrights.md) ## VirtualizationBasedTechnology diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md index 5abbb6fc17..f0100f698a 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Surface Hub. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 03/17/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -335,6 +335,8 @@ This article lists the policies in Policy CSP that are applicable for Surface Hu - [HideRecentlyAddedApps](policy-csp-start.md#hiderecentlyaddedapps) - [HideRecommendedSection](policy-csp-start.md#hiderecommendedsection) - [HideRecommendedSection](policy-csp-start.md#hiderecommendedsection) +- [HideRecoPersonalizedSites](policy-csp-start.md#hiderecopersonalizedsites) +- [HideRecoPersonalizedSites](policy-csp-start.md#hiderecopersonalizedsites) - [HideRestart](policy-csp-start.md#hiderestart) - [HideShutDown](policy-csp-start.md#hideshutdown) - [HideSignOut](policy-csp-start.md#hidesignout) diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index bdb6a819f1..f6ee903aef 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -4,7 +4,7 @@ description: Learn more about the AboveLock Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -40,7 +40,7 @@ ms.topic: reference -This policy is deprecated +This policy is deprecated. diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index 44c49be631..a9ee824925 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -4,7 +4,7 @@ description: Learn more about the Accounts Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,7 +37,7 @@ ms.topic: reference -Specifies whether user is allowed to add non-MSA email accounts. Most restricted value is 0 +Specifies whether user is allowed to add non-MSA email accounts. Most restricted value is 0. > [!NOTE] > This policy will only block UI/UX-based methods for adding non-Microsoft accounts. Even if this policy is enforced, you can still provision non-MSA accounts using the EMAIL2 CSP. @@ -138,10 +138,10 @@ Specifies whether the user is allowed to use an MSA account for non-email relate -Allows IT Admins the ability to disable the Microsoft Account Sign-In Assistant (wlidsvc) NT service +Allows IT Admins the ability to disable the Microsoft Account Sign-In Assistant (wlidsvc) NT service. > [!NOTE] -> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See Feature updates are not being offered while other updates are +> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See Feature updates are not being offered while other updates are. > [!NOTE] > If the MSA service is disabled, the Subscription Activation feature will not work properly and your users will not be able to "step-up" from Windows 10 Pro to Windows 10 Enterprise, because the MSA ticket for license authentication cannot be generated. The machine will remain on Windows 10 Pro and no error will be displayed in the Activation Settings app. diff --git a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md index 58e17f5f98..d1170a124f 100644 --- a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md +++ b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_AddRemovePrograms Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -110,7 +110,7 @@ You can use this setting to direct users to the programs they are most likely to Removes the "Add a program from CD-ROM or floppy disk" section from the Add New Programs page. This prevents users from using Add or Remove Programs to install programs from removable media. -- If you disable this setting or do not configure it, the "Add a program from CD-ROM or floppy disk" option is available to all users. +If you disable this setting or do not configure it, the "Add a program from CD-ROM or floppy disk" option is available to all users. This setting does not prevent users from using other tools and methods to add or remove program components. @@ -173,7 +173,7 @@ This setting does not prevent users from using other tools and methods to add or Removes the "Add programs from Microsoft" section from the Add New Programs page. This setting prevents users from using Add or Remove Programs to connect to Windows Update. -- If you disable this setting or do not configure it, "Add programs from Microsoft" is available to all users. +If you disable this setting or do not configure it, "Add programs from Microsoft" is available to all users. This setting does not prevent users from using other tools and methods to connect to Windows Update. @@ -305,7 +305,7 @@ Removes the Add New Programs button from the Add or Remove Programs bar. As a re The Add New Programs button lets users install programs published or assigned by a system administrator. -- If you disable this setting or do not configure it, the Add New Programs button is available to all users. +If you disable this setting or do not configure it, the Add New Programs button is available to all users. This setting does not prevent users from using other tools and methods to install programs. @@ -369,7 +369,7 @@ This setting removes Add or Remove Programs from Control Panel and removes the A Add or Remove Programs lets users install, uninstall, repair, add, and remove features and components of Windows 2000 Professional and a wide variety of Windows programs. Programs published or assigned to the user appear in Add or Remove Programs. -- If you disable this setting or do not configure it, Add or Remove Programs is available to all users. +If you disable this setting or do not configure it, Add or Remove Programs is available to all users. When enabled, this setting takes precedence over the other settings in this folder. @@ -433,7 +433,7 @@ Removes the Set Program Access and Defaults button from the Add or Remove Progra The Set Program Access and Defaults button lets administrators specify default programs for certain activities, such as Web browsing or sending e-mail, as well as which programs are accessible from the Start menu, desktop, and other locations. -- If you disable this setting or do not configure it, the Set Program Access and Defaults button is available to all users. +If you disable this setting or do not configure it, the Set Program Access and Defaults button is available to all users. This setting does not prevent users from using other tools and methods to change program access or defaults. @@ -497,7 +497,7 @@ Removes the Change or Remove Programs button from the Add or Remove Programs bar The Change or Remove Programs button lets users uninstall, repair, add, or remove features of installed programs. -- If you disable this setting or do not configure it, the Change or Remove Programs page is available to all users. +If you disable this setting or do not configure it, the Change or Remove Programs page is available to all users. This setting does not prevent users from using other tools and methods to delete or uninstall programs. @@ -560,6 +560,7 @@ Prevents users from using Add or Remove Programs to configure installed services This setting removes the "Set up services" section of the Add/Remove Windows Components page. The "Set up services" section lists system services that have not been configured and offers users easy access to the configuration tools. - If you disable this setting or do not configure it, "Set up services" appears only when there are unconfigured system services. + - If you enable this setting, "Set up services" never appears. This setting does not prevent users from using other methods to configure services. @@ -627,7 +628,7 @@ Removes links to the Support Info dialog box from programs on the Change or Remo Programs listed on the Change or Remove Programs page can include a "Click here for support information" hyperlink. When clicked, the hyperlink opens a dialog box that displays troubleshooting information, including a link to the installation files and data that users need to obtain product support, such as the Product ID and version number of the program. The dialog box also includes a hyperlink to support information on the Internet, such as the Microsoft Product Support Services Web page. -- If you disable this setting or do not configure it, the Support Info hyperlink appears. +If you disable this setting or do not configure it, the Support Info hyperlink appears. > [!NOTE] > Not all programs provide a support information hyperlink. @@ -690,7 +691,7 @@ Removes the Add/Remove Windows Components button from the Add or Remove Programs The Add/Remove Windows Components button lets users configure installed services and use the Windows Component Wizard to add, remove, and configure components of Windows from the installation files. -- If you disable this setting or do not configure it, the Add/Remove Windows Components button is available to all users. +If you disable this setting or do not configure it, the Add/Remove Windows Components button is available to all users. This setting does not prevent users from using other tools and methods to configure services or add or remove program components. However, this setting blocks user access to the Windows Component Wizard. diff --git a/windows/client-management/mdm/policy-csp-admx-appcompat.md b/windows/client-management/mdm/policy-csp-admx-appcompat.md index a0d2e3d901..d864def13f 100644 --- a/windows/client-management/mdm/policy-csp-admx-appcompat.md +++ b/windows/client-management/mdm/policy-csp-admx-appcompat.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_AppCompat Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -241,7 +241,8 @@ The Windows Resource Protection and User Account Control features of Windows use This option is useful to server administrators who require faster performance and are aware of the compatibility of the applications they are using. It is particularly useful for a web server where applications may be launched several hundred times a second, and the performance of the loader is essential. -NOTE: Many system processes cache the value of this setting for performance reasons. If you make changes to this setting, please reboot to ensure that your system accurately reflects those changes. +> [!NOTE] +> Many system processes cache the value of this setting for performance reasons. If you make changes to this setting, please reboot to ensure that your system accurately reflects those changes. diff --git a/windows/client-management/mdm/policy-csp-admx-auditsettings.md b/windows/client-management/mdm/policy-csp-admx-auditsettings.md index 8e82cda5ea..9df41c0e25 100644 --- a/windows/client-management/mdm/policy-csp-admx-auditsettings.md +++ b/windows/client-management/mdm/policy-csp-admx-auditsettings.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_AuditSettings Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -45,6 +45,7 @@ ms.topic: reference This policy setting determines what information is logged in security audit events when a new process has been created. This setting only applies when the Audit Process Creation policy is enabled. + - If you enable this policy setting the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied. - If you disable or do not configure this policy setting, the process's command line information will not be included in Audit Process Creation events. diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md index 6c2d52f8d1..4381ecdcb1 100644 --- a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md +++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_CipherSuiteOrder Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -117,7 +117,7 @@ NistP384 To See all the curves supported on the system, Use the following command: -CertUtil.exe -DisplayEccCurve +CertUtil.exe -DisplayEccCurve. diff --git a/windows/client-management/mdm/policy-csp-admx-controlpanel.md b/windows/client-management/mdm/policy-csp-admx-controlpanel.md index 4a3df26d6e..07bb2c18f1 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpanel.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_ControlPanel Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference This setting allows you to display or hide specified Control Panel items, such as Mouse, System, or Personalization, from the Control Panel window and the Start screen. The setting affects the Start screen and Control Panel window, as well as other ways to access Control Panel items, such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings. -- If you enable this setting, you can select specific items not to display on the Control Panel window and the Start screen. +If you enable this setting, you can select specific items not to display on the Control Panel window and the Start screen. To hide a Control Panel item, enable this policy setting and click Show to access the list of disallowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter Microsoft. Mouse, Microsoft. System, or Microsoft. Personalization. @@ -120,6 +120,7 @@ This policy setting controls the default Control Panel view, whether by category - If this policy setting is disabled, the Control Panel opens to the category view. - If this policy setting is not configured, the Control Panel opens to the view used in the last Control Panel session. + > [!NOTE] > Icon size is dependent upon what the user has set it to in the previous session. diff --git a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md index 68499c0c39..e751b4fa8b 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_ControlPanelDisplay Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/13/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference Disables the Display Control Panel. -- If you enable this setting, the Display Control Panel does not run. When users try to start Display, a message appears explaining that a setting prevents the action. +If you enable this setting, the Display Control Panel does not run. When users try to start Display, a message appears explaining that a setting prevents the action. Also, see the "Prohibit access to the Control Panel" (User Configuration\Administrative Templates\Control Panel) and "Remove programs on Settings menu" (User Configuration\Administrative Templates\Start Menu & Taskbar) settings. @@ -537,7 +537,7 @@ Prevents users from changing the background image shown when the machine is lock By default, users can change the background image shown when the machine is locked or displaying the logon screen. -- If you enable this setting, the user will not be able to change their lock screen and logon image, and they will instead see the default image. +If you enable this setting, the user will not be able to change their lock screen and logon image, and they will instead see the default image. @@ -597,7 +597,7 @@ Prevents users from changing the look of their start menu background, such as it By default, users can change the look of their start menu background, such as its color or accent. -- If you enable this setting, the user will be assigned the default start menu background and colors and will not be allowed to change them. +If you enable this setting, the user will be assigned the default start menu background and colors and will not be allowed to change them. If the "Force a specific background and accent color" policy is also set on a supported version of Windows, then those colors take precedence over this policy. @@ -661,7 +661,7 @@ Disables the Color (or Window Color) page in the Personalization Control Panel, This setting prevents users from using Control Panel to change the window border and taskbar color (on Windows 8), glass color (on Windows Vista and Windows 7), system colors, or color scheme of the desktop and windows. -- If this setting is disabled or not configured, the Color (or Window Color) page or Color Scheme dialog is available in the Personalization or Display Control Panel. +If this setting is disabled or not configured, the Color (or Window Color) page or Color Scheme dialog is available in the Personalization or Display Control Panel. For systems prior to Windows Vista, this setting hides the Appearance and Themes tabs in the in Display in Control Panel. @@ -723,7 +723,7 @@ Prevents users from adding or changing the background design of the desktop. By default, users can use the Desktop Background page in the Personalization or Display Control Panel to add a background design (wallpaper) to their desktop. -- If you enable this setting, none of the Desktop Background settings can be changed by the user. +If you enable this setting, none of the Desktop Background settings can be changed by the user. To specify wallpaper for a group, use the "Desktop Wallpaper" setting. @@ -790,7 +790,7 @@ Prevents users from changing the desktop icons. By default, users can use the Desktop Icon Settings dialog in the Personalization or Display Control Panel to show, hide, or change the desktop icons. -- If you enable this setting, none of the desktop icons can be changed by the user. +If you enable this setting, none of the desktop icons can be changed by the user. For systems prior to Windows Vista, this setting also hides the Desktop tab in the Display Control Panel. @@ -912,7 +912,7 @@ Prevents users from changing the mouse pointers. By default, users can use the Pointers tab in the Mouse Control Panel to add, remove, or change the mouse pointers. -- If you enable this setting, none of the mouse pointer scheme settings can be changed by the user. +If you enable this setting, none of the mouse pointer scheme settings can be changed by the user. @@ -1030,7 +1030,7 @@ Prevents users from changing the sound scheme. By default, users can use the Sounds tab in the Sound Control Panel to add, remove, or change the system Sound Scheme. -- If you enable this setting, none of the Sound Scheme settings can be changed by the user. +If you enable this setting, none of the Sound Scheme settings can be changed by the user. @@ -1090,7 +1090,7 @@ Forces Windows to use the specified colors for the background and accent. The co By default, users can change the background and accent colors. -- If this setting is enabled, the background and accent colors of Windows will be set to the specified colors and users cannot change those colors. This setting will not be applied if the specified colors do not meet a contrast ratio of 2:1 with white text. +If this setting is enabled, the background and accent colors of Windows will be set to the specified colors and users cannot change those colors. This setting will not be applied if the specified colors do not meet a contrast ratio of 2:1 with white text. diff --git a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md index 9ded8c68b8..90a95f4010 100644 --- a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_CredentialProviders Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -173,7 +173,7 @@ credential providers from use during authentication. **Note** credential providers are used to process and validate user credentials during logon or when authentication is required. -Windows Vista provides two default credential providers +Windows Vista provides two default credential providers: Password and Smart Card. An administrator can install additional credential providers for different sets of credentials (for example, to support biometric authentication). diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md index 6af877c393..336f4f912a 100644 --- a/windows/client-management/mdm/policy-csp-admx-credssp.md +++ b/windows/client-management/mdm/policy-csp-admx-credssp.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_CredSsp Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -50,7 +50,7 @@ This policy setting applies when server authentication was achieved by using a t The policy becomes effective the next time the user signs on to a computer running Windows. -If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any computer. Applications depending upon this delegation behavior might fail authentication. For more information, see KB. +- If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any computer. Applications depending upon this delegation behavior might fail authentication. For more information, see KB. FWlink for KB: @@ -61,7 +61,7 @@ FWlink for KB: For Example: TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine TERMSRV/* Remote Desktop Session Host running on all machines. -TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com +TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com. @@ -123,7 +123,7 @@ This policy setting applies when server authentication was achieved via NTLM. - If you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you use when first logging on to Windows). -If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any machine. +- If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any machine. > [!NOTE] > The "Allow delegating default credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. @@ -131,7 +131,7 @@ If you disable or do not configure (by default) this policy setting, delegation For Example: TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine TERMSRV/* Remote Desktop Session Host running on all machines. -TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com +TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com. @@ -189,19 +189,19 @@ TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all Encryption Oracle Remediation -This policy setting applies to applications using the CredSSP component (for example Remote Desktop Connection). +This policy setting applies to applications using the CredSSP component (for example: Remote Desktop Connection). Some versions of the CredSSP protocol are vulnerable to an encryption oracle attack against the client. This policy controls compatibility with vulnerable clients and servers. This policy allows you to set the level of protection desired for the encryption oracle vulnerability. -- If you enable this policy setting, CredSSP version support will be selected based on the following options +If you enable this policy setting, CredSSP version support will be selected based on the following options: -Force Updated Clients Client applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. **Note** this setting should not be deployed until all remote hosts support the newest version. +Force Updated Clients: Client applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. **Note** this setting should not be deployed until all remote hosts support the newest version. -Mitigated Client applications which use CredSSP will not be able to fall back to the insecure version but services using CredSSP will accept unpatched clients. See the link below for important information about the risk posed by remaining unpatched clients. +Mitigated: Client applications which use CredSSP will not be able to fall back to the insecure version but services using CredSSP will accept unpatched clients. See the link below for important information about the risk posed by remaining unpatched clients. -Vulnerable Client applications which use CredSSP will expose the remote servers to attacks by supporting fall back to the insecure versions and services using CredSSP will accept unpatched clients. +Vulnerable: Client applications which use CredSSP will expose the remote servers to attacks by supporting fall back to the insecure versions and services using CredSSP will accept unpatched clients. -For more information about the vulnerability and servicing requirements for protection, see +For more information about the vulnerability and servicing requirements for protection, see @@ -262,7 +262,7 @@ This policy setting applies when server authentication was achieved via a truste - If you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application). -If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). +- If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). - If you disable this policy setting, delegation of fresh credentials is not permitted to any machine. @@ -273,7 +273,7 @@ For Example: TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine TERMSRV/* Remote Desktop Session Host running on all machines. -TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com +TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com. @@ -335,7 +335,7 @@ This policy setting applies when server authentication was achieved via NTLM. - If you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application). -If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). +- If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). - If you disable this policy setting, delegation of fresh credentials is not permitted to any machine. @@ -345,7 +345,7 @@ If you do not configure (by default) this policy setting, after proper mutual au For Example: TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine TERMSRV/* Remote Desktop Session Host running on all machines. -TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com +TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com. @@ -407,7 +407,7 @@ This policy setting applies when server authentication was achieved via a truste - If you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). -If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). +- If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). - If you disable this policy setting, delegation of saved credentials is not permitted to any machine. @@ -417,7 +417,7 @@ If you do not configure (by default) this policy setting, after proper mutual au For Example: TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine TERMSRV/* Remote Desktop Session Host running on all machines. -TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com +TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com. @@ -479,7 +479,7 @@ This policy setting applies when server authentication was achieved via NTLM. - If you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). -If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*) if the client machine is not a member of any domain. If the client is domain-joined, by default the delegation of saved credentials is not permitted to any machine. +- If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*) if the client machine is not a member of any domain. If the client is domain-joined, by default the delegation of saved credentials is not permitted to any machine. - If you disable this policy setting, delegation of saved credentials is not permitted to any machine. @@ -489,7 +489,7 @@ If you do not configure (by default) this policy setting, after proper mutual au For Example: TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine TERMSRV/* Remote Desktop Session Host running on all machines. -TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com +TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com. @@ -549,7 +549,7 @@ This policy setting applies to applications using the Cred SSP component (for ex - If you enable this policy setting, you can specify the servers to which the user's default credentials cannot be delegated (default credentials are those that you use when first logging on to Windows). -If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. +- If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. > [!NOTE] > The "Deny delegating default credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. @@ -619,7 +619,7 @@ This policy setting applies to applications using the Cred SSP component (for ex - If you enable this policy setting, you can specify the servers to which the user's fresh credentials cannot be delegated (fresh credentials are those that you are prompted for when executing the application). -If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. +- If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. > [!NOTE] > The "Deny delegating fresh credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. @@ -689,7 +689,7 @@ This policy setting applies to applications using the Cred SSP component (for ex - If you enable this policy setting, you can specify the servers to which the user's saved credentials cannot be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). -If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. +- If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. > [!NOTE] > The "Deny delegating saved credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. diff --git a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md index 16b4681320..84347d6bd5 100644 --- a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md +++ b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_CtrlAltDel Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference This policy setting prevents users from changing their Windows password on demand. -- If you enable this policy setting, the 'Change Password' button on the Windows Security dialog box will not appear when you press Ctrl+Alt+Del. +If you enable this policy setting, the 'Change Password' button on the Windows Security dialog box will not appear when you press Ctrl+Alt+Del. However, users are still able to change their password when prompted by the system. The system prompts users for a new password when an administrator requires a new password or their password is expiring. diff --git a/windows/client-management/mdm/policy-csp-admx-datacollection.md b/windows/client-management/mdm/policy-csp-admx-datacollection.md index d658533761..fcae6c76a0 100644 --- a/windows/client-management/mdm/policy-csp-admx-datacollection.md +++ b/windows/client-management/mdm/policy-csp-admx-datacollection.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_DataCollection Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference This policy setting defines the identifier used to uniquely associate this device's diagnostic data data as belonging to a given organization. If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program. -- If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its diagnostic data data with your organization. +If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its diagnostic data data with your organization. diff --git a/windows/client-management/mdm/policy-csp-admx-dcom.md b/windows/client-management/mdm/policy-csp-admx-dcom.md index 61fe97ffea..57e6837e05 100644 --- a/windows/client-management/mdm/policy-csp-admx-dcom.md +++ b/windows/client-management/mdm/policy-csp-admx-dcom.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_DCOM Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -107,7 +107,7 @@ Allows you to specify that local computer administrators can supplement the "Def Allows you to view and change a list of DCOM server application ids (appids) which are exempted from the DCOM Activation security check. DCOM uses two such lists, one configured via Group Policy through this policy setting, and the other via the actions of local computer administrators. DCOM ignores the second list when this policy setting is configured, unless the "Allow local activation security check exemptions" policy is enabled. -DCOM server appids added to this policy must be listed in curly-brace format. For example: {b5dcb061-cefb-42e0-a1be-e6a6438133fe}. If you enter a non-existent or improperly formatted appid DCOM will add it to the list without checking for errors. +DCOM server appids added to this policy must be listed in curly-brace format. For Example: `{b5dcb061-cefb-42e0-a1be-e6a6438133fe}`. If you enter a non-existent or improperly formatted appid DCOM will add it to the list without checking for errors. - If you enable this policy setting, you can view and change the list of DCOM activation security check exemptions defined by Group Policy settings. If you add an appid to this list and set its value to 1, DCOM will not enforce the Activation security check for that DCOM server. If you add an appid to this list and set its value to 0 DCOM will always enforce the Activation security check for that DCOM server regardless of local settings. diff --git a/windows/client-management/mdm/policy-csp-admx-desktop.md b/windows/client-management/mdm/policy-csp-admx-desktop.md index 69fb32dabf..4a0662062e 100644 --- a/windows/client-management/mdm/policy-csp-admx-desktop.md +++ b/windows/client-management/mdm/policy-csp-admx-desktop.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Desktop Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -233,7 +233,7 @@ Enables Active Desktop and prevents users from disabling it. This setting prevents users from trying to enable or disable Active Desktop while a policy controls it. -- If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it. +If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it. > [!NOTE] > If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored. If the "Turn on Classic Shell" setting ( in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both of these policies are ignored. @@ -296,7 +296,7 @@ Disables Active Desktop and prevents users from enabling it. This setting prevents users from trying to enable or disable Active Desktop while a policy controls it. -- If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it. +If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it. > [!NOTE] > If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored. If the "Turn on Classic Shell" setting (in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both these policies are ignored. @@ -1098,7 +1098,7 @@ Removes the Properties option from the Recycle Bin context menu. Prevents users from saving certain changes to the desktop. -- If you enable this setting, users can change the desktop, but some changes, such as the position of open windows or the size and position of the taskbar, are not saved when users log off. However, shortcuts placed on the desktop are always saved. +If you enable this setting, users can change the desktop, but some changes, such as the position of open windows or the size and position of the taskbar, are not saved when users log off. However, shortcuts placed on the desktop are always saved. @@ -1343,7 +1343,7 @@ Prevents users from removing Web content from their Active Desktop. In Active Desktop, you can add items to the desktop but close them so they are not displayed. -- If you enable this setting, items added to the desktop cannot be closed; they always appear on the desktop. This setting removes the check boxes from items on the Web tab in Display in Control Panel. +If you enable this setting, items added to the desktop cannot be closed; they always appear on the desktop. This setting removes the check boxes from items on the Web tab in Display in Control Panel. > [!NOTE] > This setting does not prevent users from deleting items from their Active Desktop. @@ -1585,7 +1585,7 @@ This setting removes all Active Desktop items from the desktop. It also removes Prevents users from manipulating desktop toolbars. -- If you enable this setting, users cannot add or remove toolbars from the desktop. Also, users cannot drag toolbars on to or off of docked toolbars. +If you enable this setting, users cannot add or remove toolbars from the desktop. Also, users cannot drag toolbars on to or off of docked toolbars. > [!NOTE] > If users have added or removed toolbars, this setting prevents them from restoring the default configuration. @@ -1776,7 +1776,7 @@ This setting lets you specify the wallpaper on users' desktops and prevents user To use this setting, type the fully qualified path and name of the file that stores the wallpaper image. You can type a local path, such as C:\Windows\web\wallpaper\home.jpg or a UNC path, such as \\Server\Share\Corp.jpg. If the specified file is not available when the user logs on, no wallpaper is displayed. Users cannot specify alternative wallpaper. You can also use this setting to specify that the wallpaper image be centered, tiled, or stretched. Users cannot change this specification. -- If you disable this setting or do not configure it, no wallpaper is displayed. However, users can select the wallpaper of their choice. +If you disable this setting or do not configure it, no wallpaper is displayed. However, users can select the wallpaper of their choice. Also, see the "Allow only bitmapped wallpaper" in the same location, and the "Prevent changing wallpaper" setting in User Configuration\Administrative Templates\Control Panel. diff --git a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md index 1deaa9fc80..e0d3710fed 100644 --- a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_DeviceInstallation Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -45,6 +45,7 @@ ms.topic: reference This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings. - If you enable this policy setting, members of the Administrators group can use the Add Hardware wizard or the Update Driver wizard to install and update the drivers for any device. + - If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. - If you disable or do not configure this policy setting, members of the Administrators group are subject to all policy settings that restrict device installation. @@ -345,9 +346,11 @@ This policy setting establishes the amount of time (in seconds) that the system This policy setting allows you to prevent Windows from installing removable devices. A device is considered removable when the driver for the device to which it is connected indicates that the device is removable. For example, a Universal Serial Bus (USB) device is reported to be removable by the drivers for the USB hub to which the device is connected. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device. -NOTE: To enable the "Allow installation of devices using drivers that match these device setup classes", "Allow installation of devices that match any of these device IDs", and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting. +> [!NOTE] +> To enable the "Allow installation of devices using drivers that match these device setup classes", "Allow installation of devices that match any of these device IDs", and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting. - If you enable this policy setting, Windows is prevented from installing removable devices and existing removable devices cannot have their drivers updated. + - If you enable this policy setting on a remote desktop server, the policy setting affects redirection of removable devices from a remote desktop client to the remote desktop server. - If you disable or do not configure this policy setting, Windows can install and update driver packages for removable devices as allowed or prevented by other policy settings. diff --git a/windows/client-management/mdm/policy-csp-admx-diskquota.md b/windows/client-management/mdm/policy-csp-admx-diskquota.md index a8d0a1bea1..30316a20e8 100644 --- a/windows/client-management/mdm/policy-csp-admx-diskquota.md +++ b/windows/client-management/mdm/policy-csp-admx-diskquota.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_DiskQuota Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -189,7 +189,7 @@ This setting overrides new users' settings for the disk quota limit and warning This policy setting applies to all new users as soon as they write to the volume. It does not affect disk quota limits for current users, or affect customized limits and warning levels set for particular users (on the Quota tab in Volume Properties). -- If you disable or do not configure this policy setting, the disk space available to users is not limited. The disk quota management feature uses the physical space on each volume as its quota limit and warning level. +If you disable or do not configure this policy setting, the disk space available to users is not limited. The disk quota management feature uses the physical space on each volume as its quota limit and warning level. When you select a limit, remember that the same limit applies to all users on all volumes, regardless of actual volume size. Be sure to set the limit and warning level so that it is reasonable for the range of volumes in the group. @@ -384,7 +384,7 @@ This policy setting does not affect the Quota Entries window on the Quota tab. E This policy setting extends the disk quota policies in this folder to NTFS file system volumes on removable media. -- If you disable or do not configure this policy setting, the disk quota policies established in this folder apply to fixed-media NTFS volumes only +If you disable or do not configure this policy setting, the disk quota policies established in this folder apply to fixed-media NTFS volumes only. > [!NOTE] > When this policy setting is applied, the computer will apply the disk quota to both fixed and removable media. diff --git a/windows/client-management/mdm/policy-csp-admx-errorreporting.md b/windows/client-management/mdm/policy-csp-admx-errorreporting.md index 600645f1cf..17b77f1279 100644 --- a/windows/client-management/mdm/policy-csp-admx-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-admx-errorreporting.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_ErrorReporting Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -243,6 +243,7 @@ This policy setting does not enable or disable Windows Error Reporting. To turn > If the Turn off Windows Error Reporting policy setting is not configured, then Control Panel settings for Windows Error Reporting override this policy setting. - If you enable this policy setting, the setting overrides any user changes made to Windows Error Reporting settings in Control Panel, and default values are applied for any Windows Error Reporting policy settings that are not configured (even if users have changed settings by using Control Panel). + - If you enable this policy setting, you can configure the following settings in the policy setting: - "Do not display links to any Microsoft 'More information' websites": Select this option if you do not want error dialog boxes to display links to Microsoft websites. @@ -1425,6 +1426,7 @@ This policy setting turns off Windows Error Reporting, so that reports are not c This policy setting limits Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on. - If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. To remove an application from the list, click the name, and then press DELETE. + - If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence. - If you disable or do not configure this policy setting, errors are reported on all Microsoft and Windows applications by default. @@ -1485,6 +1487,7 @@ This policy setting limits Windows Error Reporting behavior for errors in genera This policy setting limits Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on. - If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. To remove an application from the list, click the name, and then press DELETE. + - If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence. - If you disable or do not configure this policy setting, errors are reported on all Microsoft and Windows applications by default. diff --git a/windows/client-management/mdm/policy-csp-admx-eventlog.md b/windows/client-management/mdm/policy-csp-admx-eventlog.md index e1e98092d9..1164b582ab 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventlog.md +++ b/windows/client-management/mdm/policy-csp-admx-eventlog.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_EventLog Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -973,7 +973,7 @@ This policy setting controls Event Log behavior when the log file reaches its ma This policy setting turns on logging. -- If you enable or do not configure this policy setting, then events can be written to this log. +If you enable or do not configure this policy setting, then events can be written to this log. If the policy setting is disabled, then no new events can be logged. Events can always be read from the log, regardless of this policy setting. diff --git a/windows/client-management/mdm/policy-csp-admx-eventviewer.md b/windows/client-management/mdm/policy-csp-admx-eventviewer.md index c0b5223b4c..ec7f4e721d 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventviewer.md +++ b/windows/client-management/mdm/policy-csp-admx-eventviewer.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_EventViewer Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -97,7 +97,7 @@ This is the program that will be invoked when the user clicks the events.asp lin -This specifies the command line parameters that will be passed to the events.asp program +This specifies the command line parameters that will be passed to the events.asp program. diff --git a/windows/client-management/mdm/policy-csp-admx-explorer.md b/windows/client-management/mdm/policy-csp-admx-explorer.md index 1d565c61b0..1508b4ca33 100644 --- a/windows/client-management/mdm/policy-csp-admx-explorer.md +++ b/windows/client-management/mdm/policy-csp-admx-explorer.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Explorer Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -165,7 +165,7 @@ This policy setting configures File Explorer to always display the menu bar. This policy setting allows administrators who have configured roaming profile in conjunction with Delete Cached Roaming Profile Group Policy setting to ensure that Explorer will not reinitialize default program associations and other settings to default values. -- If you enable this policy setting on a machine that does not contain all programs installed in the same manner as it was on the machine on which the user had last logged on, unexpected behavior could occur. +If you enable this policy setting on a machine that does not contain all programs installed in the same manner as it was on the machine on which the user had last logged on, unexpected behavior could occur. diff --git a/windows/client-management/mdm/policy-csp-admx-filesys.md b/windows/client-management/mdm/policy-csp-admx-filesys.md index 329a7e9c63..cf01947874 100644 --- a/windows/client-management/mdm/policy-csp-admx-filesys.md +++ b/windows/client-management/mdm/policy-csp-admx-filesys.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_FileSys Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference Compression can add to the processing overhead of filesystem operations. Enabling this setting will prevent access to and creation of compressed files. -A reboot is required for this setting to take effect +A reboot is required for this setting to take effect. @@ -161,7 +161,7 @@ A value of 1 will disable delete notifications for all volumes. Encryption can add to the processing overhead of filesystem operations. Enabling this setting will prevent access to and creation of encrypted files. -A reboot is required for this setting to take effect +A reboot is required for this setting to take effect. @@ -395,7 +395,8 @@ Remote Link to Local Target For further information please refer to the Windows Help section -NOTE: If this policy is Disabled or Not Configured, local administrators may select the types of symbolic links to be evaluated. +> [!NOTE] +> If this policy is Disabled or Not Configured, local administrators may select the types of symbolic links to be evaluated. diff --git a/windows/client-management/mdm/policy-csp-admx-folderredirection.md b/windows/client-management/mdm/policy-csp-admx-folderredirection.md index e3ca25a214..ef355a430a 100644 --- a/windows/client-management/mdm/policy-csp-admx-folderredirection.md +++ b/windows/client-management/mdm/policy-csp-admx-folderredirection.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_FolderRedirection Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -115,7 +115,7 @@ This policy setting allows you to control whether individual redirected shell fo For the folders affected by this setting, users must manually select the files they wish to make available offline. -- If you disable or do not configure this policy setting, all redirected shell folders are automatically made available offline. All subfolders within the redirected folders are also made available offline. +If you disable or do not configure this policy setting, all redirected shell folders are automatically made available offline. All subfolders within the redirected folders are also made available offline. > [!NOTE] > This policy setting does not prevent files from being automatically cached if the network share is configured for "Automatic Caching", nor does it affect the availability of the "Always available offline" menu option in the user interface. diff --git a/windows/client-management/mdm/policy-csp-admx-framepanes.md b/windows/client-management/mdm/policy-csp-admx-framepanes.md index 898a9c4f92..00c5fcc190 100644 --- a/windows/client-management/mdm/policy-csp-admx-framepanes.md +++ b/windows/client-management/mdm/policy-csp-admx-framepanes.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_FramePanes Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,9 +44,9 @@ ms.topic: reference This policy setting shows or hides the Details Pane in File Explorer. -- If you enable this policy setting and configure it to hide the pane, the Details Pane in File Explorer is hidden and cannot be turned on by the user. +If you enable this policy setting and configure it to hide the pane, the Details Pane in File Explorer is hidden and cannot be turned on by the user. -- If you enable this policy setting and configure it to show the pane, the Details Pane is always visible and cannot be hidden by the user +If you enable this policy setting and configure it to show the pane, the Details Pane is always visible and cannot be hidden by the user. > [!NOTE] > This has a side effect of not being able to toggle to the Preview Pane since the two cannot be displayed at the same time. @@ -108,7 +108,7 @@ If you disable, or do not configure this policy setting, the Details Pane is hid Hides the Preview Pane in File Explorer. -- If you enable this policy setting, the Preview Pane in File Explorer is hidden and cannot be turned on by the user. +If you enable this policy setting, the Preview Pane in File Explorer is hidden and cannot be turned on by the user. If you disable, or do not configure this setting, the Preview Pane is hidden by default and can be displayed by the user. diff --git a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md index f755796c17..f1ef50e530 100644 --- a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_GroupPolicy Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -47,10 +47,10 @@ This policy setting allows user-based policy processing, roaming user profiles, This policy setting affects all user accounts that interactively log on to a computer in a different forest when a trust across forests or a two-way forest trust exists. - If you do not configure this policy setting: -- No user-based policy settings are applied from the user's forest. -- Users do not receive their roaming profiles; they receive a local profile on the computer from the local forest. A warning message appears to the user, and an event log message (1529) is posted. -- Loopback Group Policy processing is applied, using the Group Policy Objects (GPOs) that are scoped to the computer. -- An event log message (1109) is posted, stating that loopback was invoked in Replace mode. + - No user-based policy settings are applied from the user's forest. + - Users do not receive their roaming profiles; they receive a local profile on the computer from the local forest. A warning message appears to the user, and an event log message (1529) is posted. + - Loopback Group Policy processing is applied, using the Group Policy Objects (GPOs) that are scoped to the computer. + - An event log message (1109) is posted, stating that loopback was invoked in Replace mode. - If you enable this policy setting, the behavior is exactly the same as in Windows 2000: user policy is applied, and a roaming user profile is allowed from the trusted forest. @@ -1117,7 +1117,8 @@ Changing the status of this setting to Enabled will keep any source files from c Changing the status of this setting to Disabled will enforce the default behavior. Files will always be copied to the GPO if they have a later timestamp. -NOTE: If the Computer Configuration policy setting, "Always use local ADM files for the Group Policy Object Editor" is enabled, the state of this setting is ignored and always treated as Enabled. +> [!NOTE] +> If the Computer Configuration policy setting, "Always use local ADM files for the Group Policy Object Editor" is enabled, the state of this setting is ignored and always treated as Enabled. @@ -1496,6 +1497,7 @@ The timeout value that is defined in this policy setting determines how long Gro This policy setting allows you to configure Group Policy caching behavior on Windows Server machines. + - If you enable this policy setting, Group Policy caches policy information after every background processing session. This cache saves applicable GPOs and the settings contained within them. When Group Policy runs in synchronous foreground mode, it refers to this cache, which enables it to run faster. When the cache is read, Group Policy attempts to contact a logon domain controller to determine the link speed. When Group Policy runs in background mode or asynchronous foreground mode, it continues to download the latest version of the policy information, and it uses a bandwidth estimate to determine slow link thresholds. (See the "Configure Group Policy Slow Link Detection" policy setting to configure asynchronous foreground behavior.) The slow link value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before reporting the link speed as slow. The default is 500 milliseconds. The timeout value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before determining that there is no network connectivity. This stops the current Group Policy processing. Group Policy will run in the background the next time a connection to a domain controller is established. Setting this value too high might result in longer waits for the user at boot or logon. The default is 5000 milliseconds. @@ -1819,7 +1821,7 @@ The system's response to a slow policy connection varies among policies. The pro This setting appears in the Computer Configuration and User Configuration folders. The setting in Computer Configuration defines a slow link for policies in the Computer Configuration folder. The setting in User Configuration defines a slow link for settings in the User Configuration folder. -Also, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile +Also, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile. > [!NOTE] > If the profile server has IP connectivity, the connection speed setting is used. If the profile server does not have IP connectivity, the SMB timing is used. @@ -1889,7 +1891,7 @@ The system's response to a slow policy connection varies among policies. The pro This setting appears in the Computer Configuration and User Configuration folders. The setting in Computer Configuration defines a slow link for policies in the Computer Configuration folder. The setting in User Configuration defines a slow link for settings in the User Configuration folder. -Also, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile +Also, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile. > [!NOTE] > If the profile server has IP connectivity, the connection speed setting is used. If the profile server does not have IP connectivity, the SMB timing is used. @@ -2231,7 +2233,7 @@ This setting allows you to specify the default name for new Group Policy objects The display name can contain environment variables and can be a maximum of 255 characters long. -- If this setting is disabled or Not Configured, the default display name of New Group Policy object is used. +If this setting is Disabled or Not Configured, the default display name of New Group Policy object is used. @@ -2694,12 +2696,10 @@ This policy directs Group Policy processing to skip processing any client side e - If you enable this policy setting, when a slow network connection is detected, Group Policy processing will always run in an asynchronous manner. Client computers will not wait for the network to be fully initialized at startup and logon. Existing users will be logged on using cached credentials, which will result in shorter logon times. Group Policy will be applied in the background after the network becomes available. -> [!NOTE] -> that because this is a background refresh, extensions requiring synchronous processing such as Software Installation, Folder Redirection +**Note** that because this is a background refresh, extensions requiring synchronous processing such as Software Installation, Folder Redirection and Drive Maps preference extension will not be applied. -> [!NOTE] -> There are two conditions that will cause Group Policy to be processed synchronously even if this policy setting is enabled: +**Note** There are two conditions that will cause Group Policy to be processed synchronously even if this policy setting is enabled: 1 - At the first computer startup after the client computer has joined the domain. 2 - If the policy setting "Always wait for the network at computer startup and logon" is enabled. @@ -2821,6 +2821,7 @@ This policy setting specifies how long Group Policy should wait for network avai This policy setting directs the system to apply the set of Group Policy objects for the computer to any user who logs on to a computer affected by this setting. It is intended for special-use computers, such as those in public places, laboratories, and classrooms, where you must modify the user setting based on the computer that is being used. By default, the user's Group Policy Objects determine which user settings apply. + - If this setting is enabled, then, when a user logs on to this computer, the computer's Group Policy Objects determine which set of Group Policy Objects applies. - If you enable this setting, you can select one of the following modes from the Mode box: diff --git a/windows/client-management/mdm/policy-csp-admx-help.md b/windows/client-management/mdm/policy-csp-admx-help.md index 08e004e302..c125af97bc 100644 --- a/windows/client-management/mdm/policy-csp-admx-help.md +++ b/windows/client-management/mdm/policy-csp-admx-help.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Help Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -187,7 +187,7 @@ This policy setting allows you to restrict programs from being run from online H > You can also restrict users from running applications by using the Software Restriction Policy settings available in Computer Configuration\Security Settings. > [!NOTE] -> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help +> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help. @@ -252,7 +252,7 @@ This policy setting allows you to restrict programs from being run from online H > You can also restrict users from running applications by using the Software Restriction Policy settings available in Computer Configuration\Security Settings. > [!NOTE] -> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help +> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help. diff --git a/windows/client-management/mdm/policy-csp-admx-iis.md b/windows/client-management/mdm/policy-csp-admx-iis.md index 0af1df4d24..6ac2bb4f65 100644 --- a/windows/client-management/mdm/policy-csp-admx-iis.md +++ b/windows/client-management/mdm/policy-csp-admx-iis.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_IIS Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -43,6 +43,7 @@ ms.topic: reference "This policy setting prevents installation of Internet Information Services (IIS) on this computer. + - If you enable this policy setting, Internet Information Services (IIS) cannot be installed, and you will not be able to install Windows components or applications that require IIS. Users installing Windows components or applications that require IIS might not receive a warning that IIS cannot be installed because of this Group Policy setting. Enabling this setting will not have any effect on IIS if IIS is already installed on the computer. - If you disable or do not configure this policy setting, IIS can be installed, as well as all the programs and applications that require IIS to run." diff --git a/windows/client-management/mdm/policy-csp-admx-kdc.md b/windows/client-management/mdm/policy-csp-admx-kdc.md index 0b0cd3777a..3a5a0abee3 100644 --- a/windows/client-management/mdm/policy-csp-admx-kdc.md +++ b/windows/client-management/mdm/policy-csp-admx-kdc.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_kdc Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -59,8 +59,8 @@ Domain functional level requirements For the options "Always provide claims" and "Fail unarmored authentication requests", when the domain functional level is set to Windows Server 2008 R2 or earlier then domain controllers behave as if the "Supported" option is selected. When the domain functional level is set to Windows Server 2012 then the domain controller advertises to Kerberos client computers that the domain is capable of claims and compound authentication for Dynamic Access Control and Kerberos armoring, and: -- If you set the "Always provide claims" option, always returns claims for accounts and supports the RFC behavior for advertising the flexible authentication secure tunneling (FAST). -- If you set the "Fail unarmored authentication requests" option, rejects unarmored Kerberos messages. + - If you set the "Always provide claims" option, always returns claims for accounts and supports the RFC behavior for advertising the flexible authentication secure tunneling (FAST). + - If you set the "Fail unarmored authentication requests" option, rejects unarmored Kerberos messages. > [!WARNING] > When "Fail unarmored authentication requests" is set, then client computers which do not support Kerberos armoring will fail to authenticate to the domain controller. @@ -68,9 +68,9 @@ When the domain functional level is set to Windows Server 2012 then the domain c To ensure this feature is effective, deploy enough domain controllers that support claims and compound authentication for Dynamic Access Control and are Kerberos armor-aware to handle the authentication requests. Insufficient number of domain controllers that support this policy result in authentication failures whenever Dynamic Access Control or Kerberos armoring is required (that is, the "Supported" option is enabled). Impact on domain controller performance when this policy setting is enabled: -- Secure Kerberos domain capability discovery is required resulting in additional message exchanges. -- Claims and compound authentication for Dynamic Access Control increases the size and complexity of the data in the message which results in more processing time and greater Kerberos service ticket size. -- Kerberos armoring fully encrypts Kerberos messages and signs Kerberos errors which results in increased processing time, but does not change the service ticket size. + - Secure Kerberos domain capability discovery is required resulting in additional message exchanges. + - Claims and compound authentication for Dynamic Access Control increases the size and complexity of the data in the message which results in more processing time and greater Kerberos service ticket size. + - Kerberos armoring fully encrypts Kerberos messages and signs Kerberos errors which results in increased processing time, but does not change the service ticket size. diff --git a/windows/client-management/mdm/policy-csp-admx-kerberos.md b/windows/client-management/mdm/policy-csp-admx-kerberos.md index 1845af6733..2a492d3afd 100644 --- a/windows/client-management/mdm/policy-csp-admx-kerberos.md +++ b/windows/client-management/mdm/policy-csp-admx-kerberos.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Kerberos Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -237,6 +237,7 @@ This policy setting allows you to specify which DNS host names and which DNS suf This policy setting allows you to disable revocation check for the SSL certificate of the targeted KDC proxy server. - If you enable this policy setting, revocation check for the SSL certificate of the KDC proxy server is ignored by the Kerberos client. This policy setting should only be used in troubleshooting KDC proxy connections. + > [!WARNING] > When revocation check is ignored, the server represented by the certificate is not guaranteed valid. diff --git a/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md b/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md index 3908dc2a9b..566b0c5342 100644 --- a/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md +++ b/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_LeakDiagnostic Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -49,8 +49,8 @@ This policy setting determines whether Diagnostic Policy Service (DPS) diagnoses - If you disable this policy setting, the DPS is not able to diagnose memory leak problems. This policy setting takes effect only under the following conditions: -- If the diagnostics-wide scenario execution policy is not configured. -- When the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed. + - If the diagnostics-wide scenario execution policy is not configured. + - When the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed. > [!NOTE] > The DPS can be configured with the Services snap-in to the Microsoft Management Console. diff --git a/windows/client-management/mdm/policy-csp-admx-logon.md b/windows/client-management/mdm/policy-csp-admx-logon.md index d95dcfdb4f..8854f1a0e9 100644 --- a/windows/client-management/mdm/policy-csp-admx-logon.md +++ b/windows/client-management/mdm/policy-csp-admx-logon.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Logon Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -839,15 +839,15 @@ If a user with a roaming profile, home directory, or user object logon script lo On servers running Windows Server 2008 or later, this policy setting is ignored during Group Policy processing at computer startup and Group Policy processing will be synchronous (these servers wait for the network to be initialized during computer startup). -If the server is configured as follows, this policy setting takes effect during Group Policy processing at user logon -- The server is configured as a terminal server (that is, the Terminal Server role service is installed and configured on the server); and -- The "Allow asynchronous user Group Policy processing when logging on through Terminal Services" policy setting is enabled. This policy setting is located under Computer Configuration\Policies\Administrative templates\System\Group Policy\. +If the server is configured as follows, this policy setting takes effect during Group Policy processing at user logon: + - The server is configured as a terminal server (that is, the Terminal Server role service is installed and configured on the server); and + - The "Allow asynchronous user Group Policy processing when logging on through Terminal Services" policy setting is enabled. This policy setting is located under Computer Configuration\Policies\Administrative templates\System\Group Policy\. If this configuration is not implemented on the server, this policy setting is ignored. In this case, Group Policy processing at user logon is synchronous (these servers wait for the network to be initialized during user logon). - If you disable or do not configure this policy setting and users log on to a client computer or a server running Windows Server 2008 or later and that is configured as described earlier, the computer typically does not wait for the network to be fully initialized. In this case, users are logged on with cached credentials. Group Policy is applied asynchronously in the background. -**Note** +**Note**: -If you want to guarantee the application of Folder Redirection, Software Installation, or roaming user profile settings in just one logon, enable this policy setting to ensure that Windows waits for the network to be available before applying policy. -If Folder Redirection policy will apply during the next logon, security policies will be applied asynchronously during the next update cycle, if network connectivity is available. diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md index 7cc5313827..4e89010233 100644 --- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_MicrosoftDefenderAntivirus Area in Policy author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -589,7 +589,7 @@ This policy setting allows you to disable scheduled and real-time scanning for f -This policy setting allows you to disable real-time scanning for any file opened by any of the specified processes. This policy does not apply to scheduled scans. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. **Note** that only executables can be excluded. For example, a process might be defined as "c\windows\app.exe". The value is not used and it is recommended that this be set to 0. +This policy setting allows you to disable real-time scanning for any file opened by any of the specified processes. This policy does not apply to scheduled scans. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. **Note** that only executables can be excluded. For example, a process might be defined as: "c:\windows\app.exe". The value is not used and it is recommended that this be set to 0. @@ -650,8 +650,8 @@ Exclude files and paths from Attack Surface Reduction (ASR) rules. Enabled: Specify the folders or files and resources that should be excluded from ASR rules in the Options section. Enter each rule on a new line as a name-value pair: -- Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder -- Value column: Enter "0" for each item + - Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder + - Value column: Enter "0" for each item Disabled: No exclusions will be applied to the ASR rules. @@ -718,26 +718,26 @@ You can configure ASR rules in the Configure Attack Surface Reduction rules GP s Set the state for each Attack Surface Reduction (ASR) rule. After enabling this setting, you can set each rule to the following in the Options section: -- Block: the rule will be applied -- Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied) -- Off: the rule will not be applied -- Not Configured: the rule is enabled with default values -- Warn: the rule will be applied and the end-user will have the option to bypass the block + - Block: the rule will be applied + - Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied) + - Off: the rule will not be applied + - Not Configured: the rule is enabled with default values + - Warn: the rule will be applied and the end-user will have the option to bypass the block Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules will the value of not configured. Enabled: Specify the state for each ASR rule under the Options section for this setting. Enter each rule on a new line as a name-value pair: -- Name column: Enter a valid ASR rule ID -- Value column: Enter the status ID that relates to state you want to specify for the associated rule + - Name column: Enter a valid ASR rule ID + - Value column: Enter the status ID that relates to state you want to specify for the associated rule The following status IDs are permitted under the value column: -- 1 (Block) -- 0 (Off) -- 2 (Audit) -- 5 (Not Configured) -- 6 (Warn) + - 1 (Block) + - 0 (Off) + - 2 (Audit) + - 5 (Not Configured) + - 6 (Warn) Example: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx @@ -1511,6 +1511,7 @@ This policy setting defines the number of days items should be kept in the Quara This policy setting allows you to configure the scheduled scan, and the scheduled security intelligence update, start time window in hours. - If you disable or do not configure this setting, scheduled tasks will begin at a random time within 4 hours after the time specified in Task Scheduler. + - If you enable this setting, you can widen, or narrow, this randomization period. Specify a randomization window of between 1 and 23 hours. @@ -2823,7 +2824,7 @@ Tracing levels are defined as: 1 - Error 2 - Warning 3 - Info -4 - Debug +4 - Debug. @@ -4742,7 +4743,7 @@ This policy setting allows you to configure security intelligence updates on sta This policy setting allows you to define the order in which different security intelligence update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources in order. Possible values are: "InternalDefinitionUpdateServer", "MicrosoftUpdateServer", "MMPC", and "FileShares" -For example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC } +For Example: `{ InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC }` - If you enable this setting, security intelligence update sources will be contacted in the order specified. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted. @@ -5054,7 +5055,7 @@ This policy setting allows you to specify the time of day at which to check for This policy setting allows you to define the security intelligence location for VDI-configured computers. -- If you disable or do not configure this setting, security intelligence will be referred from the default local source. +If you disable or do not configure this setting, security intelligence will be referred from the default local source. @@ -5427,7 +5428,7 @@ This policy setting customize which remediation action will be taken for each li Valid remediation action values are: 2 = Quarantine 3 = Remove -6 = Ignore +6 = Ignore. @@ -5603,7 +5604,7 @@ Use this policy setting to specify if you want Microsoft Defender Antivirus noti This policy setting allows user to supress reboot notifications in UI only mode (for cases where UI can't be in lockdown mode). -- If you enable this setting AM UI won't show reboot notifications. +If you enable this setting AM UI won't show reboot notifications. @@ -5660,7 +5661,7 @@ This policy setting allows user to supress reboot notifications in UI only mode This policy setting allows you to configure whether or not to display AM UI to the users. -- If you enable this setting AM UI won't be available to users. +If you enable this setting AM UI won't be available to users. diff --git a/windows/client-management/mdm/policy-csp-admx-mmc.md b/windows/client-management/mdm/policy-csp-admx-mmc.md index 1956accd4b..1a28b481b0 100644 --- a/windows/client-management/mdm/policy-csp-admx-mmc.md +++ b/windows/client-management/mdm/policy-csp-admx-mmc.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_MMC Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference Permits or prohibits use of this snap-in. -- If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. +If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. @@ -114,7 +114,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo Permits or prohibits use of this snap-in. -- If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. +If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. @@ -184,7 +184,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo Permits or prohibits use of this snap-in. -- If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. +If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. @@ -260,7 +260,7 @@ As a result, users cannot create console files or add or remove snap-ins. Also, This setting permits users to open MMC user-mode console files, such as those on the Administrative Tools menu in Windows 2000 Server family or Windows Server 2003 family. However, users cannot open a blank MMC console window on the Start menu. (To open the MMC, click Start, click Run, and type mmc.) Users also cannot open a blank MMC console window from a command prompt. -- If you disable this setting or do not configure it, users can enter author mode and open author-mode console files. +If you disable this setting or do not configure it, users can enter author mode and open author-mode console files. diff --git a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md index b4f74ad73e..4bd4f1a4d1 100644 --- a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md +++ b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_MMCSnapins Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -2564,7 +2564,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo Permits or prohibits use of the Group Policy tab in property sheets for the Active Directory Users and Computers and Active Directory Sites and Services snap-ins. -- If you enable this setting, the Group Policy tab is displayed in the property sheet for a site, domain, or organizational unit displayed by the Active Directory Users and Computers and Active Directory Sites and Services snap-ins. If you disable the setting, the Group Policy tab is not displayed in those snap-ins. +If you enable this setting, the Group Policy tab is displayed in the property sheet for a site, domain, or organizational unit displayed by the Active Directory Users and Computers and Active Directory Sites and Services snap-ins. If you disable the setting, the Group Policy tab is not displayed in those snap-ins. If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this tab is displayed. diff --git a/windows/client-management/mdm/policy-csp-admx-msapolicy.md b/windows/client-management/mdm/policy-csp-admx-msapolicy.md index aac8c8c118..6d4c737e5b 100644 --- a/windows/client-management/mdm/policy-csp-admx-msapolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-msapolicy.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_MSAPolicy Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -43,6 +43,7 @@ ms.topic: reference This setting controls whether users can provide Microsoft accounts for authentication for applications or services. + - If this setting is enabled, all applications and services on the device are prevented from using Microsoft accounts for authentication. This applies both to existing users of a device and new users who may be added. However, any application or service that has already authenticated a user will not be affected by enabling this setting until the authentication cache expires. It is recommended to enable this setting before any user signs in to a device to prevent cached tokens from being present. diff --git a/windows/client-management/mdm/policy-csp-admx-msdt.md b/windows/client-management/mdm/policy-csp-admx-msdt.md index cdfeba781c..5dee7d69dd 100644 --- a/windows/client-management/mdm/policy-csp-admx-msdt.md +++ b/windows/client-management/mdm/policy-csp-admx-msdt.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_MSDT Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -115,6 +115,7 @@ Microsoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by These tools are required to completely troubleshoot the problem. If tool download is restricted, it may not be possible to find the root cause of the problem. - If you enable this policy setting for remote troubleshooting, MSDT prompts the user to download additional tools to diagnose problems on remote computers only. + - If you enable this policy setting for local and remote troubleshooting, MSDT always prompts for additional tool downloading. - If you disable this policy setting, MSDT never downloads tools, and is unable to diagnose problems on remote computers. diff --git a/windows/client-management/mdm/policy-csp-admx-msi.md b/windows/client-management/mdm/policy-csp-admx-msi.md index 637630abaf..6b3d9e67e1 100644 --- a/windows/client-management/mdm/policy-csp-admx-msi.md +++ b/windows/client-management/mdm/policy-csp-admx-msi.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_MSI Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -551,7 +551,7 @@ Also, see the "Enable user to use media source while elevated" and "Hide the 'Ad This policy setting restricts the use of Windows Installer. -- If you enable this policy setting, you can prevent users from installing software on their systems or permit users to install only those programs offered by a system administrator. You can use the options in the Disable Windows Installer box to establish an installation setting. +If you enable this policy setting, you can prevent users from installing software on their systems or permit users to install only those programs offered by a system administrator. You can use the options in the Disable Windows Installer box to establish an installation setting. - The "Never" option indicates Windows Installer is fully enabled. Users can install and upgrade software. This is the default behavior for Windows Installer on Windows 2000 Professional, Windows XP Professional and Windows Vista when the policy is not configured. @@ -681,7 +681,7 @@ Also, see the "Enable user to patch elevated products" policy setting. This policy setting prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation. -- If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete. +If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete. This policy setting is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this policy setting unless it is essential. @@ -743,7 +743,7 @@ This policy setting appears in the Computer Configuration and User Configuration This policy setting prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation. -- If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete. +If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete. This policy setting is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this policy setting unless it is essential. @@ -1303,7 +1303,7 @@ When you enable this policy setting, you can specify the types of events you wan To disable logging, delete all of the letters from the box. -- If you disable or do not configure this policy setting, Windows Installer logs the default event types, represented by the letters "iweap." +If you disable or do not configure this policy setting, Windows Installer logs the default event types, represented by the letters "iweap." diff --git a/windows/client-management/mdm/policy-csp-admx-nca.md b/windows/client-management/mdm/policy-csp-admx-nca.md index 3177e932ac..4f0aa3bb0a 100644 --- a/windows/client-management/mdm/policy-csp-admx-nca.md +++ b/windows/client-management/mdm/policy-csp-admx-nca.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_nca Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -56,7 +56,7 @@ We recommend that you use FQDNs instead of IPv6 addresses wherever possible. At least one of the entries must be a PING: resource. -- A Uniform Resource Locator (URL) that NCA queries with a Hypertext Transfer Protocol (HTTP) request. The contents of the web page do not matter. The syntax is "HTTP:" followed by a URL. The host portion of the URL must resolve to an IPv6 address of a Web server or contain an IPv6 address. Examples: HTTP: or HTTP:https://2002:836b:1::1/. +- A Uniform Resource Locator (URL) that NCA queries with a Hypertext Transfer Protocol (HTTP) request. The contents of the web page do not matter. The syntax is "HTTP:" followed by a URL. The host portion of the URL must resolve to an IPv6 address of a Web server or contain an IPv6 address. Examples: HTTP:https://myserver.corp.contoso.com/ or HTTP:https://2002:836b:1::1/. - A Universal Naming Convention (UNC) path to a file that NCA checks for existence. The contents of the file do not matter. The syntax is "FILE:" followed by a UNC path. The ComputerName portion of the UNC path must resolve to an IPv6 address or contain an IPv6 address. Examples: FILE:\\myserver\myshare\test.txt or FILE:\\2002:836b:1::1\myshare\test.txt. @@ -290,7 +290,7 @@ If this setting is not configured, the string that appears for DirectAccess conn Specifies whether the user has Connect and Disconnect options for the DirectAccess entry when the user clicks the Networking notification area icon. -If the user clicks the Disconnect option, NCA removes the DirectAccess rules from the Name Resolution Policy Table (NRPT) and the DirectAccess client computer uses whatever normal name resolution is available to the client computer in its current network configuration, including sending all DNS queries to the local intranet or Internet DNS servers. **Note** that NCA does not remove the existing IPsec tunnels and users can still access intranet resources across the DirectAccess server by specifying IPv6 addresses rather than names. +If the user clicks the Disconnect option, NCA removes the DirectAccess rules from the [Name Resolution Policy Table](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn593632(v=ws.11)) (NRPT) and the DirectAccess client computer uses whatever normal name resolution is available to the client computer in its current network configuration, including sending all DNS queries to the local intranet or Internet DNS servers. **Note** that NCA does not remove the existing IPsec tunnels and users can still access intranet resources across the DirectAccess server by specifying IPv6 addresses rather than names. The ability to disconnect allows users to specify single-label, unqualified names (such as "PRINTSVR") for local resources when connected to a different intranet and for temporary access to intranet resources when network location detection has not correctly determined that the DirectAccess client computer is connected to its own intranet. diff --git a/windows/client-management/mdm/policy-csp-admx-ncsi.md b/windows/client-management/mdm/policy-csp-admx-ncsi.md index 66333d0c19..24975f13e3 100644 --- a/windows/client-management/mdm/policy-csp-admx-ncsi.md +++ b/windows/client-management/mdm/policy-csp-admx-ncsi.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_NCSI Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -317,8 +317,7 @@ This policy setting enables you to specify the HTTPS URL of the corporate websit -This policy setting enables you to specify DNS binding behavior. NCSI by default will restrict DNS lookups to the interface it is currently probing on. -- If you enable this setting, NCSI will allow the DNS lookups to happen on any interface. +This policy setting enables you to specify DNS binding behavior. NCSI by default will restrict DNS lookups to the interface it is currently probing on. If you enable this setting, NCSI will allow the DNS lookups to happen on any interface. diff --git a/windows/client-management/mdm/policy-csp-admx-netlogon.md b/windows/client-management/mdm/policy-csp-admx-netlogon.md index 9656e0aa10..2b76aaec77 100644 --- a/windows/client-management/mdm/policy-csp-admx-netlogon.md +++ b/windows/client-management/mdm/policy-csp-admx-netlogon.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Netlogon Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -54,7 +54,7 @@ The allowable values for this setting result in the following behaviors: To specify this behavior in the DC Locator DNS SRV records, click Enabled, and then enter a value. The range of values is from 0 to 2. -- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. @@ -955,7 +955,7 @@ DCs configured to perform dynamic registration of the DC Locator DNS resource re To specify the Refresh Interval of the DC records, click Enabled, and then enter a value larger than 1800. This value specifies the Refresh Interval of the DC records in seconds (for example, the value 3600 is 60 minutes). -- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. @@ -1082,7 +1082,7 @@ This policy setting specifies the value for the Time-To-Live (TTL) field in SRV To specify the TTL for DC Locator DNS records, click Enabled, and then enter a value in seconds (for example, the value "900" is 15 minutes). -- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. @@ -1141,7 +1141,7 @@ This policy setting specifies the additional time for the computer to wait for t To specify the expected dial-up delay at logon, click Enabled, and then enter the desired value in seconds (for example, the value "60" is 1 minute). -- If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. +If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. @@ -1265,7 +1265,7 @@ The GC Locator DNS records and the site-specific SRV records are dynamically reg To specify the sites covered by the GC Locator DNS SRV records, click Enabled, and enter the sites' names in a space-delimited format. -- If you do not configure this policy setting, it is not applied to any GCs, and GCs use their local configuration. +If you do not configure this policy setting, it is not applied to any GCs, and GCs use their local configuration. @@ -1391,7 +1391,7 @@ The Priority field in the SRV record sets the preference for target hosts (speci To specify the Priority in the DC Locator DNS SRV resource records, click Enabled, and then enter a value. The range of values is from 0 to 65535. -- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. @@ -1452,7 +1452,7 @@ The Weight field in the SRV record can be used in addition to the Priority value To specify the Weight in the DC Locator DNS SRV records, click Enabled, and then enter a value. The range of values is from 0 to 65535. -- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. @@ -1510,6 +1510,7 @@ To specify the Weight in the DC Locator DNS SRV records, click Enabled, and then This policy setting specifies the maximum size in bytes of the log file netlogon.log in the directory %windir%\debug when logging is enabled. By default, the maximum size of the log file is 20MB. + - If you enable this policy setting, the maximum size of the log file is set to the specified size. Once this size is reached the log file is saved to netlogon.bak and netlogon.log is truncated. A reasonable value based on available storage should be specified. - If you disable or do not configure this policy setting, the default behavior occurs as indicated above. @@ -1573,7 +1574,7 @@ The application directory partition DC Locator DNS records and the site-specific To specify the sites covered by the DC Locator application directory partition-specific DNS SRV records, click Enabled, and then enter the site names in a space-delimited format. -- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. @@ -1823,7 +1824,7 @@ The allowable values for this setting result in the following behaviors: To specify this behavior, click Enabled and then enter a value. The range of values is from 1 to 2. -- If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. +If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. @@ -1949,7 +1950,7 @@ The DC Locator DNS records are dynamically registered by the Net Logon service, To specify the sites covered by the DC Locator DNS SRV records, click Enabled, and then enter the sites names in a space-delimited format. -- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. @@ -2010,7 +2011,7 @@ An Active Directory site is one or more well-connected TCP/IP subnets that allow To specify the site name for this setting, click Enabled, and then enter the site name. When the site to which a computer belongs is not specified, the computer automatically discovers its site from Active Directory. -- If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. +If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. @@ -2076,7 +2077,7 @@ By default, the SYSVOL share will grant shared read access to files on the share > [!NOTE] > The SYSVOL share is a share created by the Net Logon service for use by Group Policy clients in the domain. The default behavior of the SYSVOL share ensures that no application with only read permission to files on the sysvol share can lock the files by requesting exclusive read access, which might prevent Group Policy settings from being updated on clients in the domain. When this setting is enabled, an application that relies on the ability to lock files on the SYSVOL share with only read permission will be able to deny Group Policy clients from reading the files, and in general the availability of the SYSVOL share on the domain will be decreased. -- If you enable this policy setting, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator. +If you enable this policy setting, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator. diff --git a/windows/client-management/mdm/policy-csp-admx-networkconnections.md b/windows/client-management/mdm/policy-csp-admx-networkconnections.md index f59fcc9805..8844aca989 100644 --- a/windows/client-management/mdm/policy-csp-admx-networkconnections.md +++ b/windows/client-management/mdm/policy-csp-admx-networkconnections.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_NetworkConnections Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -544,7 +544,7 @@ Specifies whether or not the "local access only" network icon will be shown. When enabled, the icon for Internet access will be shown in the system tray even when a user is connected to a network with local access only. -- If you disable this setting or do not configure it, the "local access only" icon will be used when a user is connected to a network with local access only. +If you disable this setting or do not configure it, the "local access only" icon will be used when a user is connected to a network with local access only. @@ -950,6 +950,7 @@ This setting determines whether the Properties menu item is enabled, and thus, w > [!NOTE] > This setting takes precedence over settings that manipulate the availability of features inside the Local Area Connection Properties dialog box. + - If this setting is enabled, nothing within the properties dialog box for a LAN connection is available to users. > [!NOTE] @@ -1378,6 +1379,7 @@ This setting determines whether the Properties menu item is enabled, and thus, w > [!NOTE] > This setting takes precedence over settings that manipulate the availability of features in the Remote Access Connection Properties dialog box. + - If this setting is enabled, nothing within the properties dialog box for a remote access connection will be available to users. > [!NOTE] @@ -1445,7 +1447,7 @@ To create an all-user connection, on the Connection Availability page in the New - If you disable this setting, the Rename option is disabled for nonadministrators only. -If you do not configure the setting, only Administrators and Network Configuration Operators can rename all-user remote access connections. +- If you do not configure the setting, only Administrators and Network Configuration Operators can rename all-user remote access connections. > [!NOTE] > This setting does not apply to Administrators diff --git a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md index a4d11fa601..38fe42d808 100644 --- a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md +++ b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_OfflineFiles Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -1642,7 +1642,7 @@ Hides or displays reminder balloons, and prevents users from changing the settin Reminder balloons appear above the Offline Files icon in the notification area to notify users when they have lost the connection to a networked file and are working on a local copy of the file. Users can then decide how to proceed. -- If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them. +If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them. If you disable the setting, the system displays the reminder balloons and prevents users from hiding them. @@ -1713,7 +1713,7 @@ Hides or displays reminder balloons, and prevents users from changing the settin Reminder balloons appear above the Offline Files icon in the notification area to notify users when they have lost the connection to a networked file and are working on a local copy of the file. Users can then decide how to proceed. -- If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them. +If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them. If you disable the setting, the system displays the reminder balloons and prevents users from hiding them. @@ -1847,7 +1847,7 @@ Deletes local copies of the user's offline files when the user logs off. This setting specifies that automatically and manually cached offline files are retained only while the user is logged on to the computer. When the user logs off, the system deletes all local copies of offline files. -- If you disable this setting or do not configure it, automatically and manually cached copies are retained on the user's computer for later offline use. +If you disable this setting or do not configure it, automatically and manually cached copies are retained on the user's computer for later offline use. > [!CAUTION] > Files are not synchronized before they are deleted. Any changes to local files since the last synchronization are lost. @@ -1968,7 +1968,7 @@ This policy setting allows you to turn on economical application of administrati Determines how often reminder balloon updates appear. -- If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting. +If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting. Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the update interval. @@ -2032,7 +2032,7 @@ This setting appears in the Computer Configuration and User Configuration folder Determines how often reminder balloon updates appear. -- If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting. +If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting. Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the update interval. @@ -2744,7 +2744,7 @@ Determines whether offline files are synchonized before a computer is suspended. - If you enable this setting, offline files are synchronized whenever the computer is suspended. Setting the synchronization action to "Quick" ensures only that all files in the cache are complete. Setting the synchronization action to "Full" ensures that all cached files and folders are up-to-date with the most current version. -If you disable or do not configuring this setting, files are not synchronized when the computer is suspended. +- If you disable or do not configuring this setting, files are not synchronized when the computer is suspended. > [!NOTE] > If the computer is suspended by closing the display on a portable computer, files are not synchronized. If multiple users are logged on to the computer at the time the computer is suspended, a synchronization is not performed. @@ -2806,7 +2806,7 @@ Determines whether offline files are synchonized before a computer is suspended. - If you enable this setting, offline files are synchronized whenever the computer is suspended. Setting the synchronization action to "Quick" ensures only that all files in the cache are complete. Setting the synchronization action to "Full" ensures that all cached files and folders are up-to-date with the most current version. -If you disable or do not configuring this setting, files are not synchronized when the computer is suspended. +- If you disable or do not configuring this setting, files are not synchronized when the computer is suspended. > [!NOTE] > If the computer is suspended by closing the display on a portable computer, files are not synchronized. If multiple users are logged on to the computer at the time the computer is suspended, a synchronization is not performed. diff --git a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md index dea0b08208..f2d2d78382 100644 --- a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md +++ b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_PeerToPeerCaching Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -261,10 +261,9 @@ Hosted cache clients must trust the server certificate that is issued to the hos -This policy setting specifies whether client computers should attempt the automatic configuration of hosted cache mode by searching for hosted cache servers publishing service connection points that are associated with the client's current Active Directory site. -- If you enable this policy setting, client computers to which the policy setting is applied search for hosted cache servers using Active Directory, and will prefer both these servers and hosted cache mode rather than manual BranchCache configuration or BranchCache configuration by other group policies. +This policy setting specifies whether client computers should attempt the automatic configuration of hosted cache mode by searching for hosted cache servers publishing service connection points that are associated with the client's current Active Directory site. If you enable this policy setting, client computers to which the policy setting is applied search for hosted cache servers using Active Directory, and will prefer both these servers and hosted cache mode rather than manual BranchCache configuration or BranchCache configuration by other group policies. -- If you enable this policy setting in addition to the "Turn on BranchCache" policy setting, BranchCache clients attempt to discover hosted cache servers in the local branch office. If client computers detect hosted cache servers, hosted cache mode is turned on. If they do not detect hosted cache servers, hosted cache mode is not turned on, and the client uses any other configuration that is specified manually or by Group Policy. +If you enable this policy setting in addition to the "Turn on BranchCache" policy setting, BranchCache clients attempt to discover hosted cache servers in the local branch office. If client computers detect hosted cache servers, hosted cache mode is turned on. If they do not detect hosted cache servers, hosted cache mode is not turned on, and the client uses any other configuration that is specified manually or by Group Policy. When this policy setting is applied, the client computer performs or does not perform automatic hosted cache server discovery under the following circumstances: diff --git a/windows/client-management/mdm/policy-csp-admx-printing.md b/windows/client-management/mdm/policy-csp-admx-printing.md index b85780257a..207d96ce87 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing.md +++ b/windows/client-management/mdm/policy-csp-admx-printing.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Printing Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -242,6 +242,7 @@ Web view is affected by the "Turn on Classic Shell" and "Do not allow Folder Opt + - If you enable this policy setting, it sets the maximum number of printers (of each type) that the Add Printer wizard will display on a computer on a managed network (when the computer is able to reach a domain controller, e.g. a domain-joined laptop on a corporate network.) - If this policy setting is disabled, the network scan page will not be displayed. @@ -258,6 +259,7 @@ In order to view available Web Services printers on your network, ensure that ne If you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0. In Windows 10 and later, only TCP/IP printers can be shown in the wizard. + - If you enable this policy setting, only TCP/IP printer limits are applicable. On Windows 10 only, if you disable or do not configure this policy setting, the default limit is applied. In Windows 8 and later, Bluetooth printers are not shown so its limit does not apply to those versions of Windows. @@ -577,7 +579,7 @@ Adds a link to an Internet or intranet Web page to the Add Printer Wizard. You can use this setting to direct users to a Web page from which they can install printers. -- If you enable this setting and type an Internet or intranet address in the text box, the system adds a Browse button to the "Specify a Printer" page in the Add Printer Wizard. The Browse button appears beside the "Connect to a printer on the Internet or on a home or office network" option. When users click Browse, the system opens an Internet browser and navigates to the specified URL address to display the available printers. +If you enable this setting and type an Internet or intranet address in the text box, the system adds a Browse button to the "Specify a Printer" page in the Add Printer Wizard. The Browse button appears beside the "Connect to a printer on the Internet or on a home or office network" option. When users click Browse, the system opens an Internet browser and navigates to the specified URL address to display the available printers. This setting makes it easy for users to find the printers you want them to add. @@ -823,13 +825,14 @@ Microsoft XPS Document Writer (MXDW) generates OpenXPS (*.oxps) files by default + - If this policy setting is enabled, it prevents users from deleting local and network printers. If a user tries to delete a printer, such as by using the Delete option in Printers in Control Panel, a message appears explaining that a setting prevents the action. This setting does not prevent users from running other programs to delete a printer. -If this policy is disabled, or not configured, users can delete printers using the methods described above. +- If this policy is disabled, or not configured, users can delete printers using the methods described above. @@ -898,6 +901,7 @@ Shared printers: 50 If you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0. In Windows 10 and later, only TCP/IP printers can be shown in the wizard. + - If you enable this policy setting, only TCP/IP printer limits are applicable. On Windows 10 only, if you disable or do not configure this policy setting, the default limit is applied. In Windows 8 and later, Bluetooth printers are not shown so its limit does not apply to those versions of Windows. @@ -1204,6 +1208,7 @@ Windows Vista and later clients will attempt to make a non-package point and pri + - If this policy setting is enabled, it specifies the default location criteria used when searching for printers. This setting is a component of the Location Tracking feature of Windows printers. To use this setting, enable Location Tracking by enabling the "Pre-populate printer search location text" setting. @@ -1463,7 +1468,7 @@ Specifies the Active Directory location where searches for printers begin. The Add Printer Wizard gives users the option of searching Active Directory for a shared printer. -- If you enable this policy setting, these searches begin at the location you specify in the "Default Active Directory path" box. Otherwise, searches begin at the root of Active Directory. +If you enable this policy setting, these searches begin at the location you specify in the "Default Active Directory path" box. Otherwise, searches begin at the root of Active Directory. This setting only provides a starting point for Active Directory searches for printers. It does not restrict user searches through Active Directory. diff --git a/windows/client-management/mdm/policy-csp-admx-printing2.md b/windows/client-management/mdm/policy-csp-admx-printing2.md index dd69376114..1d78b2f09e 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing2.md +++ b/windows/client-management/mdm/policy-csp-admx-printing2.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Printing2 Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -251,7 +251,7 @@ By default, the pruning service contacts computers every eight hours and allows - If you enable this setting, you can change the interval between contact attempts. -If you do not configure or disable this setting the default values will be used. +- If you do not configure or disable this setting the default values will be used. > [!NOTE] > This setting is used only on domain controllers. @@ -381,7 +381,7 @@ By default, the pruning service contacts computers every eight hours and allows - If you enable this setting, you can change the interval between attempts. -If you do not configure or disable this setting, the default values are used. +- If you do not configure or disable this setting, the default values are used. > [!NOTE] > This setting is used only on domain controllers. diff --git a/windows/client-management/mdm/policy-csp-admx-programs.md b/windows/client-management/mdm/policy-csp-admx-programs.md index 1d7a70b423..da10e25a17 100644 --- a/windows/client-management/mdm/policy-csp-admx-programs.md +++ b/windows/client-management/mdm/policy-csp-admx-programs.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Programs Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -46,7 +46,7 @@ This setting removes the Set Program Access and Defaults page from the Programs The Set Program Access and Computer Defaults page allows administrators to specify default programs for certain activities, such as Web browsing or sending e-mail, as well as specify the programs that are accessible from the Start menu, desktop, and other locations. -- If this setting is disabled or not configured, the Set Program Access and Defaults button is available to all users. +If this setting is disabled or not configured, the Set Program Access and Defaults button is available to all users. This setting does not prevent users from using other tools and methods to change program access or defaults. @@ -177,7 +177,7 @@ This setting prevents users from accessing "Installed Updates" page from the "Vi "Installed Updates" allows users to view and uninstall updates currently installed on the computer. The updates are often downloaded directly from Windows Update or from various program publishers. -- If this setting is disabled or not configured, the "View installed updates" task and the "Installed Updates" page will be available to all users. +If this setting is disabled or not configured, the "View installed updates" task and the "Installed Updates" page will be available to all users. This setting does not prevent users from using other tools and methods to install or uninstall programs. @@ -237,7 +237,7 @@ This setting does not prevent users from using other tools and methods to instal This setting prevents users from accessing "Programs and Features" to view, uninstall, change, or repair programs that are currently installed on the computer. -- If this setting is disabled or not configured, "Programs and Features" will be available to all users. +If this setting is disabled or not configured, "Programs and Features" will be available to all users. This setting does not prevent users from using other tools and methods to view or uninstall programs. It also does not prevent users from linking to related Programs Control Panel Features including Windows Features, Get Programs, or Windows Marketplace. @@ -299,7 +299,7 @@ This setting prevents users from using the Programs Control Panel in Category Vi The Programs Control Panel allows users to uninstall, change, and repair programs, enable and disable Windows Features, set program defaults, view installed updates, and purchase software from Windows Marketplace. Programs published or assigned to the user by the system administrator also appear in the Programs Control Panel. -- If this setting is disabled or not configured, the Programs Control Panel in Category View and Programs and Features in Classic View will be available to all users. +If this setting is disabled or not configured, the Programs Control Panel in Category View and Programs and Features in Classic View will be available to all users. When enabled, this setting takes precedence over the other settings in this folder. @@ -361,7 +361,7 @@ This setting does not prevent users from using other tools and methods to instal This setting prevents users from accessing the "Turn Windows features on or off" task from the Programs Control Panel in Category View, Programs and Features in Classic View, and Get Programs. As a result, users cannot view, enable, or disable various Windows features and services. -- If this setting is disabled or is not configured, the "Turn Windows features on or off" task will be available to all users. +If this setting is disabled or is not configured, the "Turn Windows features on or off" task will be available to all users. This setting does not prevent users from using other tools and methods to configure services or enable or disable program components. diff --git a/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md b/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md index a2094c9c4e..812ee0a71e 100644 --- a/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md +++ b/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_PushToInstall Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -42,7 +42,7 @@ ms.topic: reference -- If you enable this setting, users will not be able to push Apps to this device from the Microsoft Store running on other devices or the web. +If you enable this setting, users will not be able to push Apps to this device from the Microsoft Store running on other devices or the web. diff --git a/windows/client-management/mdm/policy-csp-admx-rpc.md b/windows/client-management/mdm/policy-csp-admx-rpc.md index b37b7eb63d..ca1428aae4 100644 --- a/windows/client-management/mdm/policy-csp-admx-rpc.md +++ b/windows/client-management/mdm/policy-csp-admx-rpc.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_RPC Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -273,7 +273,7 @@ This policy setting determines whether the RPC Runtime maintains RPC state infor - If you enable this policy setting, you can use the drop-down box to determine which systems maintain RPC state information. -- "None" indicates that the system does not maintain any RPC state information +- "None" indicates that the system does not maintain any RPC state information. > [!NOTE] > Because the basic state information required for troubleshooting has a negligible effect on performance and uses only about 4K of memory, this setting is not recommended for most installations. diff --git a/windows/client-management/mdm/policy-csp-admx-sam.md b/windows/client-management/mdm/policy-csp-admx-sam.md index 3a57924050..1dc3a07841 100644 --- a/windows/client-management/mdm/policy-csp-admx-sam.md +++ b/windows/client-management/mdm/policy-csp-admx-sam.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_sam Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,19 +44,19 @@ ms.topic: reference This policy setting allows you to configure how domain controllers handle Windows Hello for Business (WHfB) keys that are vulnerable to the "Return of Coppersmith's attack" (ROCA) vulnerability. -For more information on the ROCA vulnerability, please see +For more information on the ROCA vulnerability, please see: - + - + -- If you enable this policy setting the following options are supported +If you enable this policy setting the following options are supported: -Ignore during authentication the domain controller will not probe any WHfB keys for the ROCA vulnerability. +Ignore: during authentication the domain controller will not probe any WHfB keys for the ROCA vulnerability. -Audit during authentication the domain controller will emit audit events for WHfB keys that are subject to the ROCA vulnerability (authentications will still succeed). +Audit: during authentication the domain controller will emit audit events for WHfB keys that are subject to the ROCA vulnerability (authentications will still succeed). -Block during authentication the domain controller will block the use of WHfB keys that are subject to the ROCA vulnerability (authentications will fail). +Block: during authentication the domain controller will block the use of WHfB keys that are subject to the ROCA vulnerability (authentications will fail). This setting only takes effect on domain controllers. @@ -66,7 +66,7 @@ A reboot is not required for changes to this setting to take effect. **Note** to avoid unexpected disruptions this setting should not be set to Block until appropriate mitigations have been performed, for example patching of vulnerable TPMs. -More information is available at . +More information is available at< https://go.microsoft.com/fwlink/?linkid=2116430>. diff --git a/windows/client-management/mdm/policy-csp-admx-settingsync.md b/windows/client-management/mdm/policy-csp-admx-settingsync.md index 4525405908..3eb2672ba9 100644 --- a/windows/client-management/mdm/policy-csp-admx-settingsync.md +++ b/windows/client-management/mdm/policy-csp-admx-settingsync.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_SettingSync Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference Prevent the "app settings" group from syncing to and from this PC. This turns off and disables the "app settings" group on the "sync your settings" page in PC settings. -- If you enable this policy setting, the "app settings" group will not be synced. +If you enable this policy setting, the "app settings" group will not be synced. Use the option "Allow users to turn app settings syncing on" so that syncing it turned off by default but not disabled. @@ -106,7 +106,7 @@ If you do not set or disable this setting, syncing of the "app settings" group i Prevent the "AppSync" group from syncing to and from this PC. This turns off and disables the "AppSync" group on the "sync your settings" page in PC settings. -- If you enable this policy setting, the "AppSync" group will not be synced. +If you enable this policy setting, the "AppSync" group will not be synced. Use the option "Allow users to turn app syncing on" so that syncing it turned off by default but not disabled. @@ -168,7 +168,7 @@ If you do not set or disable this setting, syncing of the "AppSync" group is on Prevent the "passwords" group from syncing to and from this PC. This turns off and disables the "passwords" group on the "sync your settings" page in PC settings. -- If you enable this policy setting, the "passwords" group will not be synced. +If you enable this policy setting, the "passwords" group will not be synced. Use the option "Allow users to turn passwords syncing on" so that syncing it turned off by default but not disabled. @@ -230,7 +230,7 @@ If you do not set or disable this setting, syncing of the "passwords" group is o Prevent the "desktop personalization" group from syncing to and from this PC. This turns off and disables the "desktop personalization" group on the "sync your settings" page in PC settings. -- If you enable this policy setting, the "desktop personalization" group will not be synced. +If you enable this policy setting, the "desktop personalization" group will not be synced. Use the option "Allow users to turn desktop personalization syncing on" so that syncing it turned off by default but not disabled. @@ -292,7 +292,7 @@ If you do not set or disable this setting, syncing of the "desktop personalizati Prevent the "personalize" group from syncing to and from this PC. This turns off and disables the "personalize" group on the "sync your settings" page in PC settings. -- If you enable this policy setting, the "personalize" group will not be synced. +If you enable this policy setting, the "personalize" group will not be synced. Use the option "Allow users to turn personalize syncing on" so that syncing it turned off by default but not disabled. @@ -354,7 +354,7 @@ If you do not set or disable this setting, syncing of the "personalize" group is Prevent syncing to and from this PC. This turns off and disables the "sync your settings" switch on the "sync your settings" page in PC Settings. -- If you enable this policy setting, "sync your settings" will be turned off, and none of the "sync your setting" groups will be synced on this PC. +If you enable this policy setting, "sync your settings" will be turned off, and none of the "sync your setting" groups will be synced on this PC. Use the option "Allow users to turn syncing on" so that syncing it turned off by default but not disabled. @@ -416,7 +416,7 @@ If you do not set or disable this setting, "sync your settings" is on by default Prevent the "Start layout" group from syncing to and from this PC. This turns off and disables the "Start layout" group on the "sync your settings" page in PC settings. -- If you enable this policy setting, the "Start layout" group will not be synced. +If you enable this policy setting, the "Start layout" group will not be synced. Use the option "Allow users to turn start syncing on" so that syncing is turned off by default but not disabled. @@ -478,7 +478,7 @@ If you do not set or disable this setting, syncing of the "Start layout" group i Prevent syncing to and from this PC when on metered Internet connections. This turns off and disables "sync your settings on metered connections" switch on the "sync your settings" page in PC Settings. -- If you enable this policy setting, syncing on metered connections will be turned off, and no syncing will take place when this PC is on a metered connection. +If you enable this policy setting, syncing on metered connections will be turned off, and no syncing will take place when this PC is on a metered connection. If you do not set or disable this setting, syncing on metered connections is configurable by the user. @@ -538,7 +538,7 @@ If you do not set or disable this setting, syncing on metered connections is con Prevent the "Other Windows settings" group from syncing to and from this PC. This turns off and disables the "Other Windows settings" group on the "sync your settings" page in PC settings. -- If you enable this policy setting, the "Other Windows settings" group will not be synced. +If you enable this policy setting, the "Other Windows settings" group will not be synced. Use the option "Allow users to turn other Windows settings syncing on" so that syncing it turned off by default but not disabled. diff --git a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md index 0380f886fb..fbc5c518ac 100644 --- a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md +++ b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_SharedFolders Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -31,7 +31,7 @@ ms.topic: reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -46,7 +46,7 @@ This policy setting determines whether the user can publish DFS roots in Active - If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option to publish DFS roots as shared folders in AD DS . -- If you disable this policy setting, users cannot publish DFS roots in AD DS and the "Publish in Active Directory" option is disabled +- If you disable this policy setting, users cannot publish DFS roots in AD DS and the "Publish in Active Directory" option is disabled. > [!NOTE] > The default is to allow shared folders to be published when this setting is not configured. @@ -109,7 +109,7 @@ This policy setting determines whether the user can publish shared folders in Ac - If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option in the Shared Folders snap-in to publish shared folders in AD DS. -- If you disable this policy setting, users cannot publish shared folders in AD DS, and the "Publish in Active Directory" option is disabled +- If you disable this policy setting, users cannot publish shared folders in AD DS, and the "Publish in Active Directory" option is disabled. > [!NOTE] > The default is to allow shared folders to be published when this setting is not configured. diff --git a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md index d51369a170..e438a375db 100644 --- a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md +++ b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_ShellCommandPromptRegEditTools Area in Po author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -175,6 +175,7 @@ This policy setting only prevents users from running programs that are started b > [!NOTE] > Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. + > [!NOTE] > To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (e.g., Winword.exe, Poledit.exe, Powerpnt.exe). @@ -242,6 +243,7 @@ This policy setting only prevents users from running programs that are started b > [!NOTE] > Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. + > [!NOTE] > To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (e.g., Winword.exe, Poledit.exe, Powerpnt.exe). diff --git a/windows/client-management/mdm/policy-csp-admx-smartcard.md b/windows/client-management/mdm/policy-csp-admx-smartcard.md index ddfeafcb32..9cc16c1696 100644 --- a/windows/client-management/mdm/policy-csp-admx-smartcard.md +++ b/windows/client-management/mdm/policy-csp-admx-smartcard.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Smartcard Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/23/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -352,6 +352,7 @@ This policy setting allows you to manage the certificate propagation that occurs This policy setting allows you to manage the clean up behavior of root certificates. + - If you enable this policy setting then root certificate cleanup will occur according to the option selected. - If you disable or do not configure this setting then root certificate clean up will occur on log off. @@ -413,7 +414,7 @@ This policy setting allows you to manage the root certificate propagation that o - If you enable or do not configure this policy setting then root certificate propagation will occur when you insert your smart card. > [!NOTE] -> For this policy setting to work the following policy setting must also be enabled Turn on certificate propagation from smart card. +> For this policy setting to work the following policy setting must also be enabled: Turn on certificate propagation from smart card. - If you disable this policy setting then root certificates will not be propagated from the smart card. @@ -542,6 +543,7 @@ This policy setting allows you to control whether elliptic curve cryptography (E > [!NOTE] > This policy setting only affects a user's ability to log on to a domain. ECC certificates on a smart card that are used for other applications, such as document signing, are not affected by this policy setting. + > [!NOTE] > If you use an ECDSA key to log on, you must also have an associated ECDH key to permit logons when you are not connected to the network. @@ -606,7 +608,7 @@ During the certificate renewal period, a user can have multiple valid logon cert If there are two or more of the "same" certificate on a smart card and this policy is enabled then the certificate that is used for logon on Windows 2000, Windows XP, and Windows 2003 Server will be shown, otherwise the the certificate with the expiration time furthest in the future will be shown. > [!NOTE] -> This setting will be applied after the following policy "Allow time invalid certificates" +> This setting will be applied after the following policy: "Allow time invalid certificates" - If you enable or do not configure this policy setting, filtering will take place. @@ -794,7 +796,7 @@ This policy setting lets you reverse the subject name from how it is stored in t By default the user principal name (UPN) is displayed in addition to the common name to help users distinguish one certificate from another. For example, if the certificate subject was CN=User1, OU=Users, DN=example, DN=com and had an UPN of user1@example.com then "User1" will be displayed along with "user1@example.com." If the UPN is not present then the entire subject name will be displayed. This setting controls the appearance of that subject name and might need to be adjusted per organization. -- If you enable this policy setting or do not configure this setting, then the subject name will be reversed. +If you enable this policy setting or do not configure this setting, then the subject name will be reversed. If you disable , the subject name will be displayed as it appears in the certificate. diff --git a/windows/client-management/mdm/policy-csp-admx-srmfci.md b/windows/client-management/mdm/policy-csp-admx-srmfci.md index 11e6d2fff2..cce101b264 100644 --- a/windows/client-management/mdm/policy-csp-admx-srmfci.md +++ b/windows/client-management/mdm/policy-csp-admx-srmfci.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_srmfci Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -227,7 +227,7 @@ The Classification tab enables users to manually classify files by selecting pro -This Group Policy Setting should be set on Windows clients to enable access-denied assistance for all file types +This Group Policy Setting should be set on Windows clients to enable access-denied assistance for all file types. diff --git a/windows/client-management/mdm/policy-csp-admx-startmenu.md b/windows/client-management/mdm/policy-csp-admx-startmenu.md index b4ffcc734a..39837aa6f0 100644 --- a/windows/client-management/mdm/policy-csp-admx-startmenu.md +++ b/windows/client-management/mdm/policy-csp-admx-startmenu.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_StartMenu Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -42,6 +42,7 @@ ms.topic: reference + - If you enable this policy, a "Search the Internet" link is shown when the user performs a search in the start menu search box. This button launches the default browser with the search terms. - If you disable this policy, there will not be a "Search the Internet" link when the user performs a search in the start menu search box. @@ -173,6 +174,7 @@ This policy also does not clear items that the user may have pinned to the Jump + - If you enable this policy setting, the recent programs list in the start menu will be blank for each new user. - If you disable or do not configure this policy, the start menu recent programs list will be pre-populated with programs for each new user. @@ -231,6 +233,7 @@ This policy also does not clear items that the user may have pinned to the Jump + - If you enable this setting, the system deletes tile notifications when the user logs on. As a result, the Tiles in the start view will always show their default content when the user logs on. In addition, any cached versions of these notifications will be cleared when the user logs on. - If you disable or do not configure this setting, the system retains notifications, and when a user logs on, the tiles appear just as they did when the user logged off, including the history of previous notifications for each tile. @@ -550,7 +553,7 @@ This setting makes it easier for users to distinguish between programs that are Partially installed programs include those that a system administrator assigns using Windows Installer and those that users have configured for full installation upon first use. -- If you disable this setting or do not configure it, all Start menu shortcuts appear as black text. +If you disable this setting or do not configure it, all Start menu shortcuts appear as black text. > [!NOTE] > Enabling this setting can make the Start menu slow to open. @@ -673,7 +676,7 @@ Disables personalized menus. Windows personalizes long menus by moving recently used items to the top of the menu and hiding items that have not been used recently. Users can display the hidden items by clicking an arrow to extend the menu. -- If you enable this setting, the system does not personalize menus. All menu items appear and remain in standard order. Also, this setting removes the "Use Personalized Menus" option so users do not try to change the setting while a setting is in effect. +If you enable this setting, the system does not personalize menus. All menu items appear and remain in standard order. Also, this setting removes the "Use Personalized Menus" option so users do not try to change the setting while a setting is in effect. > [!NOTE] > Personalized menus require user tracking. If you enable the "Turn off user tracking" setting, the system disables user tracking and personalized menus and ignores this setting. @@ -868,7 +871,7 @@ The notification area is located in the task bar, generally at the bottom of the - If you disable this setting, the system notification area will always collapse notifications. -If you do not configure it, the user can choose if they want notifications collapsed. +- If you do not configure it, the user can choose if they want notifications collapsed. @@ -1115,8 +1118,7 @@ This policy setting prevents users from performing the following commands from t Removes items in the All Users profile from the Programs menu on the Start menu. -By default, the Programs menu contains items from the All Users profile and items from the user's profile. -- If you enable this setting, only items in the user's profile appear in the Programs menu. +By default, the Programs menu contains items from the All Users profile and items from the user's profile. If you enable this setting, only items in the user's profile appear in the Programs menu. > [!TIP] > To see the Program menu items in the All Users profile, on the system drive, go to ProgramData\Microsoft\Windows\Start Menu\Programs. @@ -1311,6 +1313,7 @@ This policy setting affects the specified user interface elements only. It does + - If you enable this policy the start menu will not show a link to the Games folder. - If you disable or do not configure this policy, the start menu will show a link to the Games folder, unless the user chooses to remove it in the start menu control panel. @@ -1499,6 +1502,7 @@ This policy setting does not prevent users from pinning programs to the Start Me + - If you enable this setting, the Start Menu will either collapse or remove the all apps list from the Start menu. Selecting "Collapse" will not display the app list next to the pinned tiles in Start. An "All apps" button will be displayed on Start to open the all apps list. This is equivalent to setting the "Show app list in Start" in Settings to Off. @@ -1628,6 +1632,7 @@ Also, see the "Disable programs on Settings menu" and "Disable Control Panel" po + - If you enable this setting, the "Pinned Programs" list is removed from the Start menu. Users cannot pin programs to the Start menu. In Windows XP and Windows Vista, the Internet and email checkboxes are removed from the 'Customize Start Menu' dialog. @@ -1692,7 +1697,7 @@ Removes the Recent Items menu from the Start menu. Removes the Documents menu fr The Recent Items menu contains links to the non-program files that users have most recently opened. It appears so that users can easily reopen their documents. -- If you enable this setting, the system saves document shortcuts but does not display the Recent Items menu in the Start Menu, and users cannot turn the menu on. +If you enable this setting, the system saves document shortcuts but does not display the Recent Items menu in the Start Menu, and users cannot turn the menu on. If you later disable the setting, so that the Recent Items menu appears in the Start Menu, the document shortcuts saved before the setting was enabled and while it was in effect appear in the Recent Items menu. @@ -1973,6 +1978,7 @@ Also, users with extended keyboards will no longer be able to display the Run di + - If you enable this policy the start menu search box will not search for communications. - If you disable or do not configure this policy, the start menu will search for communications, unless the user chooses not to in the start menu control panel. @@ -2031,6 +2037,7 @@ Also, users with extended keyboards will no longer be able to display the Run di + - If you enable this policy, the "See all results" link will not be shown when the user performs a search in the start menu search box. - If you disable or do not configure this policy, the "See all results" link will be shown when the user performs a search in the start menu search box. @@ -2089,6 +2096,7 @@ Also, users with extended keyboards will no longer be able to display the Run di + - If you enable this policy, a "See more results" / "Search Everywhere" link will not be shown when the user performs a search in the start menu search box. - If you disable or do not configure this policy, a "See more results" link will be shown when the user performs a search in the start menu search box. If a 3rd party protocol handler is installed, a "Search Everywhere" link will be shown instead of the "See more results" link. @@ -2147,9 +2155,11 @@ Also, users with extended keyboards will no longer be able to display the Run di + - If you enable this policy setting the Start menu search box will not search for files. - If you disable or do not configure this policy setting, the Start menu will search for files, unless the user chooses not to do so directly in Control Panel. + - If you enable this policy, a "See more results" / "Search Everywhere" link will not be shown when the user performs a search in the start menu search box. @@ -2206,6 +2216,7 @@ Also, users with extended keyboards will no longer be able to display the Run di + - If you enable this policy the start menu search box will not search for internet history or favorites. - If you disable or do not configure this policy, the start menu will search for for internet history or favorites, unless the user chooses not to in the start menu control panel. @@ -2264,6 +2275,7 @@ Also, users with extended keyboards will no longer be able to display the Run di + - If you enable this policy setting the Start menu search box will not search for programs or Control Panel items. - If you disable or do not configure this policy setting, the Start menu search box will search for programs and Control Panel items, unless the user chooses not to do so directly in Control Panel. @@ -2822,6 +2834,7 @@ This policy setting allows you to remove the Downloads link from the Start Menu. + - If you enable this policy the Start menu will not show a link to Homegroup. It also removes the homegroup item from the Start Menu options. As a result, users cannot add the homegroup link to the Start Menu. - If you disable or do not configure this policy, users can use the Start Menu options to add or remove the homegroup link from the Start Menu. @@ -3194,7 +3207,7 @@ Taskbar grouping consolidates similar applications when there is no room on the - If you enable this setting, it prevents the taskbar from grouping items that share the same program name. By default, this setting is always enabled. -If you disable or do not configure it, items on the taskbar that share the same program are grouped together. The users have the option to disable grouping if they choose. +- If you disable or do not configure it, items on the taskbar that share the same program are grouped together. The users have the option to disable grouping if they choose. @@ -3447,9 +3460,10 @@ Description: The notification area is located at the far right end of the task b + - If you enable this setting, users cannot uninstall apps from Start. -- If you disable this setting or do not configure it, users can access the uninstall command from Start +- If you disable this setting or do not configure it, users can access the uninstall command from Start. @@ -3505,6 +3519,7 @@ Description: The notification area is located at the far right end of the task b + - If you enable this policy the start menu will not show a link to the user's storage folder. - If you disable or do not configure this policy, the start menu will display a link, unless the user chooses to remove it in the start menu control panel. @@ -3629,7 +3644,7 @@ This policy setting allows you to remove links and access to Windows Update. - If you enable this policy setting, users are prevented from connecting to the Windows Update Web site. -Enabling this policy setting blocks user access to the Windows Update Web site at . Also, the policy setting removes the Windows Update hyperlink from the Start menu and from the Tools menu in Internet Explorer. +Enabling this policy setting blocks user access to the Windows Update Web site at< https://windowsupdate.microsoft.com>. Also, the policy setting removes the Windows Update hyperlink from the Start menu and from the Tools menu in Internet Explorer. Windows Update, the online extension of Windows, offers software updates to keep a user's system up-to-date. The Windows Update Product Catalog determines any system files, security fixes, and Microsoft updates that users need and shows the newest versions available for download. @@ -3814,6 +3829,7 @@ This policy setting controls whether the QuickLaunch bar is displayed in the Tas + - If you enable this setting, the "Undock PC" button is removed from the simple Start Menu, and your PC cannot be undocked. - If you disable this setting or do not configure it, the "Undock PC" button remains on the simple Start menu, and your PC can be undocked. @@ -3995,6 +4011,7 @@ This policy setting shows or hides the "Run as different user" command on the St + - If you enable this setting, the Run command is added to the Start menu. - If you disable or do not configure this setting, the Run command is not visible on the Start menu by default, but it can be added from the Taskbar and Start menu properties. If the Remove Run link from Start Menu policy is set, the Add the Run command to the Start menu policy has no effect. diff --git a/windows/client-management/mdm/policy-csp-admx-taskbar.md b/windows/client-management/mdm/policy-csp-admx-taskbar.md index d5babf1d77..5324e13ac0 100644 --- a/windows/client-management/mdm/policy-csp-admx-taskbar.md +++ b/windows/client-management/mdm/policy-csp-admx-taskbar.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Taskbar Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -416,7 +416,7 @@ This policy setting allows you to remove the volume control icon from the system This policy setting allows you to turn off feature advertisement balloon notifications. -- If you enable this policy setting, certain notification balloons that are marked as feature advertisements are not shown. +If you enable this policy setting, certain notification balloons that are marked as feature advertisements are not shown. If you disable do not configure this policy setting, feature advertisement balloons are shown. diff --git a/windows/client-management/mdm/policy-csp-admx-tcpip.md b/windows/client-management/mdm/policy-csp-admx-tcpip.md index a0b38a0dd1..07885bdc4a 100644 --- a/windows/client-management/mdm/policy-csp-admx-tcpip.md +++ b/windows/client-management/mdm/policy-csp-admx-tcpip.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_tcpip Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -535,7 +535,7 @@ This policy setting allows you to select the UDP port the Teredo client will use This policy setting allows you to set Teredo to be ready to communicate, a process referred to as qualification. By default, Teredo enters a dormant state when not in use. The qualification process brings it out of a dormant state. -- If you disable or do not configure this policy setting, the local host setting is used. +If you disable or do not configure this policy setting, the local host setting is used. This policy setting contains only one state: diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index e293e8cf71..31bdd76413 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_TerminalServer Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -239,7 +239,8 @@ This policy setting allows you to specify whether users can run Remote Desktop P - If you disable this policy setting, users cannot run .rdp files that are signed with a valid certificate. Additionally, users cannot start an RDP session by directly opening the RDC client and specifying the remote computer name. When a user tries to start an RDP session, the user receives a message that the publisher has been blocked. > [!NOTE] -> You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, all users on the computer are affected. +> You can define this policy setting in the Computer Configuration node or in the User Configuration node. +- If you configure this policy setting for the computer, all users on the computer are affected. @@ -302,7 +303,8 @@ This policy setting allows you to specify whether users can run Remote Desktop P - If you disable this policy setting, users cannot run .rdp files that are signed with a valid certificate. Additionally, users cannot start an RDP session by directly opening the RDC client and specifying the remote computer name. When a user tries to start an RDP session, the user receives a message that the publisher has been blocked. > [!NOTE] -> You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, all users on the computer are affected. +> You can define this policy setting in the Computer Configuration node or in the User Configuration node. +- If you configure this policy setting for the computer, all users on the computer are affected. @@ -863,8 +865,7 @@ By default, Remote Desktop Services automatically designates the client default -This policy setting specifies whether the Remote Desktop Connection can use hardware acceleration if supported hardware is available. If you use this setting, the Remote Desktop Client will use only software decoding. For example, if you have a problem that you suspect may be related to hardware acceleration, use this setting to disable the acceleration; then, if the problem still occurs, you will know that there are additional issues to investigate. -- If you disable this setting or leave it not configured, the Remote Desktop client will use hardware accelerated decoding if supported hardware is available. +This policy setting specifies whether the Remote Desktop Connection can use hardware acceleration if supported hardware is available. If you use this setting, the Remote Desktop Client will use only software decoding. For example, if you have a problem that you suspect may be related to hardware acceleration, use this setting to disable the acceleration; then, if the problem still occurs, you will know that there are additional issues to investigate. If you disable this setting or leave it not configured, the Remote Desktop client will use hardware accelerated decoding if supported hardware is available. @@ -924,7 +925,7 @@ Controls whether a user can save passwords using Remote Desktop Connection. - If you enable this setting the credential saving checkbox in Remote Desktop Connection will be disabled and users will no longer be able to save passwords. When a user opens an RDP file using Remote Desktop Connection and saves his settings, any password that previously existed in the RDP file will be deleted. -- If you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection +- If you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection. @@ -1182,7 +1183,8 @@ This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA **Note**: -You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user. +You can define this policy setting in the Computer Configuration node or in the User Configuration node. +- If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user. This policy setting overrides the behavior of the "Allow .rdp files from valid publishers and user's default .rdp settings" policy setting. @@ -1249,7 +1251,8 @@ This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA **Note**: -You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user. +You can define this policy setting in the Computer Configuration node or in the User Configuration node. +- If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user. This policy setting overrides the behavior of the "Allow .rdp files from valid publishers and user's default .rdp settings" policy setting. @@ -1579,7 +1582,8 @@ This policy setting enables system administrators to change the graphics renderi - If you do not configure this policy setting, Remote Desktop Services sessions on the RD Session Host server use the Microsoft Basic Render Driver as the default adapter. In all other cases, Remote Desktop Services sessions use the hardware graphics renderer by default. -NOTE: The policy setting enables load-balancing of graphics processing units (GPU) on a computer with more than one GPU installed. The GPU configuration of the local session is not affected by this policy setting. +> [!NOTE] +> The policy setting enables load-balancing of graphics processing units (GPU) on a computer with more than one GPU installed. The GPU configuration of the local session is not affected by this policy setting. @@ -1971,7 +1975,7 @@ Specifies the authentication method that clients must use when attempting to con To allow users to overwrite this policy setting, select the "Allow users to change this setting" check box. When you do this, users can specify an alternate authentication method by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify an alternate authentication method, the authentication method that you specify in this policy setting is used by default. -- If you disable or do not configure this policy setting, the authentication method that is specified by the user is used, if one is specified. If an authentication method is not specified, the Negotiate protocol that is enabled on the client or a smart card can be used for authentication. +If you disable or do not configure this policy setting, the authentication method that is specified by the user is used, if one is specified. If an authentication method is not specified, the Negotiate protocol that is enabled on the client or a smart card can be used for authentication. @@ -2026,6 +2030,7 @@ To allow users to overwrite this policy setting, select the "Allow users to chan + - If you enable this policy setting, when Remote Desktop Connection cannot connect directly to a remote computer (an RD Session Host server or a computer with Remote Desktop enabled), the clients will attempt to connect to the remote computer through an RD Gateway server. In this case, the clients will attempt to connect to the RD Gateway server that is specified in the "Set RD Gateway server address" policy setting. You can enforce this policy setting or you can allow users to overwrite this setting. By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these RD Gateway server settings" option on the client. @@ -2165,6 +2170,7 @@ If the policy setting is not configured, the policy setting is not specified at **Note**: 1. + - If you enable this policy setting, you must also enable the Configure RD Connection Broker farm name and Configure RD Connection Broker server name policy settings. 2. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. @@ -2982,7 +2988,7 @@ This policy setting determines whether a user will be prompted on the client com This policy setting specifies the default connection URL for RemoteApp and Desktop Connections. The default connection URL is a specific connection that can only be configured by using Group Policy. In addition to the capabilities that are common to all connections, the default connection URL allows document file types to be associated with RemoteApp programs. -The default connection URL must be configured in the form of . +The default connection URL must be configured in the form of< https://contoso.com/rdweb/Feed/webfeed.aspx>. - If you enable this policy setting, the specified URL is configured as the default connection URL for the user and replaces any existing connection URL. The user cannot change the default connection URL. The user's default logon credentials are used when setting up the default connection URL. @@ -3106,6 +3112,7 @@ By default, when a new user signs in to a computer, the Start screen is shown an + - If you enable this policy setting, administrators can interact with a user's Remote Desktop Services session based on the option selected. Select the desired level of control and permission from the options list: 1. No remote control allowed: Disallows an administrator to use remote control or view a remote user session. @@ -3171,6 +3178,7 @@ By default, when a new user signs in to a computer, the Start screen is shown an + - If you enable this policy setting, administrators can interact with a user's Remote Desktop Services session based on the option selected. Select the desired level of control and permission from the options list: 1. No remote control allowed: Disallows an administrator to use remote control or view a remote user session. @@ -3242,8 +3250,7 @@ Depending on the requirements of your users, you can reduce network bandwidth us If you have a higher than average bandwidth network, you can maximize the utilization of bandwidth by selecting the highest setting for screen capture rate and the highest setting for image quality. -By default, Remote Desktop Connection sessions that use RemoteFX are optimized for a balanced experience over LAN conditions. -- If you disable or do not configure this policy setting, Remote Desktop Connection sessions that use RemoteFX will be the same as if the medium screen capture rate and the medium image compression settings were selected (the default behavior). +By default, Remote Desktop Connection sessions that use RemoteFX are optimized for a balanced experience over LAN conditions. If you disable or do not configure this policy setting, Remote Desktop Connection sessions that use RemoteFX will be the same as if the medium screen capture rate and the medium image compression settings were selected (the default behavior). @@ -3573,7 +3580,7 @@ If you disable Continuous Network Detect, Remote Desktop Protocol will not try t If you disable Connect Time Detect and Continuous Network Detect, Remote Desktop Protocol will not try to determine the network quality at the connect time; instead it will assume that all traffic to this server originates from a low-speed connection, and it will not try to adapt the user experience to varying network quality. -- If you disable or do not configure this policy setting, Remote Desktop Protocol will spend up to a few seconds trying to determine the network quality prior to the connection, and it will continuously try to adapt the user experience to varying network quality. +If you disable or do not configure this policy setting, Remote Desktop Protocol will spend up to a few seconds trying to determine the network quality prior to the connection, and it will continuously try to adapt the user experience to varying network quality. @@ -3818,8 +3825,7 @@ Do not connect if authentication fails: The client establishes a connection to t -This policy setting lets you enable H.264/AVC hardware encoding support for Remote Desktop Connections. When you enable hardware encoding, if an error occurs, we will attempt to use software encoding. -- If you disable or do not configure this policy, we will always use software encoding. +This policy setting lets you enable H.264/AVC hardware encoding support for Remote Desktop Connections. When you enable hardware encoding, if an error occurs, we will attempt to use software encoding. If you disable or do not configure this policy, we will always use software encoding. @@ -3995,9 +4001,13 @@ You can also choose not to use an RDP compression algorithm. Choosing not to use This policy setting allows you to specify the visual quality for remote users when connecting to this computer by using Remote Desktop Connection. You can use this policy setting to balance the network bandwidth usage with the visual quality that is delivered. + - If you enable this policy setting and set quality to Low, RemoteFX Adaptive Graphics uses an encoding mechanism that results in low quality images. This mode consumes the lowest amount of network bandwidth of the quality modes. + - If you enable this policy setting and set quality to Medium, RemoteFX Adaptive Graphics uses an encoding mechanism that results in medium quality images. This mode provides better graphics quality than low quality and uses less bandwidth than high quality. + - If you enable this policy setting and set quality to High, RemoteFX Adaptive Graphics uses an encoding mechanism that results in high quality images and consumes moderate network bandwidth. + - If you enable this policy setting and set quality to Lossless, RemoteFX Adaptive Graphics uses lossless encoding. In this mode, the color integrity of the graphics data is not impacted. However, this setting results in a significant increase in network bandwidth consumption. We recommend that you set this for very specific cases only. - If you disable or do not configure this policy setting, RemoteFX Adaptive Graphics uses an encoding mechanism that results in medium quality images. @@ -4055,6 +4065,7 @@ This policy setting allows you to specify the visual quality for remote users wh This policy setting allows you to configure graphics encoding to use the RemoteFX Codec on the Remote Desktop Session Host server so that the sessions are compatible with non-Windows thin client devices designed for Windows Server 2008 R2 SP1. These clients only support the Windows Server 2008 R2 SP1 RemoteFX Codec. + - If you enable this policy setting, users' sessions on this server will only use the Windows Server 2008 R2 SP1 RemoteFX Codec for encoding. This mode is compatible with thin client devices that only support the Windows Server 2008 R2 SP1 RemoteFX Codec. - If you disable or do not configure this policy setting, non-Windows thin clients that only support the Windows Server 2008 R2 SP1 RemoteFX Codec will not be able to connect to this server. This policy setting applies only to clients that are using Remote Desktop Protocol (RDP) 7.1, and does not affect clients that are using other RDP versions. diff --git a/windows/client-management/mdm/policy-csp-admx-tpm.md b/windows/client-management/mdm/policy-csp-admx-tpm.md index 9237bb81e7..b22b7d4527 100644 --- a/windows/client-management/mdm/policy-csp-admx-tpm.md +++ b/windows/client-management/mdm/policy-csp-admx-tpm.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_TPM Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -342,7 +342,7 @@ This policy setting configures how much of the TPM owner authorization informati You can choose to have the operating system store either the full TPM owner authorization value, the TPM administrative delegation blob plus the TPM user delegation blob, or none. -- If you enable this policy setting, Windows will store the TPM owner authorization in the registry of the local computer according to the operating system managed TPM authentication setting you choose. +If you enable this policy setting, Windows will store the TPM owner authorization in the registry of the local computer according to the operating system managed TPM authentication setting you choose. Choose the operating system managed TPM authentication setting of "Full" to store the full TPM owner authorization, the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting allows use of the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios which do not depend on preventing reset of the TPM anti-hammering logic or changing the TPM owner authorization value. Some TPM-based applications may require this setting be changed before features which depend on the TPM anti-hammering logic can be used. diff --git a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md index 15da8637a6..f802208d23 100644 --- a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md +++ b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_UserExperienceVirtualization Area in Poli author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -48,6 +48,7 @@ ms.topic: reference This policy setting configures the synchronization of user settings of Calculator. By default, the user settings of Calculator synchronize between computers. Use the policy setting to prevent the user settings of Calculator from synchronization between computers. + - If you enable this policy setting, the Calculator user settings continue to synchronize. - If you disable this policy setting, Calculator user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -175,6 +176,7 @@ With notifications enabled, UE-V users receive a message when the settings sync This policy setting configures the synchronization of User Experience Virtualization (UE-V) rollback information for computers running in a non-persistent, pooled VDI environment. UE-V settings rollback data and checkpoints are normally stored only on the local computer. With this policy setting enabled, the rollback information is copied to the settings storage location when the user logs off or shuts down their VDI session. Enable this setting to register a VDI-specific settings location template and restore data on computers in pooled VDI environments that reset to a clean state on logout. With this policy enabled you can roll settings back to the state when UE-V was installed or to "last-known-good" configurations. Only enable this policy setting on computers running in a non-persistent VDI environment. The VDI Collection Name defines the name of the virtual desktop collection containing the virtual computers. + - If you enable this policy setting, the UE-V rollback state is copied to the settings storage location on logout and restored on login. - If you disable this policy setting, no UE-V rollback state is copied to the settings storage location. - If you do not configure this policy, no UE-V rollback state is copied to the settings storage location. @@ -234,6 +236,7 @@ This policy setting configures the synchronization of User Experience Virtualiza This policy setting specifies the text of the Contact IT URL hyperlink in the Company Settings Center. + - If you enable this policy setting, the Company Settings Center displays the specified text in the link to the Contact IT URL. - If you disable this policy setting, the Company Settings Center does not display an IT Contact link. - If you do not configure this policy setting, any defined values will be deleted. @@ -292,6 +295,7 @@ This policy setting specifies the text of the Contact IT URL hyperlink in the Co This policy setting specifies the URL for the Contact IT link in the Company Settings Center. + - If you enable this policy setting, the Company Settings Center Contact IT text links to the specified URL. The link can be of any standard protocol such as http or mailto. - If you disable this policy setting, the Company Settings Center does not display an IT Contact link. - If you do not configure this policy setting, any defined values will be deleted. @@ -355,9 +359,11 @@ This policy setting specifies the URL for the Contact IT link in the Company Set This policy setting defines whether the User Experience Virtualization (UE-V) Agent synchronizes settings for Windows apps. By default, the UE-V Agent synchronizes settings for Windows apps between the computer and the settings storage location. + - If you enable this policy setting, the UE-V Agent will not synchronize settings for Windows apps. - If you disable this policy setting, the UE-V Agent will synchronize settings for Windows apps. - If you do not configure this policy setting, any defined values are deleted. + > [!NOTE] > If the user connects their Microsoft account for their computer then the UE-V Agent will not synchronize Windows apps. The Windows apps will default to whatever settings are configured in the Sync your settings configuration in Windows. @@ -421,6 +427,7 @@ By default, the UE-V Agent synchronizes settings for Windows apps between the co This policy setting configures the synchronization of Windows settings between computers. Certain Windows settings will synchronize between computers by default. These settings include Windows themes, Windows desktop settings, Ease of Access settings, and network printers. Use this policy setting to specify which Windows settings synchronize between computers. You can also use these settings to enable synchronization of users' sign-in information for certain apps, networks, and certificates. + - If you enable this policy setting, only the selected Windows settings synchronize. Unselected Windows settings are excluded from settings synchronization. - If you disable this policy setting, all Windows Settings are excluded from the settings synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -540,6 +547,7 @@ This policy setting allows you to enable or disable User Experience Virtualizati This policy setting configures the synchronization of user settings for the Finance app. By default, the user settings of Finance sync between computers. Use the policy setting to prevent the user settings of Finance from synchronizing between computers. + - If you enable this policy setting, Finance user settings continue to sync. - If you disable this policy setting, Finance user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -602,7 +610,7 @@ This policy setting enables a notification in the system tray that appears when By default, a notification informs users that Company Settings Center, the user-facing name for the UE-V Agent, now helps to synchronize settings between their work computers. With this setting enabled, the notification appears the first time that the UE-V Agent runs. With this setting disabled, no notification appears. -- If you do not configure this policy setting, any defined values are deleted. +If you do not configure this policy setting, any defined values are deleted. @@ -664,6 +672,7 @@ With this setting disabled, no notification appears. This policy setting configures the synchronization of user settings for the Games app. By default, the user settings of Games sync between computers. Use the policy setting to prevent the user settings of Games from synchronizing between computers. + - If you enable this policy setting, Games user settings continue to sync. - If you disable this policy setting, Games user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -728,6 +737,7 @@ By default, the user settings of Games sync between computers. Use the policy se This policy setting configures the synchronization of user settings of Internet Explorer 10. By default, the user settings of Internet Explorer 10 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 10 from synchronization between computers. + - If you enable this policy setting, the Internet Explorer 10 user settings continue to synchronize. - If you disable this policy setting, Internet Explorer 10 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -792,6 +802,7 @@ By default, the user settings of Internet Explorer 10 synchronize between comput This policy setting configures the synchronization of user settings of Internet Explorer 11. By default, the user settings of Internet Explorer 11 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 11 from synchronization between computers. + - If you enable this policy setting, the Internet Explorer 11 user settings continue to synchronize. - If you disable this policy setting, Internet Explorer 11 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -856,6 +867,7 @@ By default, the user settings of Internet Explorer 11 synchronize between comput This policy setting configures the synchronization of user settings for Internet Explorer 8. By default, the user settings of Internet Explorer 8 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 8 from synchronization between computers. + - If you enable this policy setting, the Internet Explorer 8 user settings continue to synchronize. - If you disable this policy setting, Internet Explorer 8 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -920,6 +932,7 @@ By default, the user settings of Internet Explorer 8 synchronize between compute This policy setting configures the synchronization of user settings for Internet Explorer 9. By default, the user settings of Internet Explorer 9 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 9 from synchronization between computers. + - If you enable this policy setting, the Internet Explorer 9 user settings continue to synchronize. - If you disable this policy setting, Internet Explorer 9 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -984,6 +997,7 @@ By default, the user settings of Internet Explorer 9 synchronize between compute This policy setting configures the synchronization of user settings which are common between the versions of Internet Explorer. By default, the user settings which are common between the versions of Internet Explorer synchronize between computers. Use the policy setting to prevent the user settings of Internet Explorer from synchronization between computers. + - If you enable this policy setting, the user settings which are common between the versions of Internet Explorer continue to synchronize. - If you disable this policy setting, the user settings which are common between the versions of Internet Explorer are excluded from settings synchronization. If any version of the Internet Explorer settings are enabled this policy setting should not be disabled. - If you do not configure this policy setting, any defined values will be deleted. @@ -1047,6 +1061,7 @@ By default, the user settings which are common between the versions of Internet This policy setting configures the synchronization of user settings for the Maps app. By default, the user settings of Maps sync between computers. Use the policy setting to prevent the user settings of Maps from synchronizing between computers. + - If you enable this policy setting, Maps user settings continue to sync. - If you disable this policy setting, Maps user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -1110,6 +1125,7 @@ By default, the user settings of Maps sync between computers. Use the policy set This policy setting allows you to configure the UE-V Agent to write a warning event to the event log when a settings package file size reaches a defined threshold. By default the UE-V Agent does not report information about package file size. + - If you enable this policy setting, specify the threshold file size in bytes. When the settings package file exceeds this threshold the UE-V Agent will write a warning event to the event log. - If you disable or do not configure this policy setting, no event is written to the event log to report settings package size. @@ -1172,6 +1188,7 @@ This policy setting allows you to configure the UE-V Agent to write a warning ev This policy setting configures the synchronization of user settings for Microsoft Access 2010. By default, the user settings of Microsoft Access 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Access 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Access 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1235,6 +1252,7 @@ By default, the user settings of Microsoft Access 2010 synchronize between compu This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2010 applications. By default, the user settings which are common between the Microsoft Office Suite 2010 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2010 applications from synchronization between computers. + - If you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2010 applications continue to synchronize. - If you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2010 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2010 applications are enabled, this policy setting should not be disabled - If you do not configure this policy setting, any defined values will be deleted. @@ -1298,6 +1316,7 @@ By default, the user settings which are common between the Microsoft Office Suit This policy setting configures the synchronization of user settings for Microsoft Excel 2010. By default, the user settings of Microsoft Excel 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Excel 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Excel 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1361,6 +1380,7 @@ By default, the user settings of Microsoft Excel 2010 synchronize between comput This policy setting configures the synchronization of user settings for Microsoft InfoPath 2010. By default, the user settings of Microsoft InfoPath 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft InfoPath 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft InfoPath 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft InfoPath 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1424,6 +1444,7 @@ By default, the user settings of Microsoft InfoPath 2010 synchronize between com This policy setting configures the synchronization of user settings for Microsoft Lync 2010. By default, the user settings of Microsoft Lync 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Lync 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Lync 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1488,6 +1509,7 @@ By default, the user settings of Microsoft Lync 2010 synchronize between compute This policy setting configures the synchronization of user settings for Microsoft OneNote 2010. By default, the user settings of Microsoft OneNote 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft OneNote 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft OneNote 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1551,6 +1573,7 @@ By default, the user settings of Microsoft OneNote 2010 synchronize between comp This policy setting configures the synchronization of user settings for Microsoft Outlook 2010. By default, the user settings of Microsoft Outlook 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Outlook 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Outlook 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1614,6 +1637,7 @@ By default, the user settings of Microsoft Outlook 2010 synchronize between comp This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2010. By default, the user settings of Microsoft PowerPoint 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft PowerPoint 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft PowerPoint 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1677,6 +1701,7 @@ By default, the user settings of Microsoft PowerPoint 2010 synchronize between c This policy setting configures the synchronization of user settings for Microsoft Project 2010. By default, the user settings of Microsoft Project 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Project 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Project 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1740,6 +1765,7 @@ By default, the user settings of Microsoft Project 2010 synchronize between comp This policy setting configures the synchronization of user settings for Microsoft Publisher 2010. By default, the user settings of Microsoft Publisher 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Publisher 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Publisher 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1803,6 +1829,7 @@ By default, the user settings of Microsoft Publisher 2010 synchronize between co This policy setting configures the synchronization of user settings for Microsoft SharePoint Designer 2010. By default, the user settings of Microsoft SharePoint Designer 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Designer 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft SharePoint Designer 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft SharePoint Designer 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1866,6 +1893,7 @@ By default, the user settings of Microsoft SharePoint Designer 2010 synchronize This policy setting configures the synchronization of user settings for Microsoft SharePoint Workspace 2010. By default, the user settings of Microsoft SharePoint Workspace 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Workspace 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft SharePoint Workspace 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft SharePoint Workspace 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1929,6 +1957,7 @@ By default, the user settings of Microsoft SharePoint Workspace 2010 synchronize This policy setting configures the synchronization of user settings for Microsoft Visio 2010. By default, the user settings of Microsoft Visio 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Visio 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Visio 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1992,6 +2021,7 @@ By default, the user settings of Microsoft Visio 2010 synchronize between comput This policy setting configures the synchronization of user settings for Microsoft Word 2010. By default, the user settings of Microsoft Word 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Word 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Word 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2055,6 +2085,7 @@ By default, the user settings of Microsoft Word 2010 synchronize between compute This policy setting configures the synchronization of user settings for Microsoft Access 2013. By default, the user settings of Microsoft Access 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Access 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Access 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2118,6 +2149,7 @@ By default, the user settings of Microsoft Access 2013 synchronize between compu This policy setting configures the backup of certain user settings for Microsoft Access 2013. Microsoft Access 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Access 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Access 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Access 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -2181,6 +2213,7 @@ Microsoft Access 2013 has user settings that are backed up instead of synchroniz This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2013 applications. By default, the user settings which are common between the Microsoft Office Suite 2013 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2013 applications from synchronization between computers. + - If you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2013 applications continue to synchronize. - If you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2013 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2013 applications are enabled, this policy setting should not be disabled. - If you do not configure this policy setting, any defined values will be deleted. @@ -2244,6 +2277,7 @@ By default, the user settings which are common between the Microsoft Office Suit This policy setting configures the backup of certain user settings which are common between the Microsoft Office Suite 2013 applications. Microsoft Office Suite 2013 has user settings which are common between applications and are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific common Microsoft Office Suite 2013 applications. + - If you enable this policy setting, certain user settings which are common between the Microsoft Office Suite 2013 applications will continue to be backed up. - If you disable this policy setting, certain user settings which are common between the Microsoft Office Suite 2013 applications will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -2307,6 +2341,7 @@ Microsoft Office Suite 2013 has user settings which are common between applicati This policy setting configures the synchronization of user settings for Microsoft Excel 2013. By default, the user settings of Microsoft Excel 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Excel 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Excel 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2370,6 +2405,7 @@ By default, the user settings of Microsoft Excel 2013 synchronize between comput This policy setting configures the backup of certain user settings for Microsoft Excel 2013. Microsoft Excel 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Excel 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Excel 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Excel 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -2433,6 +2469,7 @@ Microsoft Excel 2013 has user settings that are backed up instead of synchronizi This policy setting configures the synchronization of user settings for Microsoft InfoPath 2013. By default, the user settings of Microsoft InfoPath 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft InfoPath 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft InfoPath 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft InfoPath 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2496,6 +2533,7 @@ By default, the user settings of Microsoft InfoPath 2013 synchronize between com This policy setting configures the backup of certain user settings for Microsoft InfoPath 2013. Microsoft InfoPath 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft InfoPath 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft InfoPath 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft InfoPath 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -2559,6 +2597,7 @@ Microsoft InfoPath 2013 has user settings that are backed up instead of synchron This policy setting configures the synchronization of user settings for Microsoft Lync 2013. By default, the user settings of Microsoft Lync 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Lync 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Lync 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2622,6 +2661,7 @@ By default, the user settings of Microsoft Lync 2013 synchronize between compute This policy setting configures the backup of certain user settings for Microsoft Lync 2013. Microsoft Lync 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Lync 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Lync 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Lync 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -2685,6 +2725,7 @@ Microsoft Lync 2013 has user settings that are backed up instead of synchronizin This policy setting configures the synchronization of user settings for OneDrive for Business 2013. By default, the user settings of OneDrive for Business 2013 synchronize between computers. Use the policy setting to prevent the user settings of OneDrive for Business 2013 from synchronization between computers. + - If you enable this policy setting, OneDrive for Business 2013 user settings continue to synchronize. - If you disable this policy setting, OneDrive for Business 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2748,6 +2789,7 @@ By default, the user settings of OneDrive for Business 2013 synchronize between This policy setting configures the synchronization of user settings for Microsoft OneNote 2013. By default, the user settings of Microsoft OneNote 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft OneNote 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft OneNote 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2811,6 +2853,7 @@ By default, the user settings of Microsoft OneNote 2013 synchronize between comp This policy setting configures the backup of certain user settings for Microsoft OneNote 2013. Microsoft OneNote 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft OneNote 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft OneNote 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft OneNote 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -2874,6 +2917,7 @@ Microsoft OneNote 2013 has user settings that are backed up instead of synchroni This policy setting configures the synchronization of user settings for Microsoft Outlook 2013. By default, the user settings of Microsoft Outlook 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Outlook 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Outlook 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2937,6 +2981,7 @@ By default, the user settings of Microsoft Outlook 2013 synchronize between comp This policy setting configures the backup of certain user settings for Microsoft Outlook 2013. Microsoft Outlook 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Outlook 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Outlook 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Outlook 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3000,6 +3045,7 @@ Microsoft Outlook 2013 has user settings that are backed up instead of synchroni This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2013. By default, the user settings of Microsoft PowerPoint 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft PowerPoint 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft PowerPoint 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3063,6 +3109,7 @@ By default, the user settings of Microsoft PowerPoint 2013 synchronize between c This policy setting configures the backup of certain user settings for Microsoft PowerPoint 2013. Microsoft PowerPoint 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft PowerPoint 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft PowerPoint 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft PowerPoint 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3126,6 +3173,7 @@ Microsoft PowerPoint 2013 has user settings that are backed up instead of synchr This policy setting configures the synchronization of user settings for Microsoft Project 2013. By default, the user settings of Microsoft Project 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Project 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Project 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3189,6 +3237,7 @@ By default, the user settings of Microsoft Project 2013 synchronize between comp This policy setting configures the backup of certain user settings for Microsoft Project 2013. Microsoft Project 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Project 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Project 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Project 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3252,6 +3301,7 @@ Microsoft Project 2013 has user settings that are backed up instead of synchroni This policy setting configures the synchronization of user settings for Microsoft Publisher 2013. By default, the user settings of Microsoft Publisher 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Publisher 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Publisher 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3315,6 +3365,7 @@ By default, the user settings of Microsoft Publisher 2013 synchronize between co This policy setting configures the backup of certain user settings for Microsoft Publisher 2013. Microsoft Publisher 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Publisher 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Publisher 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Publisher 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3378,6 +3429,7 @@ Microsoft Publisher 2013 has user settings that are backed up instead of synchro This policy setting configures the synchronization of user settings for Microsoft SharePoint Designer 2013. By default, the user settings of Microsoft SharePoint Designer 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Designer 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft SharePoint Designer 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft SharePoint Designer 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3441,6 +3493,7 @@ By default, the user settings of Microsoft SharePoint Designer 2013 synchronize This policy setting configures the backup of certain user settings for Microsoft SharePoint Designer 2013. Microsoft SharePoint Designer 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft SharePoint Designer 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft SharePoint Designer 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft SharePoint Designer 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3504,6 +3557,7 @@ Microsoft SharePoint Designer 2013 has user settings that are backed up instead This policy setting configures the synchronization of user settings for Microsoft Office 2013 Upload Center. By default, the user settings of Microsoft Office 2013 Upload Center synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Office 2013 Upload Center from synchronization between computers. + - If you enable this policy setting, Microsoft Office 2013 Upload Center user settings continue to synchronize. - If you disable this policy setting, Microsoft Office 2013 Upload Center user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3567,6 +3621,7 @@ By default, the user settings of Microsoft Office 2013 Upload Center synchronize This policy setting configures the synchronization of user settings for Microsoft Visio 2013. By default, the user settings of Microsoft Visio 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Visio 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Visio 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3630,6 +3685,7 @@ By default, the user settings of Microsoft Visio 2013 synchronize between comput This policy setting configures the backup of certain user settings for Microsoft Visio 2013. Microsoft Visio 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Visio 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Visio 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Visio 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3693,6 +3749,7 @@ Microsoft Visio 2013 has user settings that are backed up instead of synchronizi This policy setting configures the synchronization of user settings for Microsoft Word 2013. By default, the user settings of Microsoft Word 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Word 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Word 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3756,6 +3813,7 @@ By default, the user settings of Microsoft Word 2013 synchronize between compute This policy setting configures the backup of certain user settings for Microsoft Word 2013. Microsoft Word 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Word 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Word 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Word 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3819,6 +3877,7 @@ Microsoft Word 2013 has user settings that are backed up instead of synchronizin This policy setting configures the synchronization of user settings for Microsoft Access 2016. By default, the user settings of Microsoft Access 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Access 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Access 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3882,6 +3941,7 @@ By default, the user settings of Microsoft Access 2016 synchronize between compu This policy setting configures the backup of certain user settings for Microsoft Access 2016. Microsoft Access 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Access 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Access 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Access 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3945,6 +4005,7 @@ Microsoft Access 2016 has user settings that are backed up instead of synchroniz This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2016 applications. By default, the user settings which are common between the Microsoft Office Suite 2016 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2016 applications from synchronization between computers. + - If you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2016 applications continue to synchronize. - If you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2016 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2016 applications are enabled, this policy setting should not be disabled. - If you do not configure this policy setting, any defined values will be deleted. @@ -4008,6 +4069,7 @@ By default, the user settings which are common between the Microsoft Office Suit This policy setting configures the backup of certain user settings which are common between the Microsoft Office Suite 2016 applications. Microsoft Office Suite 2016 has user settings which are common between applications and are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific common Microsoft Office Suite 2016 applications. + - If you enable this policy setting, certain user settings which are common between the Microsoft Office Suite 2016 applications will continue to be backed up. - If you disable this policy setting, certain user settings which are common between the Microsoft Office Suite 2016 applications will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -4071,6 +4133,7 @@ Microsoft Office Suite 2016 has user settings which are common between applicati This policy setting configures the synchronization of user settings for Microsoft Excel 2016. By default, the user settings of Microsoft Excel 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Excel 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Excel 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4134,6 +4197,7 @@ By default, the user settings of Microsoft Excel 2016 synchronize between comput This policy setting configures the backup of certain user settings for Microsoft Excel 2016. Microsoft Excel 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Excel 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Excel 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Excel 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -4197,6 +4261,7 @@ Microsoft Excel 2016 has user settings that are backed up instead of synchronizi This policy setting configures the synchronization of user settings for Microsoft Lync 2016. By default, the user settings of Microsoft Lync 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Lync 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Lync 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4260,6 +4325,7 @@ By default, the user settings of Microsoft Lync 2016 synchronize between compute This policy setting configures the backup of certain user settings for Microsoft Lync 2016. Microsoft Lync 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Lync 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Lync 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Lync 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -4323,6 +4389,7 @@ Microsoft Lync 2016 has user settings that are backed up instead of synchronizin This policy setting configures the synchronization of user settings for OneDrive for Business 2016. By default, the user settings of OneDrive for Business 2016 synchronize between computers. Use the policy setting to prevent the user settings of OneDrive for Business 2016 from synchronization between computers. + - If you enable this policy setting, OneDrive for Business 2016 user settings continue to synchronize. - If you disable this policy setting, OneDrive for Business 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4386,6 +4453,7 @@ By default, the user settings of OneDrive for Business 2016 synchronize between This policy setting configures the synchronization of user settings for Microsoft OneNote 2016. By default, the user settings of Microsoft OneNote 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft OneNote 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft OneNote 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4449,6 +4517,7 @@ By default, the user settings of Microsoft OneNote 2016 synchronize between comp This policy setting configures the backup of certain user settings for Microsoft OneNote 2016. Microsoft OneNote 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft OneNote 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft OneNote 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft OneNote 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -4512,6 +4581,7 @@ Microsoft OneNote 2016 has user settings that are backed up instead of synchroni This policy setting configures the synchronization of user settings for Microsoft Outlook 2016. By default, the user settings of Microsoft Outlook 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Outlook 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Outlook 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4575,6 +4645,7 @@ By default, the user settings of Microsoft Outlook 2016 synchronize between comp This policy setting configures the backup of certain user settings for Microsoft Outlook 2016. Microsoft Outlook 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Outlook 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Outlook 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Outlook 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -4638,6 +4709,7 @@ Microsoft Outlook 2016 has user settings that are backed up instead of synchroni This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2016. By default, the user settings of Microsoft PowerPoint 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft PowerPoint 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft PowerPoint 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4701,6 +4773,7 @@ By default, the user settings of Microsoft PowerPoint 2016 synchronize between c This policy setting configures the backup of certain user settings for Microsoft PowerPoint 2016. Microsoft PowerPoint 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft PowerPoint 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft PowerPoint 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft PowerPoint 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -4764,6 +4837,7 @@ Microsoft PowerPoint 2016 has user settings that are backed up instead of synchr This policy setting configures the synchronization of user settings for Microsoft Project 2016. By default, the user settings of Microsoft Project 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Project 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Project 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4827,6 +4901,7 @@ By default, the user settings of Microsoft Project 2016 synchronize between comp This policy setting configures the backup of certain user settings for Microsoft Project 2016. Microsoft Project 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Project 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Project 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Project 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -4890,6 +4965,7 @@ Microsoft Project 2016 has user settings that are backed up instead of synchroni This policy setting configures the synchronization of user settings for Microsoft Publisher 2016. By default, the user settings of Microsoft Publisher 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Publisher 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Publisher 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4953,6 +5029,7 @@ By default, the user settings of Microsoft Publisher 2016 synchronize between co This policy setting configures the backup of certain user settings for Microsoft Publisher 2016. Microsoft Publisher 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Publisher 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Publisher 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Publisher 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -5016,6 +5093,7 @@ Microsoft Publisher 2016 has user settings that are backed up instead of synchro This policy setting configures the synchronization of user settings for Microsoft Office 2016 Upload Center. By default, the user settings of Microsoft Office 2016 Upload Center synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Office 2016 Upload Center from synchronization between computers. + - If you enable this policy setting, Microsoft Office 2016 Upload Center user settings continue to synchronize. - If you disable this policy setting, Microsoft Office 2016 Upload Center user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -5079,6 +5157,7 @@ By default, the user settings of Microsoft Office 2016 Upload Center synchronize This policy setting configures the synchronization of user settings for Microsoft Visio 2016. By default, the user settings of Microsoft Visio 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Visio 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Visio 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -5142,6 +5221,7 @@ By default, the user settings of Microsoft Visio 2016 synchronize between comput This policy setting configures the backup of certain user settings for Microsoft Visio 2016. Microsoft Visio 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Visio 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Visio 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Visio 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -5205,6 +5285,7 @@ Microsoft Visio 2016 has user settings that are backed up instead of synchronizi This policy setting configures the synchronization of user settings for Microsoft Word 2016. By default, the user settings of Microsoft Word 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Word 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Word 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -5268,6 +5349,7 @@ By default, the user settings of Microsoft Word 2016 synchronize between compute This policy setting configures the backup of certain user settings for Microsoft Word 2016. Microsoft Word 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Word 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Word 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Word 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -5331,6 +5413,7 @@ Microsoft Word 2016 has user settings that are backed up instead of synchronizin This policy setting configures the synchronization of user settings for Microsoft Office 365 Access 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Access 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Access 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Access 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Access 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5394,6 +5477,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Access 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Access 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Access 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Access 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Access 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5457,6 +5541,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2013 applications. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings which are common between the Microsoft Office Suite 2013 applications will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings which are common between the Microsoft Office Suite 2013 applications from synchronization between computers with UE-V. + - If you enable this policy setting, user settings which are common between the Microsoft Office Suite 2013 applications continue to synchronize with UE-V. - If you disable this policy setting, user settings which are common between the Microsoft Office Suite 2013 applications are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5520,6 +5605,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2016 applications. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings which are common between the Microsoft Office Suite 2016 applications will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings which are common between the Microsoft Office Suite 2016 applications from synchronization between computers with UE-V. + - If you enable this policy setting, user settings which are common between the Microsoft Office Suite 2016 applications continue to synchronize with UE-V. - If you disable this policy setting, user settings which are common between the Microsoft Office Suite 2016 applications are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5583,6 +5669,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Excel 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Excel 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Excel 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Excel 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Excel 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5646,6 +5733,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Excel 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Excel 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Excel 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Excel 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Excel 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5709,6 +5797,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 InfoPath 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 InfoPath 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 InfoPath 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 InfoPath 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 InfoPath 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5772,6 +5861,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Lync 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Lync 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Lync 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Lync 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Lync 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5835,6 +5925,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Lync 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Lync 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Lync 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Lync 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Lync 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5898,6 +5989,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 OneNote 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 OneNote 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 OneNote 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 OneNote 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 OneNote 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5961,6 +6053,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 OneNote 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 OneNote 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 OneNote 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 OneNote 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 OneNote 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6024,6 +6117,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Outlook 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Outlook 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Outlook 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Outlook 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Outlook 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6087,6 +6181,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Outlook 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Outlook 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Outlook 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Outlook 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Outlook 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6150,6 +6245,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 PowerPoint 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 PowerPoint 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 PowerPoint 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 PowerPoint 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 PowerPoint 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6213,6 +6309,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 PowerPoint 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 PowerPoint 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 PowerPoint 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 PowerPoint 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 PowerPoint 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6276,6 +6373,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Project 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Project 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Project 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Project 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Project 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6339,6 +6437,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Project 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Project 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Project 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Project 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Project 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6402,6 +6501,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Publisher 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Publisher 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Publisher 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Publisher 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Publisher 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6465,6 +6565,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Publisher 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Publisher 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Publisher 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Publisher 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Publisher 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6528,6 +6629,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 SharePoint Designer 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 SharePoint Designer 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 SharePoint Designer 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 SharePoint Designer 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 SharePoint Designer 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6591,6 +6693,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Visio 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Visio 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Visio 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Visio 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Visio 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6654,6 +6757,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Visio 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Visio 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Visio 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Visio 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Visio 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6717,6 +6821,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Word 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Word 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Word 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Word 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Word 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6780,6 +6885,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Word 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Word 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Word 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Word 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Word 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6843,6 +6949,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for the Music app. By default, the user settings of Music sync between computers. Use the policy setting to prevent the user settings of Music from synchronizing between computers. + - If you enable this policy setting, Music user settings continue to sync. - If you disable this policy setting, Music user settings are excluded from the synchronizing settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -6907,6 +7014,7 @@ By default, the user settings of Music sync between computers. Use the policy se This policy setting configures the synchronization of user settings for the News app. By default, the user settings of News sync between computers. Use the policy setting to prevent the user settings of News from synchronizing between computers. + - If you enable this policy setting, News user settings continue to sync. - If you disable this policy setting, News user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -6971,6 +7079,7 @@ By default, the user settings of News sync between computers. Use the policy set This policy setting configures the synchronization of user settings of Notepad. By default, the user settings of Notepad synchronize between computers. Use the policy setting to prevent the user settings of Notepad from synchronization between computers. + - If you enable this policy setting, the Notepad user settings continue to synchronize. - If you disable this policy setting, Notepad user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -7035,6 +7144,7 @@ By default, the user settings of Notepad synchronize between computers. Use the This policy setting configures the synchronization of user settings for the Reader app. By default, the user settings of Reader sync between computers. Use the policy setting to prevent the user settings of Reader from synchronizing between computers. + - If you enable this policy setting, Reader user settings continue to sync. - If you disable this policy setting, Reader user settings are excluded from the synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -7099,6 +7209,7 @@ By default, the user settings of Reader sync between computers. Use the policy s This policy setting configures the number of milliseconds that the computer waits when retrieving user settings from the settings storage location. You can use this setting to override the default value of 2000 milliseconds. + - If you enable this policy setting, set the number of milliseconds that the system waits to retrieve settings. - If you disable or do not configure this policy setting, the default value of 2000 milliseconds is used. @@ -7160,6 +7271,7 @@ You can use this setting to override the default value of 2000 milliseconds. This policy setting configures where the settings package files that contain user settings are stored. + - If you enable this policy setting, the user settings are stored in the specified location. - If you disable or do not configure this policy setting, the user settings are stored in the user's home directory if configured for your environment. @@ -7217,6 +7329,7 @@ This policy setting configures where the settings package files that contain use This policy setting configures where custom settings location templates are stored and if the catalog will be used to replace the default Microsoft templates installed with the UE-V Agent. + - If you enable this policy setting, the UE-V Agent checks the specified location once each day and updates its synchronization behavior based on the templates in this location. Settings location templates added or updated since the last check are registered by the UE-V Agent. The UE-V Agent deregisters templates that were removed from this location. If you specify a UNC path and leave the option to replace the default Microsoft templates unchecked, the UE-V Agent will use the default Microsoft templates installed by the UE-V Agent and custom templates in the settings template catalog. If there are custom templates in the settings template catalog which use the same ID as the default Microsoft templates, they will be ignored. If you specify a UNC path and check the option to replace the default Microsoft templates, all of the default Microsoft templates installed by the UE-V Agent will be deleted from the computer and only the templates located in the settings template catalog will be used. @@ -7283,6 +7396,7 @@ If you specify a UNC path and check the option to replace the default Microsoft This policy setting configures the synchronization of user settings for the Sports app. By default, the user settings of Sports sync between computers. Use the policy setting to prevent the user settings of Sports from synchronizing between computers. + - If you enable this policy setting, Sports user settings continue to sync. - If you disable this policy setting, Sports user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -7409,7 +7523,7 @@ This policy setting defines whether the User Experience Virtualization (UE-V) Ag By default, the UE-V Agent does not synchronize settings over a metered connection. With this setting enabled, the UE-V Agent synchronizes settings over a metered connection. With this setting disabled, the UE-V Agent does not synchronize settings over a metered connection. -- If you do not configure this policy setting, any defined values are deleted. +If you do not configure this policy setting, any defined values are deleted. @@ -7473,7 +7587,7 @@ This policy setting defines whether the User Experience Virtualization (UE-V) Ag By default, the UE-V Agent does not synchronize settings over a metered connection that is roaming. With this setting enabled, the UE-V Agent synchronizes settings over a metered connection that is roaming. With this setting disabled, the UE-V Agent will not synchronize settings over a metered connection that is roaming. -- If you do not configure this policy setting, any defined values are deleted. +If you do not configure this policy setting, any defined values are deleted. @@ -7534,6 +7648,7 @@ With this setting disabled, the UE-V Agent will not synchronize settings over a This policy setting allows you to configure the User Experience Virtualization (UE-V) sync provider to ping the settings storage path before attempting to sync settings. If the ping is successful then the sync provider attempts to synchronize the settings packages. If the ping is unsuccessful then the sync provider doesn't attempt the synchronization. + - If you enable this policy setting, the sync provider pings the settings storage location before synchronizing settings packages. - If you disable this policy setting, the sync provider doesn't ping the settings storage location before synchronizing settings packages. - If you do not configure this policy, any defined values will be deleted. @@ -7596,7 +7711,7 @@ This policy setting defines the default settings sync behavior of the User Exper By default, the UE-V Agent only synchronizes settings of those Windows apps included in the Windows App List. With this setting enabled, the settings of all Windows apps not expressly disable in the Windows App List are synchronized. With this setting disabled, only the settings of the Windows apps set to synchronize in the Windows App List are synchronized. -- If you do not configure this policy setting, any defined values are deleted. +If you do not configure this policy setting, any defined values are deleted. @@ -7658,6 +7773,7 @@ With this setting disabled, only the settings of the Windows apps set to synchro This policy setting configures the synchronization of user settings for the Travel app. By default, the user settings of Travel sync between computers. Use the policy setting to prevent the user settings of Travel from synchronizing between computers. + - If you enable this policy setting, Travel user settings continue to sync. - If you disable this policy setting, Travel user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -7718,7 +7834,7 @@ By default, the user settings of Travel sync between computers. Use the policy s This policy setting enables the User Experience Virtualization (UE-V) tray icon. By default, an icon appears in the system tray that displays notifications for UE-V. This icon also provides a link to the UE-V Agent application, Company Settings Center. Users can open the Company Settings Center by right-clicking the icon and selecting Open or by double-clicking the icon. When this group policy setting is enabled, the UE-V tray icon is visible, the UE-V notifications display, and the Company Settings Center is accessible from the tray icon. With this setting disabled, the tray icon does not appear in the system tray, UE-V never displays notifications, and the user cannot access Company Settings Center from the system tray. The Company Settings Center remains accessible through the Control Panel and the Start menu or Start screen. -- If you do not configure this policy setting, any defined values are deleted. +If you do not configure this policy setting, any defined values are deleted. @@ -7780,6 +7896,7 @@ With this setting disabled, the tray icon does not appear in the system tray, UE This policy setting configures the synchronization of user settings for the Video app. By default, the user settings of Video sync between computers. Use the policy setting to prevent the user settings of Video from synchronizing between computers. + - If you enable this policy setting, Video user settings continue to sync. - If you disable this policy setting, Video user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -7844,6 +7961,7 @@ By default, the user settings of Video sync between computers. Use the policy se This policy setting configures the synchronization of user settings for the Weather app. By default, the user settings of Weather sync between computers. Use the policy setting to prevent the user settings of Weather from synchronizing between computers. + - If you enable this policy setting, Weather user settings continue to sync. - If you disable this policy setting, Weather user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -7908,6 +8026,7 @@ By default, the user settings of Weather sync between computers. Use the policy This policy setting configures the synchronization of user settings of WordPad. By default, the user settings of WordPad synchronize between computers. Use the policy setting to prevent the user settings of WordPad from synchronization between computers. + - If you enable this policy setting, the WordPad user settings continue to synchronize. - If you disable this policy setting, WordPad user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. diff --git a/windows/client-management/mdm/policy-csp-admx-userprofiles.md b/windows/client-management/mdm/policy-csp-admx-userprofiles.md index 1f26fcf32f..e5f3324a38 100644 --- a/windows/client-management/mdm/policy-csp-admx-userprofiles.md +++ b/windows/client-management/mdm/policy-csp-admx-userprofiles.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_UserProfiles Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -42,7 +42,7 @@ ms.topic: reference -This policy setting allows an administrator to automatically delete user profiles on system restart that have not been used within a specified number of days +This policy setting allows an administrator to automatically delete user profiles on system restart that have not been used within a specified number of days. > [!NOTE] > One day is interpreted as 24 hours after a specific user profile was accessed. @@ -373,7 +373,7 @@ This policy setting and related policy settings in this folder together define t - If you enable this policy setting, you can change how long Windows waits for a response from the server before considering the connection to be slow. -- If you disable or do not configure this policy setting, Windows considers the network connection to be slow if the server returns less than 500 kilobits of data per second or take 120 milliseconds to respond. Consider increasing this value for clients using DHCP Service-assigned addresses or for computers accessing profiles across dial-up connections +- If you disable or do not configure this policy setting, Windows considers the network connection to be slow if the server returns less than 500 kilobits of data per second or take 120 milliseconds to respond. Consider increasing this value for clients using DHCP Service-assigned addresses or for computers accessing profiles across dial-up connections. > [!IMPORTANT] > If the "Do not detect slow network connections" policy setting is enabled, this policy setting is ignored. Also, if the "Delete cached copies of roaming profiles" policy setting is enabled, there is no local copy of the roaming profile to load when the system detects a slow connection. @@ -507,7 +507,7 @@ This setting prevents users from managing the ability to allow apps to access th "Always off" - users will not be able to change this setting and the user's name and account picture will not be shared with apps (not desktop apps). In addition apps (not desktop apps) that have the enterprise authentication capability will not be able to retrieve the user's UPN, SIP/URI, and DNS. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources. -If you do not configure or disable this policy the user will have full control over this setting and can turn it off and on. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources if users choose to turn the setting off. +- If you do not configure or disable this policy the user will have full control over this setting and can turn it off and on. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources if users choose to turn the setting off. diff --git a/windows/client-management/mdm/policy-csp-admx-w32time.md b/windows/client-management/mdm/policy-csp-admx-w32time.md index 48ea1bbd7f..f35943b958 100644 --- a/windows/client-management/mdm/policy-csp-admx-w32time.md +++ b/windows/client-management/mdm/policy-csp-admx-w32time.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_W32Time Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -46,7 +46,7 @@ This policy setting allows you to specify Clock discipline and General values fo - If this policy setting is enabled, W32time Service on target machines use the settings provided here. Otherwise, the service on target machines use locally configured settings values. -For more details on individual parameters, combinations of parameter values as well as definitions of flags, see . +For more details on individual parameters, combinations of parameter values as well as definitions of flags, see< https://go.microsoft.com/fwlink/?linkid=847809>. FrequencyCorrectRate This parameter controls the rate at which the W32time corrects the local clock's frequency. Lower values cause larger corrections; larger values cause smaller corrections. Default: 4 (scalar). diff --git a/windows/client-management/mdm/policy-csp-admx-wcm.md b/windows/client-management/mdm/policy-csp-admx-wcm.md index f572e7a8d8..525dff55c9 100644 --- a/windows/client-management/mdm/policy-csp-admx-wcm.md +++ b/windows/client-management/mdm/policy-csp-admx-wcm.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_WCM Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -109,9 +109,9 @@ This policy setting determines whether Windows will soft-disconnect a computer f - If this policy setting is disabled, Windows will disconnect a computer from a network immediately when it determines that the computer should no longer be connected to a network. When soft disconnect is enabled: -- When Windows decides that the computer should no longer be connected to a network, it waits for traffic to settle on that network. The existing TCP session will continue uninterrupted. -- Windows then checks the traffic level on the network periodically. If the traffic level is above a certain threshold, no further action is taken. The computer stays connected to the network and continues to use it. For example, if the network connection is currently being used to download files from the Internet, the files will continue to be downloaded using that network connection. -- When the network traffic drops below this threshold, the computer will be disconnected from the network. Apps that keep a network connection active even when they're not actively using it (for example, email apps) might lose their connection. If this happens, these apps should re-establish their connection over a different network. + - When Windows decides that the computer should no longer be connected to a network, it waits for traffic to settle on that network. The existing TCP session will continue uninterrupted. + - Windows then checks the traffic level on the network periodically. If the traffic level is above a certain threshold, no further action is taken. The computer stays connected to the network and continues to use it. For example, if the network connection is currently being used to download files from the Internet, the files will continue to be downloaded using that network connection. + - When the network traffic drops below this threshold, the computer will be disconnected from the network. Apps that keep a network connection active even when they're not actively using it (for example, email apps) might lose their connection. If this happens, these apps should re-establish their connection over a different network. This policy setting depends on other group policy settings. For example, if 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is disabled, Windows will not disconnect from any networks. diff --git a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md index 8a53921483..be0b41abb0 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_WindowsExplorer Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/10/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -357,6 +357,7 @@ This disables access to user-defined properties, and properties stored in NTFS s This policy setting allows you to turn off Windows Libraries features that need indexed file metadata to function properly. + - If you enable this policy, some Windows Libraries features will be turned off to better handle included folders that have been redirected to non-indexed network locations. Setting this policy will: * Disable all Arrangement views except for "By Folder" @@ -681,8 +682,7 @@ For more information, see [Microsoft Defender SmartScreen](/windows/security/thr -This setting is designed to ensure that shell extensions can operate on a per-user basis. -- If you enable this setting, Windows is directed to only run those shell extensions that have either been approved by an administrator or that will not impact other users of the machine. +This setting is designed to ensure that shell extensions can operate on a per-user basis. If you enable this setting, Windows is directed to only run those shell extensions that have either been approved by an administrator or that will not impact other users of the machine. A shell extension only runs if there is an entry in at least one of the following locations in registry. @@ -749,6 +749,7 @@ For shell extensions to run on a per-user basis, there must be an entry at HKEY_ This policy setting allows you to specify whether the ribbon appears minimized or in full when new File Explorer windows are opened. + - If you enable this policy setting, you can set how the ribbon appears the first time users open File Explorer and whenever they open new windows. - If you disable or do not configure this policy setting, users can choose how the ribbon appears when they open new windows. @@ -2776,7 +2777,7 @@ Also, see the "Prevent access to drives from My Computer" policy setting. Removes all computers outside of the user's workgroup or local domain from lists of network resources in File Explorer and Network Locations. -- If you enable this setting, the system removes the Entire Network option and the icons representing networked computers from Network Locations and from the browser associated with the Map Network Drive option. +If you enable this setting, the system removes the Entire Network option and the icons representing networked computers from Network Locations and from the browser associated with the Map Network Drive option. This setting does not prevent users from viewing or connecting to computers in their workgroup or domain. It also does not prevent users from connecting to remote computers by other commonly used methods, such as by typing the share name in the Run dialog box or the Map Network Drive dialog box. @@ -2900,6 +2901,7 @@ This setting does not prevent users from using other methods to perform tasks av Removes the list of most recently used files from the Open dialog box. - If you disable this setting or do not configure it, the "File name" field includes a drop-down list of recently used files. + - If you enable this setting, the "File name" field is a simple text box. Users must browse directories to find a file or type a file name in the text box. This setting, and others in this folder, lets you remove new features added in Windows 2000 Professional, so that the Open dialog box looks like it did in Windows NT 4.0 and earlier. These policies only affect programs that use the standard Open dialog box provided to developers of Windows programs. @@ -3213,7 +3215,7 @@ When a Windows client is in a workgroup, a Shared Documents icon appears in the Prevents users from using File Explorer or Network Locations to map or disconnect network drives. -- If you enable this setting, the system removes the Map Network Drive and Disconnect Network Drive commands from the toolbar and Tools menus in File Explorer and Network Locations and from menus that appear when you right-click the File Explorer or Network Locations icons. +If you enable this setting, the system removes the Map Network Drive and Disconnect Network Drive commands from the toolbar and Tools menus in File Explorer and Network Locations and from menus that appear when you right-click the File Explorer or Network Locations icons. This setting does not prevent users from connecting to another computer by typing the name of a shared folder in the Run dialog box. @@ -3465,6 +3467,7 @@ Prevents users from submitting alternate logon credentials to install a program. This setting suppresses the "Install Program As Other User" dialog box for local and network installations. This dialog box, which prompts the current user for the user name and password of an administrator, appears when users who are not administrators try to install programs locally on their computers. This setting allows administrators who have logged on as regular users to install programs without logging off and logging on again using their administrator credentials. Many programs can be installed only by an administrator. + - If you enable this setting and a user does not have sufficient permissions to install a program, the installation continues with the current user's logon credentials. As a result, the installation might fail, or it might complete but not include all features. Or, it might appear to complete successfully, but the installed program might not operate correctly. - If you disable this setting or do not configure it, the "Install Program As Other User" dialog box appears whenever users install programs locally on the computer. @@ -3525,6 +3528,7 @@ By default, users are not prompted for alternate logon credentials when installi + - If you enable this policy, the "Internet" "Search again" link will not be shown when the user performs a search in the Explorer window. - If you disable this policy, there will be an "Internet" "Search again" link when the user performs a search in the Explorer window. This button launches a search in the default browser with the search terms. @@ -3714,6 +3718,7 @@ This policy setting does not affect the Search items on the File Explorer contex This policy setting allows you to have file names sorted literally (as in Windows 2000 and earlier) rather than in numerical order. + - If you enable this policy setting, File Explorer will sort file names by each digit in a file name (for example, 111 < 22 < 3). - If you disable or do not configure this policy setting, File Explorer will sort file names by increasing number value (for example, 3 < 22 < 111). @@ -3773,7 +3778,7 @@ This policy setting allows you to have file names sorted literally (as in Window Removes shortcut menus from the desktop and File Explorer. Shortcut menus appear when you right-click an item. -- If you enable this setting, menus do not appear when you right-click the desktop or when you right-click the items in File Explorer. This setting does not prevent users from using other methods to issue commands available on the shortcut menus. +If you enable this setting, menus do not appear when you right-click the desktop or when you right-click the items in File Explorer. This setting does not prevent users from using other methods to issue commands available on the shortcut menus. @@ -3831,7 +3836,7 @@ Removes shortcut menus from the desktop and File Explorer. Shortcut menus appear Prevents users from using My Computer to gain access to the content of selected drives. -- If you enable this setting, users can browse the directory structure of the selected drives in My Computer or File Explorer, but they cannot open folders and access the contents. Also, they cannot use the Run dialog box or the Map Network Drive dialog box to view the directories on these drives. +If you enable this setting, users can browse the directory structure of the selected drives in My Computer or File Explorer, but they cannot open folders and access the contents. Also, they cannot use the Run dialog box or the Map Network Drive dialog box to view the directories on these drives. To use this setting, select a drive or combination of drives from the drop-down list. To allow access to all drive directories, disable this setting or select the "Do not restrict drives" option from the drop-down list. @@ -4039,7 +4044,7 @@ The list of Common Shell Folders that may be specified: Desktop, Recent Places, Documents, Pictures, Music, Recently Changed, Attachments and Saved Searches. -- If you disable or do not configure this setting the default list of items will be displayed in the Places Bar. +If you disable or do not configure this setting the default list of items will be displayed in the Places Bar. > [!NOTE] > In Windows Vista, this policy setting applies only to applications that are using the Windows XP common dialog box style. This policy setting does not apply to the new Windows Vista common dialog box style. @@ -4101,7 +4106,7 @@ Prompts users for alternate logon credentials during network-based installations This setting displays the "Install Program As Other User" dialog box even when a program is being installed from files on a network computer across a local area network connection. -- If you disable this setting or do not configure it, this dialog box appears only when users are installing programs from local media. +If you disable this setting or do not configure it, this dialog box appears only when users are installing programs from local media. The "Install Program as Other User" dialog box prompts the current user for the user name and password of an administrator. This setting allows administrators who have logged on as regular users to install programs without logging off and logging on again using their administrator credentials. diff --git a/windows/client-management/mdm/policy-csp-admx-winlogon.md b/windows/client-management/mdm/policy-csp-admx-winlogon.md index 97b2a94a4a..3f211bcf84 100644 --- a/windows/client-management/mdm/policy-csp-admx-winlogon.md +++ b/windows/client-management/mdm/policy-csp-admx-winlogon.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_WinLogon Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -45,6 +45,7 @@ ms.topic: reference Specifies an alternate user interface. The Explorer program (%windir%\explorer.exe) creates the familiar Windows interface, but you can use this setting to specify an alternate interface. + - If you enable this setting, the system starts the interface you specify instead of Explorer.exe. To use this setting, copy your interface program to a network share or to your system drive. Then, enable this setting, and type the name of the interface program, including the file name extension, in the Shell name text box. If the interface program file is not located in a folder specified in the Path environment variable for your system, enter the fully qualified path to the file. @@ -176,7 +177,7 @@ This policy controls whether the logged on user should be notified when his logo - If you disable or do not configure this setting, users receive warnings before the logon hours expire, if actions have been set to occur when the logon hours expire. > [!NOTE] -> If you configure this setting, you might want to examine and appropriately configure the "Set action to take when logon hours expire" setting. If "Set action to take when logon hours expire" is disabled or not configured, the "Remove logon hours expiration warnings" setting will have no effect, and users receive no warnings about logon hour expiration +> If you configure this setting, you might want to examine and appropriately configure the "Set action to take when logon hours expire" setting. If "Set action to take when logon hours expire" is disabled or not configured, the "Remove logon hours expiration warnings" setting will have no effect, and users receive no warnings about logon hour expiration. @@ -243,7 +244,7 @@ If you choose to log off a user, the user cannot log on again except during perm - If you disable or do not configure this setting, the system takes no action when the user's logon hours expire. The user can continue the existing session, but cannot log on to a new session. > [!NOTE] -> If you configure this setting, you might want to examine and appropriately configure the "Remove logon hours expiration warnings" setting +> If you configure this setting, you might want to examine and appropriately configure the "Remove logon hours expiration warnings" setting. diff --git a/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md b/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md index 1ba24c4abe..1d2efeeadc 100644 --- a/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md +++ b/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_WorkFoldersClient Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -165,7 +165,7 @@ This policy setting specifies the Work Folders server for affected users, as wel The "Work Folders URL" can specify either the URL used by the organization for Work Folders discovery, or the specific URL of the file server that stores the affected users' data. -The "Work Folders Local Path" specifies the local folder used on the client machine to sync files. This path may contain environment variables +The "Work Folders Local Path" specifies the local folder used on the client machine to sync files. This path may contain environment variables. > [!NOTE] > In order for this configuration to take effect, a valid 'Work Folders URL' must also be specified. diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index 849c9609bc..dfa18c48f2 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -4,7 +4,7 @@ description: Learn more about the ApplicationDefaults Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,8 +36,19 @@ ms.topic: reference - -This policy allows an administrator to set default file type and protocol associations. When set, default associations will be applied on sign-in to the PC. The association file can be created using the DISM tool (dism /online /export-defaultappassociations:appassoc. xml), and then needs to be base64 encoded before being added to SyncML. If policy is enabled and the client machine is Azure Active Directory joined, the associations assigned in SyncML will be processed and default associations will be applied. + +This policy specifies the path to a file (e.g. either stored locally or on a network location) that contains file type and protocol default application associations. This file can be created using the DISM tool. + +For example: +Dism.exe /Online /Export-DefaultAppAssociations:C:\AppAssoc.txt + +For more information, refer to the DISM documentation on TechNet. + +If this group policy is enabled and the client machine is domain-joined, the file will be processed and default associations will be applied at logon time. + +If the group policy is not configured, disabled, or the client machine is not domain-joined, no default associations will be applied at logon time. + +If the policy is enabled, disabled, or not configured, users will still be able to override default file type and protocol associations. @@ -60,7 +71,7 @@ This policy allows an administrator to set default file type and protocol associ |:--|:--| | Name | DefaultAssociationsConfiguration | | Friendly Name | Set a default associations configuration file | -| Element Name | Default Associations Configuration File | +| Element Name | Default Associations Configuration File. | | Location | Computer Configuration | | Path | WindowsComponents > File Explorer | | Registry Key Name | Software\Policies\Microsoft\Windows\System | @@ -147,7 +158,7 @@ Enabling this policy setting enables web-to-app linking so that apps can be laun Disabling this policy disables web-to-app linking and http(s) URIs will be opened in the default browser instead of launching the associated app. -- If you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot. +If you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot. diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 8e2b18b64d..6cd0b742ae 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -4,7 +4,7 @@ description: Learn more about the ApplicationManagement Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -309,8 +309,7 @@ Allows or denies development of Microsoft Store applications and installing them Windows Game Recording and Broadcasting. -This setting enables or disables the Windows Game Recording and Broadcasting features. -- If you disable this setting, Windows Game Recording will not be allowed. +This setting enables or disables the Windows Game Recording and Broadcasting features. If you disable this setting, Windows Game Recording will not be allowed. If the setting is enabled or not configured, then Recording and Broadcasting (streaming) will be allowed. @@ -446,7 +445,7 @@ Manages a Windows app's ability to share data between users who have installed t -This policy is deprecated +This policy is deprecated. @@ -498,7 +497,7 @@ This policy is deprecated -This policy is deprecated +This policy is deprecated. diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index f4f3975002..8163149bf4 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -4,7 +4,7 @@ description: Learn more about the AppVirtualization Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -1526,7 +1526,7 @@ Specifies that streamed package contents will be not be saved to the local hard -If enabled, the App-V client will support BrancheCache compatible HTTP streaming. If BranchCache support is not desired, this should be disabled. The client can then apply HTTP optimizations which are incompatible with BranchCache +If enabled, the App-V client will support BrancheCache compatible HTTP streaming. If BranchCache support is not desired, this should be disabled. The client can then apply HTTP optimizations which are incompatible with BranchCache. diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 46796cc58d..f558a57eaa 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -4,7 +4,7 @@ description: Learn more about the Audit Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/10/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -98,7 +98,8 @@ Volume: High on domain controllers. -This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. +This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. +- If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. - If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. @@ -160,7 +161,8 @@ Volume: High on Kerberos Key Distribution Center servers. -This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. +This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. +- If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. - If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. @@ -404,7 +406,8 @@ Volume: Low on a client computer. Medium on a domain controller or a network ser -This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. +- If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. @@ -466,7 +469,8 @@ Volume: High. -This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. +- If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. @@ -528,7 +532,8 @@ Volume: High. -This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. +- If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. @@ -590,7 +595,8 @@ Volume: High. -This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. +This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. +- If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. - If you do not configure this policy setting, no audit event is generated when a logon session is closed. @@ -713,7 +719,8 @@ Volume: Low on a client computer. Medium on a domain controller or a network ser -This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +- If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. - If you do not configure this policy settings, IAS and NAP user access requests are not audited. @@ -836,7 +843,7 @@ Volume: Low. -This policy setting allows you to audit events generated by special logons such as the following: The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](). +This policy setting allows you to audit events generated by special logons such as the following : The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121697). @@ -958,7 +965,8 @@ Volume: Low on a client computer. Medium on a domain controller or a network ser -This policy setting allows you to audit events generated by changes to application groups such as the following: Application group is created, changed, or deleted. Member is added or removed from an application group. If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes to application groups such as the following: Application group is created, changed, or deleted. Member is added or removed from an application group. +- If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when an application group changes. @@ -1020,7 +1028,8 @@ Volume: Low. -This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. +- If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a computer account changes. @@ -1082,7 +1091,8 @@ Volume: Low. -This policy setting allows you to audit events generated by changes to distribution groups such as the following Distribution group is created, changed, or deleted. Member is added or removed from a distribution group. Distribution group type is changed. If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes to distribution groups such as the following: Distribution group is created, changed, or deleted. Member is added or removed from a distribution group. Distribution group type is changed. +- If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a distribution group changes. > [!NOTE] @@ -1147,7 +1157,7 @@ Volume: Low. -This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. Changes to the Default Domain Group Policy under the following Group Policy paths: Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy +This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. Changes to the Default Domain Group Policy under the following Group Policy paths: Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy. @@ -1208,7 +1218,8 @@ Volume: Low. -This policy setting allows you to audit events generated by changes to security groups such as the following: Security group is created, changed, or deleted. Member is added or removed from a security group. Group type is changed. If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes to security groups such as the following: Security group is created, changed, or deleted. Member is added or removed from a security group. Group type is changed. +- If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a security group changes. @@ -1270,7 +1281,8 @@ Volume: Low. -This policy setting allows you to audit changes to user accounts. Events include the following: A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. A user account's password is set or changed. A security identifier (SID) is added to the SID History of a user account. The Directory Services Restore Mode password is configured. Permissions on administrative user accounts are changed. Credential Manager credentials are backed up or restored. If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit changes to user accounts. Events include the following: A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. A user account's password is set or changed. A security identifier (SID) is added to the SID History of a user account. The Directory Services Restore Mode password is configured. Permissions on administrative user accounts are changed. Credential Manager credentials are backed up or restored. +- If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a user account changes. @@ -1332,7 +1344,8 @@ Volume: Low. -This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see [How to Use Data Protection](/dotnet/standard/security/how-to-use-data-protection). If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. +This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see [How to Use Data Protection](/dotnet/standard/security/how-to-use-data-protection). +- If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. - If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. @@ -1394,7 +1407,8 @@ Volume: Low. -This policy setting allows you to audit when plug and play detects an external device. If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. +This policy setting allows you to audit when plug and play detects an external device. +- If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. - If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. @@ -1456,7 +1470,8 @@ Volume: Low. -This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. +- If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a process is created. @@ -1518,7 +1533,8 @@ Volume: Depends on how the computer is used. -This policy setting allows you to audit events generated when a process ends. If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated when a process ends. +- If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a process ends. @@ -1580,7 +1596,8 @@ Volume: Depends on how the computer is used. -This policy setting allows you to audit inbound remote procedure call (RPC) connections. If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit inbound remote procedure call (RPC) connections. +- If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. @@ -1828,7 +1845,8 @@ Volume: High on domain controllers. None on client computers. This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. When possible, events logged in this subcategory indicate the old and new values of the object's properties. Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. > [!NOTE] -> Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. +> Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. +- If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. - If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. @@ -1890,7 +1908,8 @@ Volume: High on domain controllers only. -This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. +This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. +- If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. - If you do not configure this policy setting, no audit event is generated during AD DS replication. @@ -2135,10 +2154,12 @@ Volume: Medium or Low on computers running Active Directory Certificate Services -This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. +This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. +- If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. > [!NOTE] > There are no system access control lists (SACLs) for shared folders. + - If this policy setting is enabled, access to all shared files and folders on the system is audited. @@ -2200,11 +2221,13 @@ Volume: High on a file server or domain controller because of SYSVOL network acc -This policy setting allows you to audit attempts to access a shared folder. If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. +This policy setting allows you to audit attempts to access a shared folder. +- If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. - If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. > [!NOTE] > There are no system access control lists (SACLs) for shared folders. + - If this policy setting is enabled, access to all shared folders on the system is audited. @@ -2266,7 +2289,8 @@ Volume: High on a file server or domain controller because of SYSVOL network acc -This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see . If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see< https://go.microsoft.com/fwlink/?LinkId=122083>. +- If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. > [!NOTE] @@ -2331,7 +2355,8 @@ Volume: Depends on how the file system SACLs are configured. -This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: The Windows Firewall Service blocks an application from accepting incoming connections on the network. The WFP allows a connection. The WFP blocks a connection. The WFP permits a bind to a local port. The WFP blocks a bind to a local port. The WFP allows a connection. The WFP blocks a connection. The WFP permits an application or service to listen on a port for incoming connections. The WFP blocks an application or service to listen on a port for incoming connections. If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. +This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: The Windows Firewall Service blocks an application from accepting incoming connections on the network. The WFP allows a connection. The WFP blocks a connection. The WFP permits a bind to a local port. The WFP blocks a bind to a local port. The WFP allows a connection. The WFP blocks a connection. The WFP permits an application or service to listen on a port for incoming connections. The WFP blocks an application or service to listen on a port for incoming connections. +- If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. - If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. @@ -2454,7 +2479,8 @@ Volume: High. -This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. +- If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a handle is manipulated. > [!NOTE] @@ -2522,7 +2548,7 @@ Volume: Depends on how SACLs are configured. This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events. > [!NOTE] -> The Audit Audit the access of global system objects policy setting controls the default SACL of kernel objects. +> The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. @@ -2644,7 +2670,8 @@ Volume: Low. -This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. +- If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. > [!NOTE] @@ -2709,7 +2736,8 @@ Volume: Depends on how registry SACLs are configured. -This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. +- If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. @@ -2770,11 +2798,12 @@ This policy setting allows you to audit user attempts to access file system obje -This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. SAM objects include the following SAM_ALIAS -- A local group. SAM_GROUP -- A group that is not a local group. SAM_USER - A user account. SAM_DOMAIN - A domain. SAM_SERVER - A computer account. If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. SAM objects include the following: SAM_ALIAS -- A local group. SAM_GROUP -- A group that is not a local group. SAM_USER - A user account. SAM_DOMAIN - A domain. SAM_SERVER - A computer account. +- If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. > [!NOTE] -> Only the System Access Control List (SACL) for SAM_SERVER can be modified. Volume High on domain controllers. For information about SACL, see [Access control lists](/windows/win32/secauthz/access-control-lists). +> Only the System Access Control List (SACL) for SAM_SERVER can be modified. Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see [article 841001 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121698). @@ -2835,7 +2864,8 @@ Volume: High on domain controllers. For more information about reducing the numb -This policy setting allows you to audit events generated by changes to the authentication policy such as the following Creation of forest and domain trusts. Modification of forest and domain trusts. Removal of forest and domain trusts. Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. Granting of any of the following user rights to a user or group Access This Computer From the Network. Allow Logon Locally. Allow Logon Through Terminal Services. Logon as a Batch Job. Logon a Service. Namespace collision. For example, when a new trust has the same name as an existing namespace name. If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes to the authentication policy such as the following: Creation of forest and domain trusts. Modification of forest and domain trusts. Removal of forest and domain trusts. Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. Granting of any of the following user rights to a user or group: Access This Computer From the Network. Allow Logon Locally. Allow Logon Through Terminal Services. Logon as a Batch Job. Logon a Service. Namespace collision. For example, when a new trust has the same name as an existing namespace name. +- If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. > [!NOTE] @@ -2900,7 +2930,8 @@ Volume: Low. -This policy setting allows you to audit events generated by changes to the authorization policy such as the following: Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the "Authentication Policy Change" subcategory. Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the "Authentication Policy Change" subcategory. Changes in the Encrypted File System (EFS) policy. Changes to the Resource attributes of an object. Changes to the Central Access Policy (CAP) applied to an object. If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes to the authorization policy such as the following: Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the "Authentication Policy Change" subcategory. Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the "Authentication Policy Change" subcategory. Changes in the Encrypted File System (EFS) policy. Changes to the Resource attributes of an object. Changes to the Central Access Policy (CAP) applied to an object. +- If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when the authorization policy changes. @@ -2962,7 +2993,8 @@ Volume: Low. -This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: IPsec services status. Changes to IPsec policy settings. Changes to Windows Firewall policy settings. Changes to WFP providers and engine. If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: IPsec services status. Changes to IPsec policy settings. Changes to Windows Firewall policy settings. Changes to WFP providers and engine. +- If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. @@ -3024,7 +3056,8 @@ Volume: Low. -This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: Reporting of active policies when Windows Firewall service starts. Changes to Windows Firewall rules. Changes to Windows Firewall exception list. Changes to Windows Firewall settings. Rules ignored or not applied by Windows Firewall Service. Changes to Windows Firewall Group Policy settings. If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: Reporting of active policies when Windows Firewall service starts. Changes to Windows Firewall rules. Changes to Windows Firewall exception list. Changes to Windows Firewall settings. Rules ignored or not applied by Windows Firewall Service. Changes to Windows Firewall Group Policy settings. +- If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. @@ -3147,7 +3180,7 @@ Volume: Low. -This policy setting allows you to audit changes in the security audit policy settings such as the following Settings permissions and audit settings on the Audit Policy object. Changes to the system audit policy. Registration of security event sources. De-registration of security event sources. Changes to the per-user audit settings. Changes to the value of CrashOnAuditFail. Changes to the system access control list on a file system or registry object. Changes to the Special Groups list. +This policy setting allows you to audit changes in the security audit policy settings such as the following: Settings permissions and audit settings on the Audit Policy object. Changes to the system audit policy. Registration of security event sources. De-registration of security event sources. Changes to the per-user audit settings. Changes to the value of CrashOnAuditFail. Changes to the system access control list on a file system or registry object. Changes to the Special Groups list. > [!NOTE] > System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. @@ -3212,7 +3245,8 @@ Volume: Low. This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). The following privileges are non-sensitive: Access Credential Manager as a trusted caller. Access this computer from the network. Add workstations to domain. Adjust memory quotas for a process. Allow log on locally. Allow log on through Terminal Services. Bypass traverse checking. Change the system time. Create a pagefile. Create global objects. -Create permanent shared objects. Create symbolic links. Deny access this computer from the network. Deny log on as a batch job. Deny log on as a service. Deny log on locally. Deny log on through Terminal Services. Force shutdown from a remote system. Increase a process working set. Increase scheduling priority. Lock pages in memory. Log on as a batch job. Log on as a service. Modify an object label. Perform volume maintenance tasks. Profile single process. Profile system performance. Remove computer from docking station. Shut down the system. Synchronize directory service data. If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. +Create permanent shared objects. Create symbolic links. Deny access this computer from the network. Deny log on as a batch job. Deny log on as a service. Deny log on locally. Deny log on through Terminal Services. Force shutdown from a remote system. Increase a process working set. Increase scheduling priority. Lock pages in memory. Log on as a batch job. Log on as a service. Modify an object label. Perform volume maintenance tasks. Profile single process. Profile system performance. Remove computer from docking station. Shut down the system. Synchronize directory service data. +- If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. - If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. @@ -3334,7 +3368,8 @@ Not used. -This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: A privileged service is called. One of the following privileges are called: Act as part of the operating system. Back up files and directories. Create a token object. Debug programs. Enable computer and user accounts to be trusted for delegation. Generate security audits. Impersonate a client after authentication. Load and unload device drivers. Manage auditing and security log. Modify firmware environment values. Replace a process-level token. Restore files and directories. Take ownership of files or other objects. If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. +This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: A privileged service is called. One of the following privileges are called: Act as part of the operating system. Back up files and directories. Create a token object. Debug programs. Enable computer and user accounts to be trusted for delegation. Generate security audits. Impersonate a client after authentication. Load and unload device drivers. Manage auditing and security log. Modify firmware environment values. Replace a process-level token. Restore files and directories. Take ownership of files or other objects. +- If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. - If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. @@ -3396,7 +3431,8 @@ Volume: High. -This policy setting allows you to audit events generated by the IPsec filter driver such as the following: Startup and shutdown of the IPsec services. Network packets dropped due to integrity check failure. Network packets dropped due to replay check failure. Network packets dropped due to being in plaintext. Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. Inability to process IPsec filters. If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by the IPsec filter driver such as the following: Startup and shutdown of the IPsec services. Network packets dropped due to integrity check failure. Network packets dropped due to replay check failure. Network packets dropped due to being in plaintext. Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. Inability to process IPsec filters. +- If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. @@ -3580,7 +3616,8 @@ Volume: Low. -This policy setting allows you to audit events related to security system extensions or services such as the following: A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events related to security system extensions or services such as the following: A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. +- If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 019ddd4885..3fa1f38453 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -4,7 +4,7 @@ description: Learn more about the Authentication Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,9 @@ ms.topic: reference # Policy CSP - Authentication +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + @@ -356,7 +359,7 @@ Your organization's PIN reset or web sign-in authentication flow is expected to -Specifies whether new non-admin AAD accounts should auto-connect to pre-created candidate local accounts +Specifies whether new non-admin AAD accounts should auto-connect to pre-created candidate local accounts. @@ -394,6 +397,56 @@ This policy is intended for use on Shared PCs to enable a quick first sign-in ex + +## EnablePasswordlessExperience + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Authentication/EnablePasswordlessExperience +``` + + + + +Specifies whether connected users on AADJ devices receive a Passwordless experience on Windows. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | The feature defaults to the existing edition and device capabilities. | +| 1 | Enabled. The Passwordless experience will be enabled on Windows. | +| 2 | Disabled. The Passwordless experience will not be enabled on Windows. | + + + + + + + + ## EnableWebSignIn @@ -411,7 +464,7 @@ This policy is intended for use on Shared PCs to enable a quick first sign-in ex -Specifies whether web-based sign-in is allowed for signing in to Windows +Specifies whether web-based sign-in is allowed for signing in to Windows. diff --git a/windows/client-management/mdm/policy-csp-bits.md b/windows/client-management/mdm/policy-csp-bits.md index 332ce05cc6..a51ea4a85a 100644 --- a/windows/client-management/mdm/policy-csp-bits.md +++ b/windows/client-management/mdm/policy-csp-bits.md @@ -4,7 +4,7 @@ description: Learn more about the BITS Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,12 +36,19 @@ ms.topic: reference - -This policy specifies the bandwidth throttling end time that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. This policy is based on the 24-hour clock. Value type is integer. Default value is 17 (5 PM). Supported value range 0 - 23. You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 800 A. M. to 500 P. M. , and use all available unused bandwidth the rest of the day's hours. Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. -- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth + +This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers. (This policy setting does not affect foreground transfers.) + +You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A. M. to 5:00 P. M., and use all available unused bandwidth the rest of the day's hours. + +- If you enable this policy setting, BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. + +- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. > [!NOTE] -> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the Limit the maximum network bandwidth used for Peercaching policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). +> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. + +Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). @@ -66,7 +73,7 @@ This policy specifies the bandwidth throttling end time that Background Intellig |:--|:--| | Name | BITS_MaxBandwidth | | Friendly Name | Limit the maximum network bandwidth for BITS background transfers | -| Element Name | to | +| Element Name | to. | | Location | Computer Configuration | | Path | Network > Background Intelligent Transfer Service (BITS) | | Registry Key Name | Software\Policies\Microsoft\Windows\BITS | @@ -95,12 +102,19 @@ This policy specifies the bandwidth throttling end time that Background Intellig - -This policy specifies the bandwidth throttling start time that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. This policy is based on the 24-hour clock. Value type is integer. Default value is 8 (8 am). Supported value range 0 - 23. You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 800 A. M. to 500 P. M. , and use all available unused bandwidth the rest of the day's hours. Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. -- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth + +This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers. (This policy setting does not affect foreground transfers.) + +You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A. M. to 5:00 P. M., and use all available unused bandwidth the rest of the day's hours. + +- If you enable this policy setting, BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. + +- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. > [!NOTE] -> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the Limit the maximum network bandwidth used for Peercaching policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). +> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. + +Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). @@ -125,7 +139,7 @@ This policy specifies the bandwidth throttling start time that Background Intell |:--|:--| | Name | BITS_MaxBandwidth | | Friendly Name | Limit the maximum network bandwidth for BITS background transfers | -| Element Name | From | +| Element Name | From. | | Location | Computer Configuration | | Path | Network > Background Intelligent Transfer Service (BITS) | | Registry Key Name | Software\Policies\Microsoft\Windows\BITS | @@ -154,12 +168,19 @@ This policy specifies the bandwidth throttling start time that Background Intell - -This policy specifies the bandwidth throttling transfer rate in kilobits per second (Kbps) that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. Value type is integer. Default value is 1000. Supported value range 0 - 4294967200. You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 800 A. M. to 500 P. M. , and use all available unused bandwidth the rest of the day's hours. Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. -- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth + +This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers. (This policy setting does not affect foreground transfers.) + +You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A. M. to 5:00 P. M., and use all available unused bandwidth the rest of the day's hours. + +- If you enable this policy setting, BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. + +- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. > [!NOTE] -> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the Limit the maximum network bandwidth used for Peercaching policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). +> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. + +Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). @@ -184,7 +205,7 @@ This policy specifies the bandwidth throttling transfer rate in kilobits per sec |:--|:--| | Name | BITS_MaxBandwidth | | Friendly Name | Limit the maximum network bandwidth for BITS background transfers | -| Element Name | Limit background transfer rate (Kbps) to | +| Element Name | Limit background transfer rate (Kbps) to. | | Location | Computer Configuration | | Path | Network > Background Intelligent Transfer Service (BITS) | | Registry Key Name | Software\Policies\Microsoft\Windows\BITS | @@ -213,9 +234,27 @@ This policy specifies the bandwidth throttling transfer rate in kilobits per sec - -This policy setting defines the default behavior that the Background Intelligent Transfer Service (BITS) uses for background transfers when the system is connected to a costed network (3G, etc. ). Download behavior policies further limit the network usage of background transfers. -- If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority. For example, you can specify that background jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are:1 - Always transfer2 - Transfer unless roaming3 - Transfer unless surcharge applies (when not roaming or overcap)4 - Transfer unless nearing limit (when not roaming or nearing cap)5 - Transfer only if unconstrained + +This policy setting defines the default behavior that the Background Intelligent Transfer Service (BITS) uses for background transfers when the system is connected to a costed network (3G, etc.). Download behavior policies further limit the network usage of background transfers. + +If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority. + +For example, you can specify that background jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are: + - Always transfer + - Transfer unless roaming + - Transfer unless surcharge applies (when not roaming or overcap) + - Transfer unless nearing limit (when not roaming or nearing cap) + - Transfer only if unconstrained + - Custom--allows you to specify a bitmask, in which the bits describe cost states allowed or disallowed for this priority: (bits described here) +0x1 - The cost is unknown or the connection is unlimited and is considered to be unrestricted of usage charges and capacity constraints. +0x2 - The usage of this connection is unrestricted up to a certain data limit +0x4 - The usage of this connection is unrestricted up to a certain data limit and plan usage is less than 80 percent of the limit. +0x8 - Usage of this connection is unrestricted up to a certain data limit and plan usage is between 80 percent and 100 percent of the limit. +0x10 - Usage of this connection is unrestricted up to a certain data limit, which has been exceeded. Surcharge applied or unknown. +0x20 - Usage of this connection is unrestricted up to a certain data limit, which has been exceeded. No surcharge applies, but speeds are likely reduced. +0x40 - The connection is costed on a per-byte basis. +0x80 - The connection is roaming. +0x80000000 - Ignore congestion. @@ -251,7 +290,7 @@ This policy setting defines the default behavior that the Background Intelligent |:--|:--| | Name | BITS_SetTransferPolicyOnCostedNetwork | | Friendly Name | Set default download behavior for BITS jobs on costed networks | -| Element Name | Normal | +| Element Name | Normal. | | Location | Computer Configuration | | Path | Network > Background Intelligent Transfer Service (BITS) | | Registry Key Name | Software\Policies\Microsoft\Windows\BITS\TransferPolicy | @@ -280,9 +319,27 @@ This policy setting defines the default behavior that the Background Intelligent - -This policy setting defines the default behavior that the foreground Intelligent Transfer Service (BITS) uses for foreground transfers when the system is connected to a costed network (3G, etc. ). Download behavior policies further limit the network usage of foreground transfers. -- If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority. For example, you can specify that foreground jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are:1 - Always transfer2 - Transfer unless roaming3 - Transfer unless surcharge applies (when not roaming or overcap)4 - Transfer unless nearing limit (when not roaming or nearing cap)5 - Transfer only if unconstrained + +This policy setting defines the default behavior that the Background Intelligent Transfer Service (BITS) uses for background transfers when the system is connected to a costed network (3G, etc.). Download behavior policies further limit the network usage of background transfers. + +If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority. + +For example, you can specify that background jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are: + - Always transfer + - Transfer unless roaming + - Transfer unless surcharge applies (when not roaming or overcap) + - Transfer unless nearing limit (when not roaming or nearing cap) + - Transfer only if unconstrained + - Custom--allows you to specify a bitmask, in which the bits describe cost states allowed or disallowed for this priority: (bits described here) +0x1 - The cost is unknown or the connection is unlimited and is considered to be unrestricted of usage charges and capacity constraints. +0x2 - The usage of this connection is unrestricted up to a certain data limit +0x4 - The usage of this connection is unrestricted up to a certain data limit and plan usage is less than 80 percent of the limit. +0x8 - Usage of this connection is unrestricted up to a certain data limit and plan usage is between 80 percent and 100 percent of the limit. +0x10 - Usage of this connection is unrestricted up to a certain data limit, which has been exceeded. Surcharge applied or unknown. +0x20 - Usage of this connection is unrestricted up to a certain data limit, which has been exceeded. No surcharge applies, but speeds are likely reduced. +0x40 - The connection is costed on a per-byte basis. +0x80 - The connection is roaming. +0x80000000 - Ignore congestion. @@ -318,7 +375,7 @@ This policy setting defines the default behavior that the foreground Intelligent |:--|:--| | Name | BITS_SetTransferPolicyOnCostedNetwork | | Friendly Name | Set default download behavior for BITS jobs on costed networks | -| Element Name | Foreground | +| Element Name | Foreground. | | Location | Computer Configuration | | Path | Network > Background Intelligent Transfer Service (BITS) | | Registry Key Name | Software\Policies\Microsoft\Windows\BITS\TransferPolicy | @@ -347,11 +404,17 @@ This policy setting defines the default behavior that the foreground Intelligent - -This policy setting specifies the number of days a pending BITS job can remain inactive before the job is considered abandoned. By default BITS will wait 90 days before considering an inactive job abandoned. After a job is determined to be abandoned, the job is deleted from BITS and any downloaded files for the job are deleted from the disk + +This policy setting specifies the number of days a pending BITS job can remain inactive before the job is considered abandoned. By default BITS will wait 90 days before considering an inactive job abandoned. After a job is determined to be abandoned, the job is deleted from BITS and any downloaded files for the job are deleted from the disk. > [!NOTE] -> Any property changes to the job or any successful download action will reset this timeout. Value type is integer. Default is 90 days. Supported values range 0 - 999. Consider increasing the timeout value if computers tend to stay offline for a long period of time and still have pending jobs. Consider decreasing this value if you are concerned about orphaned jobs occupying disk space. +> Any property changes to the job or any successful download action will reset this timeout. + +Consider increasing the timeout value if computers tend to stay offline for a long period of time and still have pending jobs. +Consider decreasing this value if you are concerned about orphaned jobs occupying disk space. + +- If you enable this policy setting, you can configure the inactive job timeout to specified number of days. + - If you disable or do not configure this policy setting, the default value of 90 (days) will be used for the inactive job timeout. @@ -377,7 +440,7 @@ This policy setting specifies the number of days a pending BITS job can remain i |:--|:--| | Name | BITS_Job_Timeout | | Friendly Name | Timeout for inactive BITS jobs | -| Element Name | Inactive Job Timeout in Days | +| Element Name | Inactive Job Timeout in Days. | | Location | Computer Configuration | | Path | Network > Background Intelligent Transfer Service (BITS) | | Registry Key Name | Software\Policies\Microsoft\Windows\BITS | diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index e2910d975d..d3031acbca 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -4,7 +4,7 @@ description: Learn more about the Bluetooth Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -272,7 +272,7 @@ Sets the local Bluetooth device name. If this is set, the value that it is set t -Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7. CAA-436. C-8. BF0-78. CD0FFBD4AF}. The default value is an empty string. For more information, see ServicesAllowedList usage guide +Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7. CAA-436. C-8. BF0-78. CD0FFBD4AF}. The default value is an empty string. For more information, see ServicesAllowedList usage guide. diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 8f7766c3a5..7dc55c850b 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -4,7 +4,7 @@ description: Learn more about the Browser Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -200,7 +200,7 @@ To verify AllowAutofill is set to 0 (not allowed): -This policy is deprecated +This policy is deprecated. @@ -305,8 +305,15 @@ This policy setting lets you decide whether Microsoft Edge can automatically upd - -This setting lets you configure how your company deals with cookies. + +This setting lets you configure how to work with cookies. + +- If you enable this setting, you must also decide whether to: +Allow all cookies (default): Allows all cookies from all websites. +Block all cookies: Blocks all cookies from all websites. +Block only 3rd-party cookies: Blocks only cookies from 3rd-party websites. + +- If you disable or don't configure this setting, all cookies are allowed from all sites. @@ -340,7 +347,7 @@ This setting lets you configure how your company deals with cookies. |:--|:--| | Name | Cookies | | Friendly Name | Configure cookies | -| Element Name | Configure Cookies | +| Element Name | Configure Cookies. | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Main | @@ -1483,8 +1490,8 @@ Computer Configuration > Administrative Templates > Windows Components > App Pac Supported versions: Microsoft Edge on Windows 10, version 1809 Default setting: Disabled or not configured Related policies: -- Allows development of Windows Store apps and installing them from an integrated development environment (IDE) -- Allow all trusted apps to install + - Allows development of Windows Store apps and installing them from an integrated development environment (IDE) + - Allow all trusted apps to install @@ -1920,9 +1927,17 @@ To verify whether browsing data is cleared on exit (ClearBrowsingDataOnExit is s - -Allows you to add up to 5 additional search engines for MDM-enrolled devices. If this setting is turned on, you can add up to 5 additional search engines for your employee. For each additional search engine you wish to add, you must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. This policy does not affect the default search engine. Employees will not be able to remove these search engines, but they can set any one of these as the default. If this setting is not configured, the search engines are the ones specified in the App settings. -- If this setting is disabled, the search engines you had added will be deleted from your employee's machine. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. + +This policy setting lets you add up to 5 additional search engines, which can't be removed by your employees, but can be made a personal default engine. This setting doesn't set the default search engine. For that, you must use the "Set default search engine" setting. + +**Important** +This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy). + +- If you enable this setting, you can add up to 5 additional search engines. For each additional engine, you must also add a link to your OpenSearch XML file, including at least the short name and https: URL of the search engine. For more info about creating the OpenSearch XML file, see the Understanding OpenSearch Standards (https://msdn.microsoft.com/library/dd163546.aspx) topic. Use this format to specify the link(s) you wish to add: `` `` + +- If you disable this setting, any added search engines are removed from your employee's devices. + +- If you don't configure this setting, the search engine list is set to what is specified in App settings. @@ -1945,7 +1960,7 @@ Allows you to add up to 5 additional search engines for MDM-enrolled devices. If |:--|:--| | Name | ConfigureAdditionalSearchEngines | | Friendly Name | Configure additional search engines | -| Element Name | Use this format to specify the link(s) you wish to add: `<>` `<>` | +| Element Name | Use this format to specify the link(s) you wish to add: `` `` | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\OpenSearch | @@ -2051,8 +2066,23 @@ If not configured, the favorites bar is hidden but is visible on the Start and N - -The Home button loads either the default Start page, the New tab page, or a URL defined in the Set Home Button URL policy. By default, this policy is disabled or not configured and clicking the home button loads the default Start page. When enabled, the home button is locked down preventing your users from making changes in Microsoft Edge's UI settings. To let your users change the Microsoft Edge UI settings, enable the Unlock Home Button policy. If Enabled AND: - Show home button & set to Start page is selected, clicking the home button loads the Start page. - Show home button & set to New tab page is selected, clicking the home button loads a New tab page. - Show home button & set a specific page is selected, clicking the home button loads the URL specified in the Set Home Button URL policy. - Hide home button is selected, the home button is hidden in Microsoft Edge. Default setting: Disabled or not configured Related policies: - Set Home Button URL - Unlock Home Button + +The Home button loads either the default Start page, the New tab page, or a URL defined in the Set Home Button URL policy. + +By default, this policy is disabled or not configured and clicking the home button loads the default Start page. + +When enabled, the home button is locked down preventing your users from making changes in Microsoft Edge's UI settings. To let your users change the Microsoft Edge UI settings, enable the Unlock Home Button policy. + +If Enabled AND: + - Show home button & set to Start page is selected, clicking the home button loads the Start page. + - Show home button & set to New tab page is selected, clicking the home button loads a New tab page. + - Show home button & set a specific page is selected, clicking the home button loads the URL specified in the Set Home Button URL policy. + - Hide home button is selected, the home button is hidden in Microsoft Edge. + +Default setting: Disabled or not configured +Related policies: + - Set Home Button URL + - Unlock Home Button. @@ -2087,7 +2117,7 @@ The Home button loads either the default Start page, the New tab page, or a URL |:--|:--| | Name | ConfigureHomeButton | | Friendly Name | Configure Home Button | -| Element Name | Configure the Home Button | +| Element Name | Configure the Home Button. | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Internet Settings | @@ -2122,8 +2152,17 @@ The Home button loads either the default Start page, the New tab page, or a URL - -Configure how Microsoft Edge behaves when it's running in kiosk mode with assigned access, either as a single app or as one of multiple apps running on the kiosk device. You can control whether Microsoft Edge runs InPrivate full screen, InPrivate multi-tab with limited functionality, or normal Microsoft Edge. You need to configure Microsoft Edge in assigned access for this policy to take effect; otherwise, these settings are ignored. To learn more about assigned access and kiosk configuration, see "Configure kiosk and shared devices running Windows desktop editions" (. If enabled and set to 0 (Default or not configured): - If it's a single app, it runs InPrivate full screen for digital signage or interactive displays. - If it's one of many apps, Microsoft Edge runs as normal. If enabled and set to 1: - If it's a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can't minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking "End session." You can configure Microsoft Edge to restart after a period of inactivity by using the "Configure kiosk reset after idle timeout" policy. - If it's one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can't customize Microsoft Edge. + +Configure how Microsoft Edge behaves when it's running in kiosk mode with assigned access, either as a single app or as one of multiple apps running on the kiosk device. You can control whether Microsoft Edge runs InPrivate full screen, InPrivate multi-tab with limited functionality, or normal Microsoft Edge. + +You need to configure Microsoft Edge in assigned access for this policy to take effect; otherwise, these settings are ignored. To learn more about assigned access and kiosk configuration, see "Configure kiosk and shared devices running Windows desktop editions" (https://aka.ms/E489vw). + +If enabled and set to 0 (Default or not configured): + - If it's a single app, it runs InPrivate full screen for digital signage or interactive displays. + - If it's one of many apps, Microsoft Edge runs as normal. +If enabled and set to 1: + - If it's a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can't minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking "End session." You can configure Microsoft Edge to restart after a period of inactivity by using the "Configure kiosk reset after idle timeout" policy. + - If it's one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can't customize Microsoft Edge. @@ -2188,8 +2227,16 @@ Configure how Microsoft Edge behaves when it's running in kiosk mode with assign - -You can configure Microsoft Edge to reset to the configured start experience after a specified amount of idle time. The reset timer begins after the last user interaction. Resetting to the configured start experience deletes the current user's browsing data. If enabled, you can set the idle time in minutes (0-1440). You must set the Configure kiosk mode policy to 1 and configure Microsoft Edge in assigned access as a single app for this policy to work. Once the idle time meets the time specified, a confirmation message prompts the user to continue, and if no user action, Microsoft Edge resets after 30 seconds. If you set this policy to 0, Microsoft Edge does not use an idle timer. If disabled or not configured, the default value is 5 minutes. If you do not configure Microsoft Edge in assigned access, then this policy does not take effect. + +You can configure Microsoft Edge to reset to the configured start experience after a specified amount of idle time. The reset timer begins after the last user interaction. Resetting to the configured start experience deletes the current user's browsing data. + +If enabled, you can set the idle time in minutes (0-1440). You must set the Configure kiosk mode policy to 1 and configure Microsoft Edge in assigned access as a single app for this policy to work. Once the idle time meets the time specified, a confirmation message prompts the user to continue, and if no user action, Microsoft Edge resets after 30 seconds. + +If you set this policy to 0, Microsoft Edge does not use an idle timer. + +If disabled or not configured, the default value is 5 minutes. + +If you do not configure Microsoft Edge in assigned access, then this policy does not take effect. @@ -2247,8 +2294,23 @@ You can configure Microsoft Edge to reset to the configured start experience aft - -You can configure Microsoft Edge to lock down the Start page, preventing users from changing or customizing it. If enabled, you can choose one of the following options: - Start page: the Start page loads ignoring the Configure Start Pages policy. - New tab page: the New tab page loads ignoring the Configure Start Pages policy. - Previous pages: all tabs the user had open when Microsoft Edge last closed loads ignoring the Configure Start Pages policy. - A specific page or pages: the URL(s) specified with Configure Start Pages policy load(s). If selected, you must specify at least one URL in Configure Start Pages; otherwise, this policy is ignored. When enabled, and you want to make changes, you must first set the Disable Lockdown of Start Pages to not configured, make the changes to the Configure Open Edge With policy, and then enable the Disable Lockdown of Start Pages policy. If disabled or not configured, and you enable the Disable Lockdown of Start Pages policy, your users can change or customize the Start page. Default setting: A specific page or pages (default) Related policies: -Disable Lockdown of Start Pages -Configure Start Pages + +You can configure Microsoft Edge to lock down the Start page, preventing users from changing or customizing it. + +If enabled, you can choose one of the following options: + - Start page: the Start page loads ignoring the Configure Start Pages policy. + - New tab page: the New tab page loads ignoring the Configure Start Pages policy. + - Previous pages: all tabs the user had open when Microsoft Edge last closed loads ignoring the Configure Start Pages policy. + - A specific page or pages: the URL(s) specified with Configure Start Pages policy load(s). If selected, you must specify at least one URL in Configure Start Pages; otherwise, this policy is ignored. + +When enabled, and you want to make changes, you must first set the Disable Lockdown of Start Pages to not configured, make the changes to the Configure Open Microsoft Edge With policy, and then enable the Disable Lockdown of Start Pages policy. + +If disabled or not configured, and you enable the Disable Lockdown of Start Pages policy, your users can change or customize the Start page. + +Default setting: A specific page or pages (default) +Related policies: +-Disable Lockdown of Start Pages +-Configure Start Pages. @@ -2283,7 +2345,7 @@ You can configure Microsoft Edge to lock down the Start page, preventing users f |:--|:--| | Name | ConfigureOpenEdgeWith | | Friendly Name | Configure Open Microsoft Edge With | -| Element Name | Configure Open Microsoft Edge With | +| Element Name | Configure Open Microsoft Edge With. | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Internet Settings | @@ -2321,8 +2383,11 @@ You can configure Microsoft Edge to lock down the Start page, preventing users f - -Configures what browsing data will be sent to Microsoft 365 Analytics for devices belonging to an organization. + +You can configure Microsoft Edge to send intranet history only, internet history only, or both to Desktop Analytics for enterprise devices with a configured Commercial ID. If disabled or not configured, Microsoft Edge does not send browsing history data to Desktop Analytics. + +Supported versions: Microsoft Edge on Windows 10, version 1809 +Default setting: Disabled or not configured (no data collected or sent) @@ -2357,7 +2422,7 @@ Configures what browsing data will be sent to Microsoft 365 Analytics for device |:--|:--| | Name | ConfigureTelemetryForMicrosoft365Analytics | | Friendly Name | Configure collection of browsing data for Desktop Analytics | -| Element Name | Configure telemetry collection | +| Element Name | Configure telemetry collection. | | Location | Computer and User Configuration | | Path | WindowsComponents > Data Collection and Preview Builds | | Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection | @@ -2390,8 +2455,15 @@ Configures what browsing data will be sent to Microsoft 365 Analytics for device - -You can configure Microsoft Edge to disable the lockdown of Start pages allowing users to change or customize their start pages. To do this, you must also enable the Configure Start Pages or Configure Open Microsoft With policy. When enabled, all configured start pages are editable. Any Start page configured using the Configure Start pages policy is not locked down allowing users to edit their Start pages. If disabled or not configured, the Start pages configured in the Configure Start Pages policy cannot be changed and remain locked down. Supported devices: Domain-joined or MDM-enrolled Related policy: - Configure Start Pages - Configure Open Microsoft Edge With + +You can configure Microsoft Edge to disable the lockdown of Start pages allowing users to change or customize their start pages. To do this, you must also enable the Configure Start Pages or Configure Open Microsoft With policy. When enabled, all configured start pages are editable. Any Start page configured using the Configure Start pages policy is not locked down allowing users to edit their Start pages. + +If disabled or not configured, the Start pages configured in the Configure Start Pages policy cannot be changed and remain locked down. + +Supported devices: Domain-joined or MDM-enrolled +Related policy: + - Configure Start Pages + - Configure Open Microsoft Edge With. @@ -2532,8 +2604,12 @@ This policy setting lets you decide how much data to send to Microsoft about the - -This setting lets you configure whether your company uses Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy websites. + +This policy setting lets you configure whether to use Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy apps. + +- If you enable this setting, Microsoft Edge looks for the Enterprise Mode Site List XML file. This file includes the sites and domains that need to be viewed using Internet Explorer 11 and Enterprise Mode. + +- If you disable or don't configure this setting, Microsoft Edge won't use the Enterprise Mode Site List XML file. In this case, employees might experience compatibility problems while using legacy apps. @@ -2556,7 +2632,7 @@ This setting lets you configure whether your company uses Enterprise Mode and th |:--|:--| | Name | EnterpriseModeSiteList | | Friendly Name | Configure the Enterprise Mode Site List | -| Element Name | Type the location (URL) of your Enterprise Mode IE website list | +| Element Name | Type the location (URL) of your Enterprise Mode IE website list. | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Main\EnterpriseMode | @@ -2676,8 +2752,25 @@ Configure first run URL. - -When you enable the Configure Open Microsoft Edge With policy, you can configure one or more Start pages. When you enable this policy, users are not allowed to make changes to their Start pages. If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: `` `` If disabled or not configured, the webpages specified in App settings loads as the default Start pages. Version 1703 or later: If you do not want to send traffic to Microsoft, enable this policy and use the `` value, which honors domain- and non-domain-joined devices, when it is the only configured URL. Version 1809: If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. Supported devices: Domain-joined or MDM-enrolled Related policy: - Configure Open Microsoft Edge With - Disable Lockdown of Start Pages + +When you enable the Configure Open Microsoft Edge With policy, you can configure one or more Start pages. When you enable this policy, users are not allowed to make changes to their Start pages. + +If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: + +`` `` + +If disabled or not configured, the webpages specified in App settings loads as the default Start pages. + +Version 1703 or later: +If you do not want to send traffic to Microsoft, enable this policy and use the `` value, which honors domain- and non-domain-joined devices, when it is the only configured URL. + +Version 1809: +If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. + +Supported devices: Domain-joined or MDM-enrolled +Related policy: + - Configure Open Microsoft Edge With + - Disable Lockdown of Start Pages. @@ -2700,7 +2793,7 @@ When you enable the Configure Open Microsoft Edge With policy, you can configure |:--|:--| | Name | HomePages | | Friendly Name | Configure Start pages | -| Element Name | Use this format: `` `<>` | +| Element Name | Use this format: `` `` | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Internet Settings | @@ -3374,12 +3467,14 @@ This policy setting lets you decide whether an employee's LocalHost IP address s - + This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. -- If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites -> [!IMPORTANT] -> Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. +- If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites. + +**Important** +Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. + - If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar. @@ -3403,7 +3498,7 @@ This policy setting allows you to configure a default set of favorites, which wi |:--|:--| | Name | ConfiguredFavorites | | Friendly Name | Provision Favorites | -| Element Name | Specify the URL which points to the file that has all the data for provisioning favorites (in html format). You can export a set of favorites from Microsoft Edge and use that html file for provisioning user machines.

URL can be specified as

1. HTTP location: https://localhost:8080/URLs.html
2. Local network: \\network\shares\URLs.html
3. Local file: file:///c:\\Users\\``\\Documents\\URLs.html or C:\\Users\\``\\Documents\\URLs.html | +| Element Name | Specify the URL which points to the file that has all the data for provisioning favorites (in html format). You can export a set of favorites from Microsoft Edge and use that html file for provisioning user machines.

URL can be specified as

1. HTTP location: https://localhost:8080/URLs.html
2. Local network: \\network\shares\URLs.html
3. Local file: file:///c:\\Users\\``\\Documents\\URLs.html or C:\\Users\\``\\Documents\\URLs.html. | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Favorites | @@ -3514,9 +3609,24 @@ This policy setting lets you decide whether your intranet sites should all open - -Sets the default search engine for MDM-enrolled devices. Users can still change their default search engine. If this setting is turned on, you are setting the default search engine that you would like your employees to use. Employees can still change the default search engine, unless you apply the AllowSearchEngineCustomization policy which will disable the ability to change it. You must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. If you would like for your employees to use the Edge factory settings for the default search engine for their market, set the string EDGEDEFAULT; if you would like for your employees to use Bing as the default search engine, set the string EDGEBING. If this setting is not configured, the default search engine is set to the one specified in App settings and can be changed by your employees. -- If this setting is disabled, the policy-set search engine will be removed, and, if it is the current default, the default will be set back to the factory Microsoft Edge search engine for the market. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. + +This policy setting lets you configure the default search engine for your employees. Your employees can change the default search engine at any time. + +**Important** +This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy). + +- If you enable this setting, you can choose a default search engine for your employees. + +- If this setting is enabled, you must also add the default engine to the "Set default search engine" setting, by adding a link to your OpenSearch XML file, including at least the short name and https: URL of the search engine. For more info about creating the OpenSearch XML file, see the Understanding OpenSearch Standards (https://msdn.microsoft.com/library/dd163546.aspx) topic. Use this format to specify the link you wish to add: `` + +**Note** +If you'd like your employees to use the default Microsoft Edge settings for each market, you can set the string to EDGEDEFAULT. If you'd like your employees to use Microsoft Bing as the default search engine, you can set the string to EDGEBING. + +Employees can change the default search engine at any time, unless you disable the "Allow search engine customization" setting, which restricts any changes. + +- If you disable this setting, the policy-set default search engine is removed. If this is also the current in-use default, the engine changes to the Microsoft Edge specified engine for the market. + +- If you don't configure this setting, the default search engine is set to the one specified in App settings. @@ -3539,7 +3649,7 @@ Sets the default search engine for MDM-enrolled devices. Users can still change |:--|:--| | Name | SetDefaultSearchEngine | | Friendly Name | Set default search engine | -| Element Name | Use this format to specify the link you wish to add: `<>` | +| Element Name | Use this format to specify the link you wish to add: `` | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\OpenSearch | @@ -3572,8 +3682,13 @@ Sets the default search engine for MDM-enrolled devices. Users can still change - -The home button can be configured to load a custom URL when your user clicks the home button. If enabled, or configured, and the Configure Home Button policy is enabled, and the Show home button & set a specific page is selected, a custom URL loads when your user clicks the home button. Default setting: Blank or not configured Related policy: Configure Home Button + +The home button can be configured to load a custom URL when your user clicks the home button. + +If enabled, or configured, and the Configure Home Button policy is enabled, and the Show home button & set a specific page is selected, a custom URL loads when your user clicks the home button. + +Default setting: Blank or not configured +Related policy: Configure Home Button. @@ -3629,8 +3744,15 @@ The home button can be configured to load a custom URL when your user clicks the - -You can set the default New Tab page URL in Microsoft Edge. Enabling this policy prevents your users from changing the New tab page setting. When enabled and the Allow web content on New Tab page policy is disabled, Microsoft Edge ignores the URL specified in this policy and opens about:blank. If enabled, you can set the default New Tab page URL. If disabled or not configured, the default Microsoft Edge new tab page is used. Default setting: Disabled or not configured Related policy: Allow web content on New Tab page + +You can set the default New Tab page URL in Microsoft Edge. Enabling this policy prevents your users from changing the New tab page setting. When enabled and the Allow web content on New Tab page policy is disabled, Microsoft Edge ignores the URL specified in this policy and opens about:blank. + +If enabled, you can set the default New Tab page URL. + +If disabled or not configured, the default Microsoft Edge new tab page is used. + +Default setting: Disabled or not configured +Related policy: Allow web content on New Tab page. @@ -3696,7 +3818,7 @@ If disabled or not configured, the default app behavior occurs and no additional Default setting: Disabled or not configured Related policies: -Configure the Enterprise Mode Site List --Send all intranet sites to Internet Explorer 11 +-Send all intranet sites to Internet Explorer 11. @@ -3852,7 +3974,7 @@ If disabled or not configured, the UI settings for the home button are disabled Default setting: Disabled or not configured Related policy: -Configure Home Button --Set Home Button URL +-Set Home Button URL. diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index 6931233c08..aee369d5ea 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -4,7 +4,7 @@ description: Learn more about the Cellular Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -41,8 +41,20 @@ ms.topic: reference - + This policy setting specifies whether Windows apps can access cellular data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -87,7 +99,7 @@ If an app is open when this Group Policy object is applied on a device, employee |:--|:--| | Name | LetAppsAccessCellularData | | Friendly Name | Let Windows apps access cellular data | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Network > WWAN Service > Cellular Data Access | | Registry Key Name | Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess | @@ -116,8 +128,20 @@ If an app is open when this Group Policy object is applied on a device, employee - -List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access cellular data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -169,8 +193,20 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. Listed - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access cellular data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -222,8 +258,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access cellular data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. diff --git a/windows/client-management/mdm/policy-csp-clouddesktop.md b/windows/client-management/mdm/policy-csp-clouddesktop.md index e614be7f73..5bee8f32ce 100644 --- a/windows/client-management/mdm/policy-csp-clouddesktop.md +++ b/windows/client-management/mdm/policy-csp-clouddesktop.md @@ -4,7 +4,7 @@ description: Learn more about the CloudDesktop Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,9 @@ ms.topic: reference # Policy CSP - CloudDesktop +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + @@ -37,12 +40,7 @@ ms.topic: reference -This policy allows the user to configure the boot to cloud mode. Boot to Cloud mode enables users to seamlessly sign-in to a Cloud PC that is provisioned for them by an IT Admin. For using boot to cloud mode, users need to install and configure a Cloud Provider application (eg: Win365) on their PC and need to have a Cloud PC provisioned to them. For successful use of this policy, OverrideShellProgram policy needs to be configured as well. - -This policy supports the below options: - -1. Not Configured: Machine will not trigger the Cloud PC connection automatically. -2. Enable Boot to Cloud Desktop: Users who have a Cloud PC provisioned will get connected seamlessly to the Cloud PC as they finish sign-in operation. +This policy allows the user to configure the boot to cloud mode. Boot to Cloud mode enables users to seamlessly sign-in to a Cloud PC that is provisioned for them by an IT Admin. For using boot to cloud mode, users need to install and configure a Cloud Provider application (eg: Win365) on their PC and need to have a Cloud PC provisioned to them. For successful use of this policy, OverrideShellProgram policy needs to be configured as well. This policy supports the below options: 1. Not Configured: Machine will not trigger the Cloud PC connection automatically. 2. Enable Boot to Cloud Desktop: Users who have a Cloud PC provisioned will get connected seamlessly to the Cloud PC as they finish sign-in operation. diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 0254386450..8bc1fb0fda 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -4,7 +4,7 @@ description: Learn more about the Connectivity Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -42,7 +42,7 @@ ms.topic: reference -Allows the user to enable Bluetooth or restrict access +Allows the user to enable Bluetooth or restrict access. > [!NOTE] > This value is not supported in Windows Phone 8. 1 MDM and EAS, Windows 10 for desktop, or Windows 10 Mobile. If this is not set or it is deleted, the default value of 2 (Allow) is used. Most restricted value is 0. @@ -220,6 +220,7 @@ To validate, the enterprise can confirm by observing the roaming enable switch i + > [!NOTE] > This policy requires reboot to take effect. Allows IT Admins the ability to disable the Connected Devices Platform (CDP) component. CDP enables discovery and connection to other devices (either proximally with BT/LAN or through the cloud) to support remote app launching, remote messaging, remote app sessions, and other cross-device experiences. @@ -396,6 +397,7 @@ Device that has previously opt-in to MMX will also stop showing on the device li + > [!NOTE] > Currently, this policy is supported only in HoloLens 2, HoloLens (1st gen) Commercial Suite, and HoloLens (1st gen) Development Edition. Enables USB connection between the device and a computer to sync files with the device or to use developer tools to deploy or debug applications. Changing this policy does not affect USB charging. Both Media Transfer Protocol (MTP) and IP over USB are disabled when this policy is enforced. Most restricted value is 0. @@ -811,7 +813,7 @@ As part of determining the connectivity level, NCSI performs one of two active t This policy setting configures secure access to UNC paths. -- If you enable this policy, Windows only allows access to the specified UNC paths after fulfilling additional security requirements. +If you enable this policy, Windows only allows access to the specified UNC paths after fulfilling additional security requirements. @@ -874,7 +876,7 @@ Determines whether a user can install and configure the Network Bridge. The Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segements together. This connection appears in the Network Connections folder. -- If you disable this setting or do not configure it, the user will be able to create and modify the configuration of a Network Bridge. Enabling this setting does not remove an existing Network Bridge from the user's computer. +If you disable this setting or do not configure it, the user will be able to create and modify the configuration of a Network Bridge. Enabling this setting does not remove an existing Network Bridge from the user's computer. diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md index 6c2609c4c7..fb84b5f3b7 100644 --- a/windows/client-management/mdm/policy-csp-dataprotection.md +++ b/windows/client-management/mdm/policy-csp-dataprotection.md @@ -4,7 +4,7 @@ description: Learn more about the DataProtection Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -86,7 +86,7 @@ This policy setting allows you to block direct memory access (DMA) for all hot p -Important. This policy may change in a future release. It may be used for testing purposes, but should not be used in a production environment at this time. Setting used by Windows 8. 1 Selective Wipe +Important. This policy may change in a future release. It may be used for testing purposes, but should not be used in a production environment at this time. Setting used by Windows 8. 1 Selective Wipe. > [!NOTE] > This policy is not recommended for use in Windows 10. diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index c5e12804f1..d7e2211264 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -4,7 +4,7 @@ description: Learn more about the Defender Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 03/08/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -221,7 +221,7 @@ In Windows 10, Basic membership is no longer available, so setting the value to |:--|:--| | Name | SpynetReporting | | Friendly Name | Join Microsoft MAPS | -| Element Name | Join Microsoft MAPS | +| Element Name | Join Microsoft MAPS. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > MAPS | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Spynet | @@ -700,9 +700,9 @@ Allows or disallows Windows Defender Realtime Monitoring functionality. This policy setting allows you to configure scanning for network files. It is recommended that you do not enable this setting. -- If you enable this setting or do not configure this setting, network files will be scanned. +- If you enable this setting, network files will be scanned. -- If you disable this setting, network files will not be scanned. +- If you disable or do not configure this setting, network files will not be scanned. @@ -815,7 +815,7 @@ Allows or disallows Windows Defender Script Scanning functionality. This policy setting allows you to configure whether or not to display AM UI to the users. -- If you enable this setting AM UI won't be available to users. +If you enable this setting AM UI won't be available to users. @@ -883,8 +883,8 @@ Exclude files and paths from Attack Surface Reduction (ASR) rules. Enabled: Specify the folders or files and resources that should be excluded from ASR rules in the Options section. Enter each rule on a new line as a name-value pair: -- Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder -- Value column: Enter "0" for each item + - Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder + - Value column: Enter "0" for each item Disabled: No exclusions will be applied to the ASR rules. @@ -916,7 +916,7 @@ You can configure ASR rules in the Configure Attack Surface Reduction rules GP s |:--|:--| | Name | ExploitGuard_ASR_ASROnlyExclusions | | Friendly Name | Exclude files and paths from Attack Surface Reduction Rules | -| Element Name | Exclusions from ASR rules | +| Element Name | Exclusions from ASR rules. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR | @@ -949,26 +949,26 @@ You can configure ASR rules in the Configure Attack Surface Reduction rules GP s Set the state for each Attack Surface Reduction (ASR) rule. After enabling this setting, you can set each rule to the following in the Options section: -- Block: the rule will be applied -- Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied) -- Off: the rule will not be applied -- Not Configured: the rule is enabled with default values -- Warn: the rule will be applied and the end-user will have the option to bypass the block + - Block: the rule will be applied + - Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied) + - Off: the rule will not be applied + - Not Configured: the rule is enabled with default values + - Warn: the rule will be applied and the end-user will have the option to bypass the block -Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules with the value of not configured. +Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules will the value of not configured. Enabled: Specify the state for each ASR rule under the Options section for this setting. Enter each rule on a new line as a name-value pair: -- Name column: Enter a valid ASR rule ID -- Value column: Enter the status ID that relates to state you want to specify for the associated rule + - Name column: Enter a valid ASR rule ID + - Value column: Enter the status ID that relates to state you want to specify for the associated rule The following status IDs are permitted under the value column: -- 1 (Block) -- 0 (Off) -- 2 (Audit) -- 5 (Not Configured) -- 6 (Warn) + - 1 (Block) + - 0 (Off) + - 2 (Audit) + - 5 (Not Configured) + - 6 (Warn) Example: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx @@ -1007,7 +1007,7 @@ You can exclude folders or files in the "Exclude files and paths from Attack Sur |:--|:--| | Name | ExploitGuard_ASR_Rules | | Friendly Name | Configure Attack Surface Reduction rules | -| Element Name | Set the state for each ASR rule | +| Element Name | Set the state for each ASR rule. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR | @@ -1066,7 +1066,7 @@ This policy setting allows you to configure the maximum percentage CPU utilizati |:--|:--| | Name | Scan_AvgCPULoadFactor | | Friendly Name | Specify the maximum percentage of CPU utilization during a scan | -| Element Name | Specify the maximum percentage of CPU utilization during a scan | +| Element Name | Specify the maximum percentage of CPU utilization during a scan. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Scan | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | @@ -1163,11 +1163,22 @@ This setting applies to scheduled scans, but it has no effect on scans initiated - -This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer. If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency. For more information about specific values that are supported, see [Specify the cloud protection level](/microsoft-365/security/defender-endpoint/specify-cloud-protection-level-microsoft-defender-antivirus). + +This policy setting determines how aggressive Microsoft Defender Antivirus will be in blocking and scanning suspicious files. + +If this setting is on, Microsoft Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency. + +For more information about specific values that are supported, see the Microsoft Defender Antivirus documentation site. > [!NOTE] -> This feature requires the Join Microsoft MAPS setting enabled in order to function. +> This feature requires the "Join Microsoft MAPS" setting enabled in order to function. + +Possible options are: +(0x0) Default Microsoft Defender Antivirus blocking level +(0x1) Moderate Microsoft Defender Antivirus blocking level, delivers verdict only for high confidence detections +(0x2) High blocking level - aggressively block unknowns while optimizing client performance (greater chance of false positives) +(0x4) High+ blocking level - aggressively block unknowns and apply additional protection measures (may impact client performance) +(0x6) Zero tolerance blocking level - block all unknown executables. @@ -1202,7 +1213,7 @@ This policy setting determines how aggressive Windows Defender Antivirus will be |:--|:--| | Name | MpEngine_MpCloudBlockLevel | | Friendly Name | Select cloud protection level | -| Element Name | Select cloud blocking level | +| Element Name | Select cloud blocking level. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > MpEngine | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\MpEngine | @@ -1231,11 +1242,15 @@ This policy setting determines how aggressive Windows Defender Antivirus will be - -This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50. The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds. For example, if the desired timeout is 60 seconds, specify 50 seconds in this setting, which will enable the extended cloud check feature, and will raise the total time to 60 seconds. + +This feature allows Microsoft Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. + +The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds. + +For example, if the desired timeout is 60 seconds, specify 50 seconds in this setting, which will enable the extended cloud check feature, and will raise the total time to 60 seconds. > [!NOTE] -> This feature depends on three other MAPS settings the must all be enabled- Configure the 'Block at First Sight' feature; Join Microsoft MAPS; Send file samples when further analysis is required. +> This feature depends on three other MAPS settings - "Configure the 'Block at First Sight' feature; "Join Microsoft MAPS"; "Send file samples when further analysis is required" all need to be enabled. @@ -1260,7 +1275,7 @@ This feature allows Windows Defender Antivirus to block a suspicious file for up |:--|:--| | Name | MpEngine_MpBafsExtendedTimeout | | Friendly Name | Configure extended cloud check | -| Element Name | Specify the extended cloud check time in seconds | +| Element Name | Specify the extended cloud check time in seconds. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > MpEngine | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\MpEngine | @@ -1331,7 +1346,7 @@ Default system folders are automatically guarded, but you can add folders in the |:--|:--| | Name | ExploitGuard_ControlledFolderAccess_AllowedApplications | | Friendly Name | Configure allowed applications | -| Element Name | Enter the applications that should be trusted | +| Element Name | Enter the applications that should be trusted. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access | @@ -1403,7 +1418,7 @@ Microsoft Defender Antivirus automatically determines which applications can be |:--|:--| | Name | ExploitGuard_ControlledFolderAccess_ProtectedFolders | | Friendly Name | Configure protected folders | -| Element Name | Enter the folders that should be guarded | +| Element Name | Enter the folders that should be guarded. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access | @@ -1462,7 +1477,7 @@ This policy setting defines the number of days items should be kept in the Quara |:--|:--| | Name | Quarantine_PurgeItemsAfterDelay | | Friendly Name | Configure removal of items from Quarantine folder | -| Element Name | Configure removal of items from Quarantine folder | +| Element Name | Configure removal of items from Quarantine folder. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Quarantine | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Quarantine | @@ -1625,8 +1640,8 @@ This policy setting allows you to configure catch-up scans for scheduled quick s Enable or disable controlled folder access for untrusted applications. You can choose to block, audit, or allow attempts by untrusted apps to: -- Modify or delete files in protected folders, such as the Documents folder -- Write to disk sectors + - Modify or delete files in protected folders, such as the Documents folder + - Write to disk sectors You can also choose to only block or audit writes to disk sectors while still allowing the modification or deletion of files in protected folders. @@ -1635,35 +1650,35 @@ Default system folders are automatically protected, but you can add folders in t Block: The following will be blocked: -- Attempts by untrusted apps to modify or delete files in protected folders -- Attempts by untrusted apps to write to disk sectors + - Attempts by untrusted apps to modify or delete files in protected folders + - Attempts by untrusted apps to write to disk sectors The Windows event log will record these blocks under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1123. Disabled: The following will not be blocked and will be allowed to run: -- Attempts by untrusted apps to modify or delete files in protected folders -- Attempts by untrusted apps to write to disk sectors + - Attempts by untrusted apps to modify or delete files in protected folders + - Attempts by untrusted apps to write to disk sectors These attempts will not be recorded in the Windows event log. Audit Mode: The following will not be blocked and will be allowed to run: -- Attempts by untrusted apps to modify or delete files in protected folders -- Attempts by untrusted apps to write to disk sectors + - Attempts by untrusted apps to modify or delete files in protected folders + - Attempts by untrusted apps to write to disk sectors The Windows event log will record these attempts under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1124. Block disk modification only: The following will be blocked: -- Attempts by untrusted apps to write to disk sectors + - Attempts by untrusted apps to write to disk sectors The Windows event log will record these attempts under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1123. The following will not be blocked and will be allowed to run: -- Attempts by untrusted apps to modify or delete files in protected folders + - Attempts by untrusted apps to modify or delete files in protected folders These attempts will not be recorded in the Windows event log. Audit disk modification only: The following will not be blocked and will be allowed to run: -- Attempts by untrusted apps to write to disk sectors -- Attempts by untrusted apps to modify or delete files in protected folders + - Attempts by untrusted apps to write to disk sectors + - Attempts by untrusted apps to modify or delete files in protected folders Only attempts to write to protected disk sectors will be recorded in the Windows event log (under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1124). Attempts to modify or delete files in protected folders will not be recorded. @@ -1702,7 +1717,7 @@ Same as Disabled. |:--|:--| | Name | ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess | | Friendly Name | Configure Controlled folder access | -| Element Name | Configure the guard my folders feature | +| Element Name | Configure the guard my folders feature. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access | @@ -1871,8 +1886,8 @@ Same as Disabled. - -Allows an administrator to specify a list of file type extensions to ignore during a scan. Each file type in the list must be separated by a |. For example, lib|obj. + +This policy setting allows you specify a list of file types that should be excluded from scheduled, custom, and real-time scanning. File types should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the file type extension (such as "obj" or "lib"). The value is not used and it is recommended that this be set to 0. @@ -1896,7 +1911,7 @@ Allows an administrator to specify a list of file type extensions to ignore duri |:--|:--| | Name | Exclusions_Extensions | | Friendly Name | Extension Exclusions | -| Element Name | Extension Exclusions | +| Element Name | Extension Exclusions. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Exclusions | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Exclusions | @@ -1925,8 +1940,8 @@ Allows an administrator to specify a list of file type extensions to ignore duri - -Allows an administrator to specify a list of directory paths to ignore during a scan. Each path in the list must be separated by a |. For example, C:\Example|C:\Example1. + +This policy setting allows you to disable scheduled and real-time scanning for files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a path or a fully qualified resource name. As an example, a path might be defined as: "c:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe". The value is not used and it is recommended that this be set to 0. @@ -1950,7 +1965,7 @@ Allows an administrator to specify a list of directory paths to ignore during a |:--|:--| | Name | Exclusions_Paths | | Friendly Name | Path Exclusions | -| Element Name | Path Exclusions | +| Element Name | Path Exclusions. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Exclusions | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Exclusions | @@ -1979,11 +1994,8 @@ Allows an administrator to specify a list of directory paths to ignore during a - -Allows an administrator to specify a list of files opened by processes to ignore during a scan. - -> [!IMPORTANT] -> The process itself is not excluded from the scan, but can be by using the Defender/ExcludedPaths policy to exclude its path. Each file type must be separated by a |. For example, C\Example. exe|C\Example1.exe. + +This policy setting allows you to disable real-time scanning for any file opened by any of the specified processes. This policy does not apply to scheduled scans. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. **Note** that only executables can be excluded. For example, a process might be defined as: "c:\windows\app.exe". The value is not used and it is recommended that this be set to 0. @@ -2007,7 +2019,7 @@ Allows an administrator to specify a list of files opened by processes to ignore |:--|:--| | Name | Exclusions_Processes | | Friendly Name | Process Exclusions | -| Element Name | Process Exclusions | +| Element Name | Process Exclusions. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Exclusions | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Exclusions | @@ -2115,7 +2127,7 @@ This policy setting allows you to configure monitoring for incoming and outgoing **Note** that this configuration is only honored for NTFS volumes. For any other file system type, full monitoring of file and program activity will be present on those volumes. -The options for this setting are mutually exclusive +The options for this setting are mutually exclusive: 0 = Scan incoming and outgoing files (default) 1 = Scan incoming files only 2 = Scan outgoing files only @@ -2158,7 +2170,7 @@ Any other value, or if the value does not exist, resolves to the default (0). |:--|:--| | Name | RealtimeProtection_RealtimeScanDirection | | Friendly Name | Configure monitoring for incoming and outgoing file and program activity | -| Element Name | Configure monitoring for incoming and outgoing file and program activity | +| Element Name | Configure monitoring for incoming and outgoing file and program activity. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Real-time Protection | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Real-Time Protection | @@ -2194,7 +2206,7 @@ This policy setting allows you to specify the scan type to use during a schedule - If you enable this setting, the scan type will be set to the specified value. -- If you disable or do not configure this setting, the default scan type will be used. +- If you disable or do not configure this setting, the default scan type will used. @@ -2227,7 +2239,7 @@ This policy setting allows you to specify the scan type to use during a schedule |:--|:--| | Name | Scan_ScanParameters | | Friendly Name | Specify the scan type to use for a scheduled scan | -| Element Name | Specify the scan type to use for a scheduled scan | +| Element Name | Specify the scan type to use for a scheduled scan. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Scan | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | @@ -2286,7 +2298,7 @@ This policy setting allows you to specify the time of day at which to perform a |:--|:--| | Name | Scan_ScheduleQuickScantime | | Friendly Name | Specify the time for a daily quick scan | -| Element Name | Specify the time for a daily quick scan | +| Element Name | Specify the time for a daily quick scan. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Scan | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | @@ -2371,7 +2383,7 @@ This setting can be configured with the following ordinal number values: |:--|:--| | Name | Scan_ScheduleDay | | Friendly Name | Specify the day of the week to run a scheduled scan | -| Element Name | Specify the day of the week to run a scheduled scan | +| Element Name | Specify the day of the week to run a scheduled scan. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Scan | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | @@ -2430,7 +2442,7 @@ This policy setting allows you to specify the time of day at which to perform a |:--|:--| | Name | Scan_ScheduleTime | | Friendly Name | Specify the time of day to run a scheduled scan | -| Element Name | Specify the time of day to run a scheduled scan | +| Element Name | Specify the time of day to run a scheduled scan. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Scan | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | @@ -2462,7 +2474,7 @@ This policy setting allows you to specify the time of day at which to perform a This policy setting allows you to define the security intelligence location for VDI-configured computers. -- If you disable or do not configure this setting, security intelligence will be referred from the default local source. +If you disable or do not configure this setting, security intelligence will be referred from the default local source. @@ -2485,7 +2497,7 @@ This policy setting allows you to define the security intelligence location for |:--|:--| | Name | SignatureUpdate_SharedSignaturesLocation | | Friendly Name | Define security intelligence location for VDI clients. | -| Element Name | Define file share for downloading security intelligence updates in virtual environments | +| Element Name | Define file share for downloading security intelligence updates in virtual environments. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates | @@ -2517,7 +2529,7 @@ This policy setting allows you to define the security intelligence location for This policy setting allows you to define the order in which different security intelligence update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources in order. Possible values are: "InternalDefinitionUpdateServer", "MicrosoftUpdateServer", "MMPC", and "FileShares" -For example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC } +For Example: `{ InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC }` - If you enable this setting, security intelligence update sources will be contacted in the order specified. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted. @@ -2545,7 +2557,7 @@ For example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC } |:--|:--| | Name | SignatureUpdate_FallbackOrder | | Friendly Name | Define the order of sources for downloading security intelligence updates | -| Element Name | Define the order of sources for downloading security intelligence updates | +| Element Name | Define the order of sources for downloading security intelligence updates. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates | @@ -2603,7 +2615,7 @@ This policy setting allows you to configure UNC file share sources for downloadi |:--|:--| | Name | SignatureUpdate_DefinitionUpdateFileSharesSources | | Friendly Name | Define file shares for downloading security intelligence updates | -| Element Name | Define file shares for downloading security intelligence updates | +| Element Name | Define file shares for downloading security intelligence updates. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates | @@ -2662,7 +2674,7 @@ This policy setting allows you to specify an interval at which to check for secu |:--|:--| | Name | SignatureUpdate_SignatureUpdateInterval | | Friendly Name | Specify the interval to check for security intelligence updates | -| Element Name | Specify the interval to check for security intelligence updates | +| Element Name | Specify the interval to check for security intelligence updates. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates | @@ -2698,7 +2710,7 @@ Possible options are: (0x0) Always prompt (0x1) Send safe samples automatically (0x2) Never send -(0x3) Send all samples automatically +(0x3) Send all samples automatically. @@ -2733,7 +2745,7 @@ Possible options are: |:--|:--| | Name | SubmitSamplesConsent | | Friendly Name | Send file samples when further analysis is required | -| Element Name | Send file samples when further analysis is required | +| Element Name | Send file samples when further analysis is required. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > MAPS | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Spynet | @@ -2762,8 +2774,19 @@ Possible options are: - -Allows an administrator to specify any valid threat severity levels and the corresponding default action ID to take. This value is a list of threat severity level IDs and corresponding actions, separated by a | using the format threat level=action|threat level=action. For example, 1=6|2=2|4=10|5=3. The following list shows the supported values for threat severity levels:1 - Low severity threats2 - Moderate severity threats4 - High severity threats5 - Severe threatsThe following list shows the supported values for possible actions:2 - Quarantine. Moves files to quarantine. 3 - Remove. Removes files from system. 6 - Allow. Allows file/does none of the above actions. 8 - User defined. Requires user to make a decision on which action to take. 10 - Block. Blocks file execution. + +This policy setting allows you to customize which automatic remediation action will be taken for each threat alert level. Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. + +Valid threat alert levels are: +1 = Low +2 = Medium +4 = High +5 = Severe + +Valid remediation action values are: +2 = Quarantine +3 = Remove +6 = Ignore. @@ -2786,7 +2809,7 @@ Allows an administrator to specify any valid threat severity levels and the corr |:--|:--| | Name | Threats_ThreatSeverityDefaultAction | | Friendly Name | Specify threat alert levels at which default action should not be taken when detected | -| Element Name | Specify threat alert levels at which default action should not be taken when detected | +| Element Name | Specify threat alert levels at which default action should not be taken when detected. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Threats | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Threats | diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index fe04df23d4..0a0eeb6f78 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -4,7 +4,7 @@ description: Learn more about the DeliveryOptimization Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -134,7 +134,7 @@ Specifies whether the device is allowed to participate in Peer Caching while con |:--|:--| | Name | AllowVPNPeerCaching | | Friendly Name | Enable Peer Caching while the device connects via VPN | -| Element Name | Enable Peer Caching while the device connects via VPN | +| Element Name | Enable Peer Caching while the device connects via VPN. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -192,7 +192,7 @@ One or more values can be added as either fully qualified domain names (FQDN) or |:--|:--| | Name | CacheHost | | Friendly Name | Cache Server Hostname | -| Element Name | Cache Server | +| Element Name | Cache Server. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -259,7 +259,7 @@ If this policy is not configured, the client will attempt to automatically find |:--|:--| | Name | CacheHostSource | | Friendly Name | Cache Server Hostname Source | -| Element Name | Cache Server Hostname Source | +| Element Name | Cache Server Hostname Source. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -619,7 +619,7 @@ Specifies the download method that Delivery Optimization can use in downloads of |:--|:--| | Name | DownloadMode | | Friendly Name | Download Mode | -| Element Name | Download Mode | +| Element Name | Download Mode. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -676,7 +676,7 @@ Use this if you need to create a single group for Local Network Peering for bran |:--|:--| | Name | GroupId | | Friendly Name | Group ID | -| Element Name | Group ID | +| Element Name | Group ID. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -745,7 +745,7 @@ Set this policy to restrict peer selection to a specific source. Available optio |:--|:--| | Name | GroupIdSource | | Friendly Name | Select the source of Group IDs | -| Element Name | Source of Group IDs | +| Element Name | Source of Group IDs. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -1308,7 +1308,7 @@ By default, %SystemDrive% is used to store the cache. The drive location can be |:--|:--| | Name | ModifyCacheDrive | | Friendly Name | Modify Cache Drive | -| Element Name | Modify Cache Drive | +| Element Name | Modify Cache Drive. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -1555,7 +1555,7 @@ In Windows 11 the 'Local Peer Discovery' option was introduced to restrict peer |:--|:--| | Name | RestrictPeerSelectionBy | | Friendly Name | Select a method to restrict Peer Selection | -| Element Name | Restrict Peer Selection By | +| Element Name | Restrict Peer Selection By. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index 1cc683a423..e0eeb748b5 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -4,7 +4,7 @@ description: Learn more about the Desktop Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -46,7 +46,7 @@ Prevents users from changing the path to their profile folders. By default, a user can change the location of their individual profile folders like Documents, Music etc. by typing a new path in the Locations tab of the folder's Properties dialog box. -- If you enable this setting, users are unable to type a new location in the Target box. +If you enable this setting, users are unable to type a new location in the Target box. diff --git a/windows/client-management/mdm/policy-csp-desktopappinstaller.md b/windows/client-management/mdm/policy-csp-desktopappinstaller.md index 36f2988560..c2e602fd7a 100644 --- a/windows/client-management/mdm/policy-csp-desktopappinstaller.md +++ b/windows/client-management/mdm/policy-csp-desktopappinstaller.md @@ -4,7 +4,7 @@ description: Learn more about the DesktopAppInstaller Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -210,6 +210,57 @@ Users will still be able to execute the *winget* command. The default help will + +## EnableBypassCertificatePinningForMicrosoftStore + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DesktopAppInstaller/EnableBypassCertificatePinningForMicrosoftStore +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | EnableBypassCertificatePinningForMicrosoftStore | +| ADMX File Name | DesktopAppInstaller.admx | + + + + + + + + ## EnableDefaultSource @@ -393,6 +444,57 @@ This policy controls whether or not the [Windows Package Manager](/windows/packa + +## EnableLocalArchiveMalwareScanOverride + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DesktopAppInstaller/EnableLocalArchiveMalwareScanOverride +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | EnableLocalArchiveMalwareScanOverride | +| ADMX File Name | DesktopAppInstaller.admx | + + + + + + + + ## EnableLocalManifestFiles diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index 03c560a1d3..ba41b0ac29 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -4,7 +4,7 @@ description: Learn more about the DeviceGuard Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 03/01/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -101,72 +101,8 @@ For more information about System Guard, see [Introducing Windows Defender Syste - -Specifies whether Virtualization Based Security is enabled. - -Virtualization Based Security uses the Windows Hypervisor to provide support for security services. Virtualization Based Security requires Secure Boot, and can optionally be enabled with the use of DMA Protections. DMA protections require hardware support and will only be enabled on correctly configured devices. - -Virtualization Based Protection of Code Integrity - -This setting enables virtualization based protection of Kernel Mode Code Integrity. When this is enabled, kernel mode memory protections are enforced and the Code Integrity validation path is protected by the Virtualization Based Security feature. - -The "Disabled" option turns off Virtualization Based Protection of Code Integrity remotely if it was previously turned on with the "Enabled without lock" option. - -The "Enabled with UEFI lock" option ensures that Virtualization Based Protection of Code Integrity cannot be disabled remotely. In order to disable the feature, you must set the Group Policy to "Disabled" as well as remove the security functionality from each computer, with a physically present user, in order to clear configuration persisted in UEFI. - -The "Enabled without lock" option allows Virtualization Based Protection of Code Integrity to be disabled remotely by using Group Policy. - -The "Not Configured" option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified. - -The "Require UEFI Memory Attributes Table" option will only enable Virtualization Based Protection of Code Integrity on devices with UEFI firmware support for the Memory Attributes Table. Devices without the UEFI Memory Attributes Table may have firmware that is incompatible with Virtualization Based Protection of Code Integrity which in some cases can lead to crashes or data loss or incompatibility with certain plug-in cards. If not setting this option the targeted devices should be tested to ensure compatibility. - -> [!WARNING] -> All drivers on the system must be compatible with this feature or the system may crash. Ensure that this policy setting is only deployed to computers which are known to be compatible. - -Credential Guard - -This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials. - -For Windows 11 21. H2 and earlier, the "Disabled" option turns off Credential Guard remotely if it was previously turned on with the "Enabled without lock" option. For later versions, the "Disabled" option turns off Credential Guard remotely if it was previously turned on with the "Enabled without lock" option or was "Not Configured". - -The "Enabled with UEFI lock" option ensures that Credential Guard cannot be disabled remotely. In order to disable the feature, you must set the Group Policy to "Disabled" as well as remove the security functionality from each computer, with a physically present user, in order to clear configuration persisted in UEFI. - -The "Enabled without lock" option allows Credential Guard to be disabled remotely by using Group Policy. The devices that use this setting must be running at least Windows 10 (Version 1511). - -For Windows 11 21. H2 and earlier, the "Not Configured" option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified. For later versions, if there is no current setting in the registry, the "Not Configured" option will enable Credential Guard without UEFI lock. - -Secure Launch - -This setting sets the configuration of Secure Launch to secure the boot chain. - -The "Not Configured" setting is the default, and allows configuration of the feature by Administrative users. - -The "Enabled" option turns on Secure Launch on supported hardware. - -The "Disabled" option turns off Secure Launch, regardless of hardware support. - -Kernel-mode Hardware-enforced Stack Protection - -This setting enables Hardware-enforced Stack Protection for kernel-mode code. When this security feature is enabled, kernel-mode data stacks are hardened with hardware-based shadow stacks, which store intended return address targets to ensure that program control flow is not tampered. - -This security feature has the following prerequisites: -1) The CPU hardware supports hardware-based shadow stacks. -2) Virtualization Based Protection of Code Integrity is enabled. - -If either prerequisite is not met, this feature will not be enabled, even if an "Enabled" option is selected for this feature. **Note** that selecting an "Enabled" option for this feature will not automatically enable Virtualization Based Protection of Code Integrity, that needs to be done separately. - -Devices that enable this security feature must be running at least Windows 11 (Version 22. H2). - -The "Disabled" option turns off kernel-mode Hardware-enforced Stack Protection. - -The "Enabled in audit mode" option enables kernel-mode Hardware-enforced Stack Protection in audit mode, where shadow stack violations are not fatal and will be logged to the system event log. - -The "Enabled in enforcement mode" option enables kernel-mode Hardware-enforced Stack Protection in enforcement mode, where shadow stack violations are fatal. - -The "Not Configured" option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified. - -> [!WARNING] -> All drivers on the system must be compatible with this security feature or the system may crash in enforcement mode. Audit mode can be used to discover incompatible drivers. For more information, see [A driver can't load on this device](https://go.microsoft.com/fwlink/?LinkId=2162953). + +Turns On Virtualization Based Security(VBS) diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 0696c7e877..b65b65b1e4 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -4,7 +4,7 @@ description: Learn more about the DeviceInstallation Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -45,11 +45,12 @@ ms.topic: reference This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is allowed to install. This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions. When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update any device whose Plug and Play hardware ID or compatible ID appears in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings: -- Prevent installation of devices that match these device IDs -- Prevent installation of devices that match any of these device instance IDs + - Prevent installation of devices that match these device IDs + - Prevent installation of devices that match any of these device instance IDs If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence. -NOTE: The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible. +> [!NOTE] +> The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible. Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update any device whose Plug and Play hardware ID or compatible ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting). @@ -146,10 +147,11 @@ To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is allowed to install. This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions. When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings: -- Prevent installation of devices that match any of these device instance IDs + - Prevent installation of devices that match any of these device instance IDs If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence. -NOTE: The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible. +> [!NOTE] +> The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible. Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting). @@ -248,12 +250,13 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for driver packages that Windows is allowed to install. This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions. When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update driver packages whose device setup class GUIDs appear in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings: -- Prevent installation of devices for these device classes -- Prevent installation of devices that match these device IDs -- Prevent installation of devices that match any of these device instance IDs + - Prevent installation of devices for these device classes + - Prevent installation of devices that match these device IDs + - Prevent installation of devices that match any of these device instance IDs If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence. -NOTE: The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible. +> [!NOTE] +> The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible. Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update driver packages whose device setup class GUIDs appear in the list you create, unless another policy setting specifically prevents installation (for example, the "Prevent installation of devices that match these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting). @@ -378,9 +381,10 @@ Removable devices 7. Prevent installation of removable devices -NOTE: This policy setting provides more granular control than the "Prevent installation of devices not described by other policy settings" policy setting. If these conflicting policy settings are enabled at the same time, the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting will be enabled and the other policy setting will be ignored. +> [!NOTE] +> This policy setting provides more granular control than the "Prevent installation of devices not described by other policy settings" policy setting. If these conflicting policy settings are enabled at the same time, the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting will be enabled and the other policy setting will be ignored. -- If you disable or do not configure this policy setting, the default evaluation is used. By default, all "Prevent installation..." policy settings have precedence over any other policy setting that allows Windows to install a device. +If you disable or do not configure this policy setting, the default evaluation is used. By default, all "Prevent installation..." policy settings have precedence over any other policy setting that allows Windows to install a device. @@ -533,7 +537,8 @@ This policy setting allows you to prevent Windows from retrieving device metadat This policy setting allows you to prevent the installation of devices that are not specifically described by any other policy setting. -NOTE: This policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting to provide more granular control. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting instead of this policy setting. +> [!NOTE] +> This policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting to provide more granular control. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting instead of this policy setting. - If you enable this policy setting, Windows is prevented from installing or updating the driver package for any device that is not described by either the "Allow installation of devices that match any of these device IDs", the "Allow installation of devices for these device classes", or the "Allow installation of devices that match any of these device instance IDs" policy setting. @@ -632,9 +637,11 @@ You can also block installation by using a custom profile in Intune. This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is prevented from installing. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device. -NOTE: To enable the "Allow installation of devices that match any of these device instance IDs" policy setting to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting. +> [!NOTE] +> To enable the "Allow installation of devices that match any of these device instance IDs" policy setting to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting. - If you enable this policy setting, Windows is prevented from installing a device whose hardware ID or compatible ID appears in the list you create. + - If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. - If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings. @@ -736,6 +743,7 @@ For example, this custom profile blocks installation and usage of USB devices wi This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. - If you enable this policy setting, Windows is prevented from installing a device whose device instance ID appears in the list you create. + - If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. - If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings. @@ -846,9 +854,11 @@ To prevent installation of devices with matching device instance IDs by using cu This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for driver packages that Windows is prevented from installing. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device. -NOTE: To enable the "Allow installation of devices that match any of these device IDs" and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting. +> [!NOTE] +> To enable the "Allow installation of devices that match any of these device IDs" and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting. - If you enable this policy setting, Windows is prevented from installing or updating driver packages whose device setup class GUIDs appear in the list you create. + - If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. - If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings. diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 9645d243cd..69a26fb46f 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -4,7 +4,7 @@ description: Learn more about the DeviceLock Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -21,12 +21,165 @@ ms.topic: reference > > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + > [!IMPORTANT] > The DeviceLock CSP utilizes the [Exchange ActiveSync Policy Engine](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn282287(v=ws.11)). When password length and complexity rules are applied, all the local user and administrator accounts are marked to change their password at the next sign in to ensure complexity requirements are met. For more information, see [Password length and complexity supported by account types](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn282287(v=ws.11)#password-length-and-complexity-supported-by-account-types). + +## AccountLockoutDuration + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DeviceLock/AccountLockoutDuration +``` + + + + +Account lockout duration This security setting determines the number of minutes a locked-out account remains locked out before automatically becoming unlocked. The available range is from 0 minutes through 99,999 minutes. If you set the account lockout duration to 0, the account will be locked out until an administrator explicitly unlocks it. If an account lockout threshold is defined, the account lockout duration must be greater than or equal to the reset time. Default: None, because this policy setting only has meaning when an Account lockout threshold is specified. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-99999]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Account lockout duration | +| Path | Windows Settings > Security Settings > Account Policies > Account Lockout Policy | + + + + + + + + + +## AccountLockoutThreshold + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DeviceLock/AccountLockoutThreshold +``` + + + + +Account lockout threshold - This security setting determines the number of failed logon attempts that causes a user account to be locked out. A locked-out account cannot be used until it is reset by an administrator or until the lockout duration for the account has expired. You can set a value between 0 and 999 failed logon attempts. If you set the value to 0, the account will never be locked out. Failed password attempts against workstations or member servers that have been locked using either CTRL+ALT+DELETE or password-protected screen savers count as failed logon attempts. Default: 0. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-10]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Account lockout threshold | +| Path | Windows Settings > Security Settings > Account Policies > Account Lockout Policy | + + + + + + + + + +## AllowAdministratorLockout + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DeviceLock/AllowAdministratorLockout +``` + + + + +Allow Administrator account lockout This security setting determines whether the builtin Administrator account is subject to account lockout policy. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-1]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Allow Administrator account lockout | +| Path | Windows Settings > Security Settings > Account Policies > Account Lockout Policy | + + + + + + + + ## AllowIdleReturnWithoutPassword @@ -202,7 +355,7 @@ For more information about this policy, see [Exchange ActiveSync Policy Engine O -Determines the type of PIN or password required. This policy only applies if the DeviceLock/DevicePasswordEnabled policy is set to 0 +Determines the type of PIN or password required. This policy only applies if the DeviceLock/DevicePasswordEnabled policy is set to 0. @@ -567,7 +720,7 @@ Specifies the default lock screen and logon image shown when no user is signed i -The number of authentication failures allowed before the device will be wiped. A value of 0 disables device wipe functionality +The number of authentication failures allowed before the device will be wiped. A value of 0 disables device wipe functionality. > [!NOTE] > This policy must be wrapped in an Atomic command. This policy has different behaviors on the mobile device and desktop. On a mobile device, when the user reaches the value set by this policy, then the device is wiped. On a desktop, when the user reaches the value set by this policy, it is not wiped. Instead, the desktop is put on BitLocker recovery mode, which makes the data inaccessible but recoverable. If BitLocker is not enabled, then the policy cannot be enforced. Prior to reaching the failed attempts limit, the user is sent to the lock screen and warned that more failed attempts will lock their computer. When the user reaches the limit, the device automatically reboots and shows the BitLocker recovery page. This page prompts the user for the BitLocker recovery key. Most secure value is 0 if all policy values = 0; otherwise, Min policy value is the most secure value. For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn282287(v=ws.11)). @@ -612,10 +765,10 @@ The number of authentication failures allowed before the device will be wiped. A -This security setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If the maximum password age is between 1 and 999 days, the Minimum password age must be less than the maximum password age. If the maximum password age is set to 0, the minimum password age can be any value between 0 and 998 days +This security setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If the maximum password age is between 1 and 999 days, the Minimum password age must be less than the maximum password age. If the maximum password age is set to 0, the minimum password age can be any value between 0 and 998 days. > [!NOTE] -> It is a security best practice to have passwords expire every 30 to 90 days, depending on your environment. This way, an attacker has a limited amount of time in which to crack a user's password and have access to your network resources. Default 42. +> It is a security best practice to have passwords expire every 30 to 90 days, depending on your environment. This way, an attacker has a limited amount of time in which to crack a user's password and have access to your network resources. Default: 42. @@ -1013,10 +1166,10 @@ Complexity requirements are enforced when passwords are changed or created. Minimum password length -This security setting determines the least number of characters that a password for a user account may contain. The maximum value for this setting is dependent on the value of the Relax minimum password length limits setting. If the Relax minimum password length limits setting is not defined, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and disabled, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and enabled, this setting may be configured from 0 to 128. Setting the required number of characters to 0 means that no password is required +This security setting determines the least number of characters that a password for a user account may contain. The maximum value for this setting is dependent on the value of the Relax minimum password length limits setting. If the Relax minimum password length limits setting is not defined, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and disabled, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and enabled, this setting may be configured from 0 to 128. Setting the required number of characters to 0 means that no password is required. > [!NOTE] -> By default, member computers follow the configuration of their domain controllers. Default 7 on domain controllers. 0 on stand-alone servers. Configuring this setting than 14 may affect compatibility with clients, services, and applications. Microsoft recommends that you only configure this setting larger than 14 after using the Minimum password length audit setting to test for potential incompatibilities at the new setting. +> By default, member computers follow the configuration of their domain controllers. Default: 7 on domain controllers. 0 on stand-alone servers. Configuring this setting than 14 may affect compatibility with clients, services, and applications. Microsoft recommends that you only configure this setting larger than 14 after using the Minimum password length audit setting to test for potential incompatibilities at the new setting. @@ -1070,7 +1223,7 @@ Disables the lock screen camera toggle switch in PC Settings and prevents a came By default, users can enable invocation of an available camera on the lock screen. -- If you enable this setting, users will no longer be able to enable or disable lock screen camera access in PC Settings, and the camera cannot be invoked on the lock screen. +If you enable this setting, users will no longer be able to enable or disable lock screen camera access in PC Settings, and the camera cannot be invoked on the lock screen. @@ -1130,7 +1283,7 @@ Disables the lock screen slide show settings in PC Settings and prevents a slide By default, users can enable a slide show that will run after they lock the machine. -- If you enable this setting, users will no longer be able to modify slide show settings in PC Settings, and no slide show will ever start. +If you enable this setting, users will no longer be able to modify slide show settings in PC Settings, and no slide show will ever start. @@ -1169,6 +1322,56 @@ By default, users can enable a slide show that will run after they lock the mach + +## ResetAccountLockoutCounterAfter + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DeviceLock/ResetAccountLockoutCounterAfter +``` + + + + +Reset account lockout counter after - This security setting determines the number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts. The available range is 1 minute to 99,999 minutes. If an account lockout threshold is defined, this reset time must be less than or equal to the Account lockout duration. Default: None, because this policy setting only has meaning when an Account lockout threshold is specified. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[1-99999]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Reset account lockout counter after | +| Path | Windows Settings > Security Settings > Account Policies > Account Lockout Policy | + + + + + + + + ## ScreenTimeoutWhileLocked diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index 5c610c1946..19f3a8b859 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -4,7 +4,7 @@ description: Learn more about the Display Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,8 +36,20 @@ ms.topic: reference - -This policy allows you to disable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. + +Per Process System DPI is an application compatibility feature for desktop applications that do not render properly after a display-scale factor (DPI) change. When the display scale factor of the primary display changes (which can happen when you connect or disconnect a display that has a different display scale factor (DPI), connect remotely from a device with a different display scale factor, or manually change the display scale factor), many desktop applications can display blurry. Desktop applications that have not been updated to display properly in this scenario will be blurry until the user logs out and back in to Windows. + +When you enable this policy some blurry applications will be crisp after they are restarted, without requiring the user to log out and back in to Windows. + +Be aware of the following: + +Per Process System DPI will only improve the rendering of desktop applications that are positioned on the primary display. Some desktop applications can still be blurry on secondary displays that have different display scale factors. + +Per Process System DPI will not work for all applications as some older desktop applications will always be blurry on high DPI displays. + +In some cases, you may see some odd behavior in some desktop applications. If that happens, Per Process System DPI should be disabled. + +Enabling this setting lets you specify the system-wide default for desktop applications as well as per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system. @@ -94,8 +106,20 @@ This policy allows you to disable Per-Process System DPI for a semicolon-separat - -Enable or disable Per-Process System DPI for all applications. + +Per Process System DPI is an application compatibility feature for desktop applications that do not render properly after a display-scale factor (DPI) change. When the display scale factor of the primary display changes (which can happen when you connect or disconnect a display that has a different display scale factor (DPI), connect remotely from a device with a different display scale factor, or manually change the display scale factor), many desktop applications can display blurry. Desktop applications that have not been updated to display properly in this scenario will be blurry until the user logs out and back in to Windows. + +When you enable this policy some blurry applications will be crisp after they are restarted, without requiring the user to log out and back in to Windows. + +Be aware of the following: + +Per Process System DPI will only improve the rendering of desktop applications that are positioned on the primary display. Some desktop applications can still be blurry on secondary displays that have different display scale factors. + +Per Process System DPI will not work for all applications as some older desktop applications will always be blurry on high DPI displays. + +In some cases, you may see some odd behavior in some desktop applications. If that happens, Per Process System DPI should be disabled. + +Enabling this setting lets you specify the system-wide default for desktop applications as well as per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system. @@ -169,8 +193,20 @@ Enabling this setting lets you specify the system-wide default for desktop appli - -This policy allows you to enable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. + +Per Process System DPI is an application compatibility feature for desktop applications that do not render properly after a display-scale factor (DPI) change. When the display scale factor of the primary display changes (which can happen when you connect or disconnect a display that has a different display scale factor (DPI), connect remotely from a device with a different display scale factor, or manually change the display scale factor), many desktop applications can display blurry. Desktop applications that have not been updated to display properly in this scenario will be blurry until the user logs out and back in to Windows. + +When you enable this policy some blurry applications will be crisp after they are restarted, without requiring the user to log out and back in to Windows. + +Be aware of the following: + +Per Process System DPI will only improve the rendering of desktop applications that are positioned on the primary display. Some desktop applications can still be blurry on secondary displays that have different display scale factors. + +Per Process System DPI will not work for all applications as some older desktop applications will always be blurry on high DPI displays. + +In some cases, you may see some odd behavior in some desktop applications. If that happens, Per Process System DPI should be disabled. + +Enabling this setting lets you specify the system-wide default for desktop applications as well as per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system. @@ -223,8 +259,16 @@ This policy allows you to enable Per-Process System DPI for a semicolon-separate - -This policy allows to force turn off GDI DPI Scaling for a semicolon separated list of applications. Applications can be specified either by using full path or just filename and extension. + +GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware. + +This policy setting lets you specify legacy applications that have GDI DPI Scaling turned off. + +- If you enable this policy setting, GDI DPI Scaling is turned off for all applications in the list, even if they are enabled by using ApplicationCompatibility database, ApplicationCompatibility UI System (Enhanced) setting, or an application manifest. + +- If you disable or do not configure this policy setting, GDI DPI Scaling might still be turned on for legacy applications. + +If GDI DPI Scaling is configured to both turn off and turn on an application, the application will be turned off. @@ -293,8 +337,16 @@ To validate on Desktop, do the following tasks: - -This policy allows to turn on GDI DPI Scaling for a semicolon separated list of applications. Applications can be specified either by using full path or just filename and extension. + +GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware. + +This policy setting lets you specify legacy applications that have GDI DPI Scaling turned on. + +- If you enable this policy setting, GDI DPI Scaling is turned on for all legacy applications in the list. + +- If you disable or do not configure this policy setting, GDI DPI Scaling will not be enabled for an application except when an application is enabled by using ApplicationCompatibility database, ApplicationCompatibility UI System (Enhanced) setting, or an application manifest. + +If GDI DPI Scaling is configured to both turn off and turn on an application, the application will be turned off. diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index c8c5aed332..004ce690a4 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -4,7 +4,7 @@ description: Learn more about the Education Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -39,6 +39,7 @@ ms.topic: reference This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. - If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. + - If you enable or don't configure this policy setting, users will be able to access graphing functionality. @@ -102,7 +103,7 @@ This policy setting allows you to control whether graphing functionality is avai -This policy sets user's default printer +This policy sets user's default printer. @@ -144,6 +145,7 @@ The policy value is expected to be the name (network host name) of an installed This policy setting allows you to control whether EDU-specific theme packs are available in Settings > Personalization. - If you disable or don't configure this policy setting, EDU-specific theme packs will not be included. + - If you enable this policy setting, users will be able to personalize their devices with EDU-specific themes. @@ -193,7 +195,7 @@ This policy setting allows you to control whether EDU-specific theme packs are a -This policy setting allows tenant to control whether to declare this OS as an education environment +This policy setting allows tenant to control whether to declare this OS as an education environment. @@ -255,7 +257,7 @@ This setting does not delete printers that users have already added. However, if > [!NOTE] > You can use printer permissions to restrict the use of printers without specifying a setting. In the Printers folder, right-click a printer, click Properties, and then click the Security tab. -If this policy is disabled, or not configured, users can add printers using the methods described above. +- If this policy is disabled, or not configured, users can add printers using the methods described above. @@ -318,7 +320,7 @@ If this policy is disabled, or not configured, users can add printers using the -This policy provisions per-user network printers +This policy provisions per-user network printers. diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md index b804039125..4dcd8140d3 100644 --- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md +++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md @@ -4,7 +4,7 @@ description: Learn more about the EnterpriseCloudPrint Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,7 +37,7 @@ ms.topic: reference -This policy provisions per-user discovery end point to discover cloud printers +This policy provisions per-user discovery end point to discover cloud printers. @@ -84,7 +84,7 @@ The default value is an empty string. Otherwise, the value should contain the UR -Authentication endpoint for acquiring OAuth tokens +Authentication endpoint for acquiring OAuth tokens. @@ -131,7 +131,7 @@ The default value is an empty string. Otherwise, the value should contain the UR -A GUID identifying the client application authorized to retrieve OAuth tokens from the OAuthAuthority +A GUID identifying the client application authorized to retrieve OAuth tokens from the OAuthAuthority. @@ -178,7 +178,7 @@ The default value is an empty string. Otherwise, the value should contain a GUID -Resource URI for which access is being requested by the Enterprise Cloud Print client during OAuth authentication +Resource URI for which access is being requested by the Enterprise Cloud Print client during OAuth authentication. @@ -225,7 +225,7 @@ The default value is an empty string. Otherwise, the value should contain a URL. -Defines the maximum number of printers that should be queried from discovery end point +Defines the maximum number of printers that should be queried from discovery end point. @@ -267,7 +267,7 @@ This policy must target ./User, otherwise it fails. -Resource URI for which access is being requested by the Mopria discovery client during OAuth authentication +Resource URI for which access is being requested by the Mopria discovery client during OAuth authentication. diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index e46c94e961..6505002489 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -4,7 +4,7 @@ description: Learn more about the Experience Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,9 @@ ms.topic: reference # Policy CSP - Experience +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + @@ -38,6 +41,7 @@ ms.topic: reference This policy setting determines whether history of Clipboard contents can be stored in memory. + - If you enable this policy setting, history of Clipboard contents are allowed to be stored. - If you disable this policy setting, history of Clipboard contents are not allowed to be stored. Policy change takes effect immediately. @@ -346,7 +350,7 @@ When Find My Device is off, the device and its location are not registered and t -Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e. g. auto-enrolled), then disabling the MDM unenrollment has no effect +Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e. g. auto-enrolled), then disabling the MDM unenrollment has no effect. > [!NOTE] > The MDM server can always remotely delete the account. Most restricted value is 0. @@ -447,7 +451,7 @@ This policy is deprecated. -Allow screen capture +Allow screen capture. @@ -598,6 +602,7 @@ Allow SIM error dialog prompts when no SIM is inserted. Specifies whether Spotlight collection is allowed as a Personalization->Background Setting. + - If you enable this policy setting, Spotlight collection will show as an option in the user's Personalization Settings, and the user will be able to get daily images from Microsoft displayed on their desktop. - If you disable this policy setting, Spotlight collection will not show as an option in Personalization Settings, and the user will not have the choice of getting Microsoft daily images shown on their desktop. @@ -708,8 +713,9 @@ Allows or disallows all Windows sync settings on the device. For information abo This policy allows you to prevent Windows from using diagnostic data to provide customized experiences to the user. + - If you enable this policy setting, Windows will not use diagnostic data from this device to customize content shown on the lock screen, Windows tips, Microsoft consumer features, or other related features. If these features are enabled, users will still see recommendations, tips and offers, but they may be less relevant. -- If you disable or do not configure this policy setting, Microsoft will use diagnostic data to provide personalized recommendations, tips, and offers to tailor Windows for the user's needs and make it work better for them. Diagnostic data can include browser, app and feature usage, depending on the Diagnostic and usage data setting value +- If you disable or do not configure this policy setting, Microsoft will use diagnostic data to provide personalized recommendations, tips, and offers to tailor Windows for the user's needs and make it work better for them. Diagnostic data can include browser, app and feature usage, depending on the Diagnostic and usage data setting value. > [!NOTE] > This setting does not control Cortana cutomized experiences because there are separate policies to configure it. Most restricted value is 0. @@ -1009,6 +1015,7 @@ Prior to Windows 10, version 1803, this policy had User scope. This policy allow Specifies whether to turn off all Windows spotlight features at once. + - If you enable this policy setting, Windows spotlight on lock screen, Windows Tips, Microsoft consumer features and other related features will be turned off. You should enable this policy setting if your goal is to minimize network traffic from target devices. - If you disable or do not configure this policy setting, Windows spotlight features are allowed and may be controlled individually using their corresponding policy settings. Most restricted value is 0. @@ -1074,6 +1081,7 @@ Specifies whether to turn off all Windows spotlight features at once. This policy allows administrators to prevent Windows spotlight notifications from being displayed in the Action Center. + - If you enable this policy, Windows spotlight notifications will no longer be displayed in the Action Center. - If you disable or do not configure this policy, Microsoft may display notifications in the Action Center that will suggest apps or features to help users be more productive on Windows. Most restricted value is 0. @@ -1203,6 +1211,7 @@ This policy allows IT admins to turn off Suggestions in Settings app. These sugg This policy setting lets you turn off the Windows spotlight Windows welcome experience feature. The Windows welcome experience feature introduces onboard users to Windows; for example, launching Microsoft Edge with a webpage that highlights new features. + - If you enable this policy, the Windows welcome experience will no longer be displayed when there are updates and changes to Windows and its apps. - If you disable or do not configure this policy, the Windows welcome experience will be launched to inform onboard users about what's new, changed, and suggested. Most restricted value is 0. @@ -1318,6 +1327,9 @@ Enables or disables Windows Tips / soft landing. ## ConfigureChatIcon +> [!NOTE] +> This policy is deprecated and may be removed in a future release. + | Scope | Editions | Applicable OS | |:--|:--|:--| @@ -1331,8 +1343,16 @@ Enables or disables Windows Tips / soft landing. - -Configures the Chat icon on the taskbar + +This policy setting allows you to configure the Chat icon on the taskbar. + +- If you enable this policy setting and set it to Show, the Chat icon will be displayed on the taskbar by default. Users can show or hide it in Settings. + +- If you enable this policy setting and set it to Hide, the Chat icon will be hidden by default. Users can show or hide it in Settings. + +- If you enable this policy setting and set it to Disabled, the Chat icon will not be displayed, and users cannot show or hide it in Settings. + +- If you disable or do not configure this policy setting, the Chat icon will be configured according to the defaults for your Windows edition. @@ -1369,7 +1389,7 @@ Configures the Chat icon on the taskbar |:--|:--| | Name | ConfigureChatIcon | | Friendly Name | Configures the Chat icon on the taskbar | -| Element Name | State | +| Element Name | State. | | Location | Computer Configuration | | Path | Windows Components > Chat | | Registry Key Name | Software\Policies\Microsoft\Windows\Windows Chat | @@ -1410,7 +1430,7 @@ Additionally, if you check the "Include content from Enterprise spotlight" check - If you do not configure this policy, Windows spotlight will be available on the lock screen and will be selected by default, unless you have configured another default lock screen image using the "Force a specific default lock screen and logon image" policy. > [!NOTE] -> This policy is only available for Enterprise SKUs +> This policy is only available for Enterprise SKUs. @@ -1593,6 +1613,55 @@ This policy setting lets you turn off cloud consumer account state content in al + +## DisableTextTranslation + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Experience/DisableTextTranslation +``` + + + + +Allows Text Translation feature to be enabled/disabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Enable Text Translation. | +| 1 | Disable Text Translation. | + + + + + + + + ## DoNotShowFeedbackNotifications @@ -1682,7 +1751,7 @@ This policy setting allows an organization to prevent its devices from showing f Prevent the "browser" group from syncing to and from this PC. This turns off and disables the "browser" group on the "sync your settings" page in PC settings. The "browser" group contains settings and info like history and favorites. -- If you enable this policy setting, the "browser" group, including info like history and favorites, will not be synced. +If you enable this policy setting, the "browser" group, including info like history and favorites, will not be synced. Use the option "Allow users to turn browser syncing on" so that syncing is turned off by default but not disabled. @@ -1767,8 +1836,7 @@ _**Turn syncing off by default but don’t disable**_ -Organizational messages allow Administrators to deliver messages to their end users on selected Windows 11 experiences. Organizational messages are available to Administrators via services like Microsoft Intune. By default, this policy is disabled. -- If you enable this policy, these experiences will show content booked by Administrators. Enabling this policy will have no impact on existing MDM policy settings governing delivery of content from Microsoft on Windows experiences. +Organizational messages allow Administrators to deliver messages to their end users on selected Windows 11 experiences. Organizational messages are available to Administrators via services like Microsoft Endpoint Manager. By default, this policy is disabled. If you enable this policy, these experiences will show content booked by Administrators. Enabling this policy will have no impact on existing MDM policy settings governing delivery of content from Microsoft on Windows experiences. @@ -1901,6 +1969,7 @@ _**Prevent syncing of browser settings and let users turn on syncing**_ Shows or hides lock from the user tile menu. + - If you enable this policy setting, the lock option will be shown in the User Tile menu. - If you disable this policy setting, the lock option will never be shown in the User Tile menu. diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md index e1291d1cb0..8a44d2c7e1 100644 --- a/windows/client-management/mdm/policy-csp-exploitguard.md +++ b/windows/client-management/mdm/policy-csp-exploitguard.md @@ -4,7 +4,7 @@ description: Learn more about the ExploitGuard Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -60,7 +60,7 @@ Enables the IT admin to push out a configuration representing the desired system |:--|:--| | Name | ExploitProtection_Name | | Friendly Name | Use a common set of exploit protection settings | -| Element Name | Type the location (local path, UNC path, or URL) of the mitigation settings configuration XML file | +| Element Name | Type the location (local path, UNC path, or URL) of the mitigation settings configuration XML file. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Exploit Guard > Exploit Protection | | Registry Key Name | Software\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection | diff --git a/windows/client-management/mdm/policy-csp-federatedauthentication.md b/windows/client-management/mdm/policy-csp-federatedauthentication.md index 41e2f19ab9..85326a86f9 100644 --- a/windows/client-management/mdm/policy-csp-federatedauthentication.md +++ b/windows/client-management/mdm/policy-csp-federatedauthentication.md @@ -4,7 +4,7 @@ description: Learn more about the FederatedAuthentication Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,7 +37,7 @@ ms.topic: reference -Specifies whether web-based sign-in is enabled with the Primary User experience +Specifies whether web-based sign-in is enabled with the Primary User experience. diff --git a/windows/client-management/mdm/policy-csp-humanpresence.md b/windows/client-management/mdm/policy-csp-humanpresence.md index 2a1b573428..66486d9057 100644 --- a/windows/client-management/mdm/policy-csp-humanpresence.md +++ b/windows/client-management/mdm/policy-csp-humanpresence.md @@ -4,7 +4,7 @@ description: Learn more about the HumanPresence Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,10 +16,249 @@ ms.topic: reference # Policy CSP - HumanPresence +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + + +## ForceAllowDimWhenExternalDisplayConnected + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForceAllowDimWhenExternalDisplayConnected +``` + + + + +Determines whether Allow Adaptive Dimming When External Display Connected checkbox is forced checked/unchecked by the MDM policy. The user will not be able to change this setting and the checkbox in the UI will be greyed out. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 2 | ForcedUnchecked. | +| 1 | ForcedChecked. | +| 0 (Default) | DefaultToUserChoice. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ForceAllowDimWhenExternalDisplayConnected | +| Path | Sensors > AT > WindowsComponents > HumanPresence | + + + + + + + + + +## ForceAllowLockWhenExternalDisplayConnected + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForceAllowLockWhenExternalDisplayConnected +``` + + + + +Determines whether Allow Lock on Leave When External Display Connected checkbox is forced checked/unchecked by the MDM policy. The user will not be able to change this setting and the checkbox in the UI will be greyed out. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 2 | ForcedUnchecked. | +| 1 | ForcedChecked. | +| 0 (Default) | DefaultToUserChoice. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ForceAllowLockWhenExternalDisplayConnected | +| Path | Sensors > AT > WindowsComponents > HumanPresence | + + + + + + + + + +## ForceAllowWakeWhenExternalDisplayConnected + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForceAllowWakeWhenExternalDisplayConnected +``` + + + + +Determines whether Allow Wake on Approach When External Display Connected checkbox is forced checked/unchecked by the MDM policy. The user will not be able to change this setting and the checkbox in the UI will be greyed out. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 2 | ForcedUnchecked. | +| 1 | ForcedChecked. | +| 0 (Default) | DefaultToUserChoice. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ForceAllowWakeWhenExternalDisplayConnected | +| Path | Sensors > AT > WindowsComponents > HumanPresence | + + + + + + + + + +## ForceDisableWakeWhenBatterySaverOn + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForceDisableWakeWhenBatterySaverOn +``` + + + + +Determines whether Disable Wake on Approach When Battery Saver On checkbox is forced checked/unchecked by the MDM policy. The user will not be able to change this setting and the checkbox in the UI will be greyed out. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 2 | ForcedUnchecked. | +| 1 | ForcedChecked. | +| 0 (Default) | DefaultToUserChoice. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ForceDisableWakeWhenBatterySaverOn | +| Path | Sensors > AT > WindowsComponents > HumanPresence | + + + + + + + + ## ForceInstantDim @@ -254,6 +493,7 @@ Determines the timeout for Lock on Leave forced by the MDM policy. The user will | 120 | TwoMinutes. | | 30 | ThirtySeconds. | | 10 | TenSeconds. | +| 1 | Immediate. | | 0 (Default) | DefaultToUserChoice. | diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index b60ae5ce2c..92fda2c42a 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -4,7 +4,7 @@ description: Learn more about the InternetExplorer Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -48,7 +48,7 @@ ms.topic: reference This policy setting allows you to add a specific list of search providers to the user's default list of search providers. Normally, search providers can be added from third-party toolbars or in Setup. The user can also add a search provider from the provider's website. -- If you enable this policy setting, the user can add and remove search providers, but only from the set of search providers specified in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]) +- If you enable this policy setting, the user can add and remove search providers, but only from the set of search providers specified in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). > [!NOTE] > This list can be created from a custom administrative template file. For information about creating this custom administrative template file, see the Internet Explorer documentation on search providers. @@ -577,7 +577,7 @@ This policy setting lets you decide whether users can turn on Enterprise Mode fo If you turn this setting on, users can see and use the Enterprise Mode option from the Tools menu. If you turn this setting on, but don't specify a report location, Enterprise Mode will still be available to your users, but you won't get any reports. -- If you disable or don't configure this policy setting, the menu option won't appear and users won't be able to run websites in Enterprise Mode. +If you disable or don't configure this policy setting, the menu option won't appear and users won't be able to run websites in Enterprise Mode. @@ -701,7 +701,7 @@ We recommend that you do not allow insecure fallback in order to prevent a man-i This policy does not affect which security protocols are enabled. -- If you disable this policy, system defaults will be used. +If you disable this policy, system defaults will be used. @@ -2098,23 +2098,23 @@ This policy setting allows you to manage whether Internet Explorer checks for di Enables you to configure up to three versions of Microsoft Edge to open a redirected site (in order of preference). Use this policy if your environment is configured to redirect sites from Internet Explorer 11 to Microsoft Edge. If any of the chosen versions are not installed on the device, that preference will be bypassed. If both the Windows Update for the next version of Microsoft Edge* and Microsoft Edge Stable channel are installed, the following behaviors occur: -- If you disable or don't configure this policy, Microsoft Edge Stable channel is used. This is the default behavior. -- If you enable this policy, you can configure redirected sites to open in up to three of the following channels where: + - If you disable or don't configure this policy, Microsoft Edge Stable channel is used. This is the default behavior. + - If you enable this policy, you can configure redirected sites to open in up to three of the following channels where: 1 = Microsoft Edge Stable 2 = Microsoft Edge Beta version 77 or later 3 = Microsoft Edge Dev version 77 or later 4 = Microsoft Edge Canary version 77 or later If the Windows Update for the next version of Microsoft Edge* or Microsoft Edge Stable channel are not installed, the following behaviors occur: -- If you disable or don't configure this policy, Microsoft Edge version 45 or earlier is automatically used. This is the default behavior. -- If you enable this policy, you can configure redirected sites to open in up to three of the following channels where: + - If you disable or don't configure this policy, Microsoft Edge version 45 or earlier is automatically used. This is the default behavior. + - If you enable this policy, you can configure redirected sites to open in up to three of the following channels where: 0 = Microsoft Edge version 45 or earlier 1 = Microsoft Edge Stable 2 = Microsoft Edge Beta version 77 or later 3 = Microsoft Edge Dev version 77 or later 4 = Microsoft Edge Canary version 77 or later -*For more information about the Windows update for the next version of Microsoft Edge including how to disable it, see . This update applies only to Windows 10 version 1709 and higher. +- For more information about the Windows update for the next version of Microsoft Edge including how to disable it, see< https://go.microsoft.com/fwlink/?linkid=2102115>. This update applies only to Windows 10 version 1709 and higher. @@ -3160,8 +3160,8 @@ This policy setting controls whether to have background synchronization for feed This policy setting prevents Internet Explorer from running the First Run wizard the first time a user starts the browser after installing Internet Explorer or Windows. - If you enable this policy setting, you must make one of the following choices: -- Skip the First Run wizard, and go directly to the user's home page. -- Skip the First Run wizard, and go directly to the "Welcome to Internet Explorer" webpage. + - Skip the First Run wizard, and go directly to the user's home page. + - Skip the First Run wizard, and go directly to the "Welcome to Internet Explorer" webpage. Starting with Windows 8, the "Welcome to Internet Explorer" webpage is not available. The user's home page will display regardless of which option is chosen. @@ -3616,13 +3616,13 @@ InPrivate Browsing prevents Internet Explorer from storing data about a user's b This policy lets you restrict launching of Internet Explorer as a standalone browser. -- If you enable this policy, it -- Prevents Internet Explorer 11 from launching as a standalone browser. -- Restricts Internet Explorer's usage to Microsoft Edge's native 'Internet Explorer mode'. -- Redirects all attempts at launching Internet Explorer 11 to Microsoft Edge Stable Channel browser. -- Overrides any other policies that redirect to Internet Explorer 11. +If you enable this policy, it: + - Prevents Internet Explorer 11 from launching as a standalone browser. + - Restricts Internet Explorer's usage to Microsoft Edge's native 'Internet Explorer mode'. + - Redirects all attempts at launching Internet Explorer 11 to Microsoft Edge Stable Channel browser. + - Overrides any other policies that redirect to Internet Explorer 11. -If you disable, or don't configure this policy, all sites are opened using the current active browser settings +If you disable, or don't configure this policy, all sites are opened using the current active browser settings. > [!NOTE] > Microsoft Edge Stable Channel must be installed for this policy to take effect. @@ -4503,7 +4503,7 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T This policy setting lets admins enable extended Microsoft Edge Internet Explorer mode hotkeys, such as "Ctrl+S" to have "Save as" functionality. -- If you enable this policy, extended hotkey functionality is enabled in Internet Explorer mode and work the same as Internet Explorer. +If you enable this policy, extended hotkey functionality is enabled in Internet Explorer mode and work the same as Internet Explorer. If you disable, or don't configure this policy, extended hotkeys will not work in Internet Explorer mode. @@ -5095,6 +5095,7 @@ This policy setting allows you to manage whether users can drag files or copy an This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -7256,6 +7257,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -7921,7 +7923,7 @@ This policy setting specifies whether JScript or JScript9Legacy is loaded for MS - If you disable this policy, then JScript will be utilized. -If this policy is left unconfigured, then MSHTML will use JScript9Legacy and MSXML/Cscript will use JScript. +- If this policy is left unconfigured, then MSHTML will use JScript9Legacy and MSXML/Cscript will use JScript. @@ -7990,10 +7992,10 @@ Prevents intranet sites from being opened in any browser except Internet Explore We strongly recommend keeping this policy in sync with the 'Send all intranet sites to Internet Explorer' ('SendIntranetToInternetExplorer') policy. Additionally, it's best to enable this policy only if your intranet sites have known compatibility problems with Microsoft Edge. Related policies: -- Send all intranet sites to Internet Explorer ('SendIntranetToInternetExplorer') -- Send all sites not included in the Enterprise Mode Site List to Microsoft Edge ('RestrictIE') + - Send all intranet sites to Internet Explorer ('SendIntranetToInternetExplorer') + - Send all sites not included in the Enterprise Mode Site List to Microsoft Edge ('RestrictIE') -For more info about how to use this policy together with other related policies to create the optimal configuration for your organization, see . +For more info about how to use this policy together with other related policies to create the optimal configuration for your organization, see< https://go.microsoft.com/fwlink/?linkid=2094210>. @@ -8272,6 +8274,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -9127,6 +9130,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -9988,6 +9992,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -10707,6 +10712,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -11497,6 +11503,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -12287,6 +12294,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -13399,7 +13407,7 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T This policy setting lets admins reset zoom to default for HTML dialogs in Internet Explorer mode. -- If you enable this policy, the zoom of an HTML dialog in Internet Explorer mode will not get propagated from its parent page. +If you enable this policy, the zoom of an HTML dialog in Internet Explorer mode will not get propagated from its parent page. If you disable, or don't configure this policy, the zoom of an HTML dialog in Internet Explorer mode will be set based on the zoom of it's parent page. @@ -14051,6 +14059,7 @@ This policy setting allows you to manage whether file downloads are permitted fr This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -16414,7 +16423,7 @@ Internet Explorer allows scripts to programmatically open, resize, and repositio This policy setting allows you to restrict the search providers that appear in the Search box in Internet Explorer to those defined in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Normally, search providers can be added from third-party toolbars or in Setup, but the user can also add them from a search provider's website. -- If you enable this policy setting, the user cannot configure the list of search providers on his or her computer, and any default providers installed do not appear (including providers installed from other applications). The only providers that appear are those in the list of policy keys for search providers +- If you enable this policy setting, the user cannot configure the list of search providers on his or her computer, and any default providers installed do not appear (including providers installed from other applications). The only providers that appear are those in the list of policy keys for search providers. > [!NOTE] > This list can be created through a custom administrative template file. For information about creating this custom administrative template file, see the Internet Explorer documentation on search providers. @@ -16895,6 +16904,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index 68f64fc6e5..870386a6e5 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -4,7 +4,7 @@ description: Learn more about the Kerberos Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -170,6 +170,7 @@ This policy setting allows retrieving the Azure AD Kerberos Ticket Granting Tick This policy setting controls whether a device will request claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication with domains that support these features. + - If you enable this policy setting, the client computers will request claims, provide information required to create compounded authentication and armor Kerberos messages in domains which support claims and compound authentication for Dynamic Access Control and Kerberos armoring. - If you disable or do not configure this policy setting, the client devices will not request claims, provide information required to create compounded authentication and armor Kerberos messages. Services hosted on the device will not be able to retrieve claims for clients using Kerberos protocol transition. @@ -241,7 +242,7 @@ This policy setting controls hash or checksum algorithms used by the Kerberos cl - "Not Supported" disables usage of the algorithm. This state is intended for algorithms that are deemed to be insecure. - If you disable or do not configure this policy, each algorithm will assume the "Default" state. -More information about the hash and checksum algorithms supported by the Windows Kerberos client and their default states can be found at . +More information about the hash and checksum algorithms supported by the Windows Kerberos client and their default states can be found at< https://go.microsoft.com/fwlink/?linkid=2169037>. Events generated by this configuration: 205, 206, 207, 208. @@ -347,8 +348,13 @@ If you don't configure this policy, the SHA1 algorithm will assume the **Default | Name | Value | |:--|:--| -| Name | PKInitHashAlgorithmSHA1 | -| Path | Kerberos > AT > System > kerberos | +| Name | PKInitHashAlgorithmConfiguration | +| Friendly Name | Configure hash algorithms for certificate logon | +| Location | Computer Configuration | +| Path | System > Kerberos | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters | +| Registry Value Name | PKInitHashAlgorithmConfigurationEnabled | +| ADMX File Name | Kerberos.admx | @@ -415,8 +421,13 @@ If you don't configure this policy, the SHA256 algorithm will assume the **Defau | Name | Value | |:--|:--| -| Name | PKInitHashAlgorithmSHA256 | -| Path | Kerberos > AT > System > kerberos | +| Name | PKInitHashAlgorithmConfiguration | +| Friendly Name | Configure hash algorithms for certificate logon | +| Location | Computer Configuration | +| Path | System > Kerberos | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters | +| Registry Value Name | PKInitHashAlgorithmConfigurationEnabled | +| ADMX File Name | Kerberos.admx | @@ -483,8 +494,13 @@ If you don't configure this policy, the SHA384 algorithm will assume the **Defau | Name | Value | |:--|:--| -| Name | PKInitHashAlgorithmSHA384 | -| Path | Kerberos > AT > System > kerberos | +| Name | PKInitHashAlgorithmConfiguration | +| Friendly Name | Configure hash algorithms for certificate logon | +| Location | Computer Configuration | +| Path | System > Kerberos | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters | +| Registry Value Name | PKInitHashAlgorithmConfigurationEnabled | +| ADMX File Name | Kerberos.admx | @@ -551,8 +567,13 @@ If you don't configure this policy, the SHA512 algorithm will assume the **Defau | Name | Value | |:--|:--| -| Name | PKInitHashAlgorithmSHA512 | -| Path | Kerberos > AT > System > kerberos | +| Name | PKInitHashAlgorithmConfiguration | +| Friendly Name | Configure hash algorithms for certificate logon | +| Location | Computer Configuration | +| Path | System > Kerberos | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters | +| Registry Value Name | PKInitHashAlgorithmConfigurationEnabled | +| ADMX File Name | Kerberos.admx | diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md index b425e49931..4ece74db51 100644 --- a/windows/client-management/mdm/policy-csp-licensing.md +++ b/windows/client-management/mdm/policy-csp-licensing.md @@ -4,7 +4,7 @@ description: Learn more about the Licensing Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -39,9 +39,9 @@ ms.topic: reference This policy setting controls whether OS Reactivation is blocked on a device. Policy Options: -- Not Configured (default -- Windows registration and reactivation is allowed) -- Disabled (Windows registration and reactivation is not allowed) -- Enabled (Windows registration is allowed) + - Not Configured (default -- Windows registration and reactivation is allowed) + - Disabled (Windows registration and reactivation is not allowed) + - Enabled (Windows registration is allowed) @@ -105,11 +105,11 @@ Policy Options: This policy setting lets you opt-out of sending KMS client activation data to Microsoft automatically. Enabling this setting prevents this computer from sending data to Microsoft regarding its activation state. -- If you disable or do not configure this policy setting, KMS client activation data will be sent to Microsoft services when this device activates. +If you disable or do not configure this policy setting, KMS client activation data will be sent to Microsoft services when this device activates. Policy Options: -- Not Configured (default -- data will be automatically sent to Microsoft) -- Disabled (data will be automatically sent to Microsoft) -- Enabled (data will not be sent to Microsoft) + - Not Configured (default -- data will be automatically sent to Microsoft) + - Disabled (data will be automatically sent to Microsoft) + - Enabled (data will not be sent to Microsoft) diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 075a1bd389..b85c550c26 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -4,7 +4,7 @@ description: Learn more about the LocalPoliciesSecurityOptions Area in Policy CS author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,9 @@ ms.topic: reference # Policy CSP - LocalPoliciesSecurityOptions +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + > [!NOTE] @@ -39,8 +42,7 @@ ms.topic: reference -This policy setting prevents users from adding new Microsoft accounts on this computer. If you select the "Users can't add Microsoft accounts" option, users will not be able to create new Microsoft accounts on this computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. If you select the "Users can't add or log on with Microsoft accounts" option, existing Microsoft account users will not be able to log on to Windows. Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system. -- If you disable or do not configure this policy (recommended), users will be able to use Microsoft accounts with Windows. +This policy setting prevents users from adding new Microsoft accounts on this computer. If you select the "Users can't add Microsoft accounts" option, users will not be able to create new Microsoft accounts on this computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. If you select the "Users can't add or log on with Microsoft accounts" option, existing Microsoft account users will not be able to log on to Windows. Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system. If you disable or do not configure this policy (recommended), users will be able to use Microsoft accounts with Windows. @@ -99,10 +101,10 @@ This policy setting prevents users from adding new Microsoft accounts on this co -This security setting determines whether the local Administrator account is enabled or disabled +This security setting determines whether the local Administrator account is enabled or disabled. > [!NOTE] -> If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password. Disabling the Administrator account can become a maintenance issue under certain circumstances. Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled. Default Disabled. +> If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password. Disabling the Administrator account can become a maintenance issue under certain circumstances. Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled. Default: Disabled. @@ -160,10 +162,10 @@ This security setting determines whether the local Administrator account is enab -This security setting determines if the Guest account is enabled or disabled. Default Disabled +This security setting determines if the Guest account is enabled or disabled. Default: Disabled. > [!NOTE] -> If the Guest account is disabled and the security option Network Access Sharing and Security Model for local accounts is set to Guest Only, network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail. +> If the Guest account is disabled and the security option Network Access: Sharing and Security Model for local accounts is set to Guest Only, network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail. @@ -221,10 +223,10 @@ This security setting determines if the Guest account is enabled or disabled. De -Accounts Limit local account use of blank passwords to console logon only This security setting determines whether local accounts that are not password protected can be used to log on from locations other than the physical computer console. If enabled, local accounts that are not password protected will only be able to log on at the computer's keyboard. Default Enabled +Accounts: Limit local account use of blank passwords to console logon only This security setting determines whether local accounts that are not password protected can be used to log on from locations other than the physical computer console. If enabled, local accounts that are not password protected will only be able to log on at the computer's keyboard. Default: Enabled. > [!WARNING] -> Computers that are not in physically secure locations should always enforce strong password policies for all local user accounts. Otherwise, anyone with physical access to the computer can log on by using a user account that does not have a password. This is especially important for portable computers. If you apply this security policy to the Everyone group, no one will be able to log on through Remote Desktop Services +> Computers that are not in physically secure locations should always enforce strong password policies for all local user accounts. Otherwise, anyone with physical access to the computer can log on by using a user account that does not have a password. This is especially important for portable computers. If you apply this security policy to the Everyone group, no one will be able to log on through Remote Desktop Services. > [!NOTE] > This setting does not affect logons that use domain accounts. It is possible for applications that use remote interactive logons to bypass this setting. @@ -432,7 +434,7 @@ Devices: Allowed to format and eject removable media This security setting deter -Devices Allow undock without having to log on This security setting determines whether a portable computer can be undocked without having to log on. If this policy is enabled, logon is not required and an external hardware eject button can be used to undock the computer. If disabled, a user must log on and have the Remove computer from docking station privilege to undock the computer. Default Enabled +Devices: Allow undock without having to log on This security setting determines whether a portable computer can be undocked without having to log on. If this policy is enabled, logon is not required and an external hardware eject button can be used to undock the computer. If disabled, a user must log on and have the Remove computer from docking station privilege to undock the computer. Default: Enabled. > [!CAUTION] > Disabling this policy may tempt users to try and physically remove the laptop from its docking station using methods other than the external hardware eject button. Since this may cause damage to the hardware, this setting, in general, should only be disabled on laptop configurations that are physically securable. @@ -494,6 +496,7 @@ Devices Allow undock without having to log on This security setting determines w Devices: Prevent users from installing printer drivers when connecting to shared printers For a computer to print to a shared printer, the driver for that shared printer must be installed on the local computer. This security setting determines who is allowed to install a printer driver as part of connecting to a shared printer. + - If this setting is enabled, only Administrators can install a printer driver as part of connecting to a shared printer. - If this setting is disabled, any user can install a printer driver as part of connecting to a shared printer. Default on servers: Enabled. Default on workstations: Disabled Notes This setting does not affect the ability to add a local printer. This setting does not affect Administrators. @@ -986,10 +989,10 @@ Interactive logon: Message title for users attempting to log on This security se -Interactive logon Smart card removal behavior This security setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. The options are No Action Lock Workstation Force Logoff Disconnect if a Remote Desktop Services session If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session. If you click Force Logoff in the Properties dialog box for this policy, the user is automatically logged off when the smart card is removed. If you click Disconnect if a Remote Desktop Services session, removal of the smart card disconnects the session without logging the user off. This allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped computer, without having to log on again. If the session is local, this policy functions identically to Lock Workstation +Interactive logon: Smart card removal behavior This security setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. The options are: No Action Lock Workstation Force Logoff Disconnect if a Remote Desktop Services session If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session. If you click Force Logoff in the Properties dialog box for this policy, the user is automatically logged off when the smart card is removed. If you click Disconnect if a Remote Desktop Services session, removal of the smart card disconnects the session without logging the user off. This allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped computer, without having to log on again. If the session is local, this policy functions identically to Lock Workstation. > [!NOTE] -> Remote Desktop Services was called Terminal Services in previous versions of Windows Server. Default This policy is not defined, which means that the system treats it as No action. On Windows Vista and above For this setting to work, the Smart Card Removal Policy service must be started. +> Remote Desktop Services was called Terminal Services in previous versions of Windows Server. Default: This policy is not defined, which means that the system treats it as No action. On Windows Vista and above: For this setting to work, the Smart Card Removal Policy service must be started. @@ -1049,14 +1052,16 @@ Interactive logon Smart card removal behavior This security setting determines w -Microsoft network client Digitally sign communications (always) This security setting determines whether packet signing is required by the SMB client component. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. -- If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. Default Disabled +Microsoft network client: Digitally sign communications (always) This security setting determines whether packet signing is required by the SMB client component. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. + +- If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. +- If this policy is disabled, SMB packet signing is negotiated between the client and server. Default: Disabled. > [!IMPORTANT] -> For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client Digitally sign communications (if server agrees) +> For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client: Digitally sign communications (if server agrees). > [!NOTE] -> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings Microsoft network client Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. For more information, reference . +> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>. @@ -1114,11 +1119,13 @@ Microsoft network client Digitally sign communications (always) This security se -Microsoft network client Digitally sign communications (if server agrees) This security setting determines whether the SMB client attempts to negotiate SMB packet signing. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB client component attempts to negotiate SMB packet signing when it connects to an SMB server. -- If this setting is enabled, the Microsoft network client will ask the server to perform SMB packet signing upon session setup. If packet signing has been enabled on the server, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing. Default Enabled +Microsoft network client: Digitally sign communications (if server agrees) This security setting determines whether the SMB client attempts to negotiate SMB packet signing. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB client component attempts to negotiate SMB packet signing when it connects to an SMB server. + +- If this setting is enabled, the Microsoft network client will ask the server to perform SMB packet signing upon session setup. If packet signing has been enabled on the server, packet signing will be negotiated. +- If this policy is disabled, the SMB client will never negotiate SMB packet signing. Default: Enabled. > [!NOTE] -> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings Microsoft network client Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference . +> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>. @@ -1234,15 +1241,16 @@ Microsoft network client: Send unencrypted password to connect to third-party SM -Microsoft network server Digitally sign communications (always) This security setting determines whether packet signing is required by the SMB server component. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB client is permitted. +Microsoft network server: Digitally sign communications (always) This security setting determines whether packet signing is required by the SMB server component. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB client is permitted. + - If this setting is enabled, the Microsoft network server will not communicate with a Microsoft network client unless that client agrees to perform SMB packet signing. -- If this setting is disabled, SMB packet signing is negotiated between the client and server. Default Disabled for member servers. Enabled for domain controllers +- If this setting is disabled, SMB packet signing is negotiated between the client and server. Default: Disabled for member servers. Enabled for domain controllers. > [!NOTE] -> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings Microsoft network client Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. Similarly, if client-side SMB signing is required, that client will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. If server-side SMB signing is enabled, SMB packet signing will be negotiated with clients that have client-side SMB signing enabled. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors +> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. Similarly, if client-side SMB signing is required, that client will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. If server-side SMB signing is enabled, SMB packet signing will be negotiated with clients that have client-side SMB signing enabled. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. > [!IMPORTANT] -> For this policy to take effect on computers running Windows 2000, server-side packet signing must also be enabled. To enable server-side SMB packet signing, set the following policy Microsoft network server Digitally sign communications (if server agrees) For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the Windows 2000 server HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature For more information, reference . +> For this policy to take effect on computers running Windows 2000, server-side packet signing must also be enabled. To enable server-side SMB packet signing, set the following policy: Microsoft network server: Digitally sign communications (if server agrees) For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the Windows 2000 server: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>. @@ -1300,11 +1308,13 @@ Microsoft network server Digitally sign communications (always) This security se -Microsoft network server Digitally sign communications (if client agrees) This security setting determines whether the SMB server will negotiate SMB packet signing with clients that request it. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB server will negotiate SMB packet signing when an SMB client requests it. -- If this setting is enabled, the Microsoft network server will negotiate SMB packet signing as requested by the client. That is, if packet signing has been enabled on the client, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing. Default Enabled on domain controllers only +Microsoft network server: Digitally sign communications (if client agrees) This security setting determines whether the SMB server will negotiate SMB packet signing with clients that request it. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB server will negotiate SMB packet signing when an SMB client requests it. + +- If this setting is enabled, the Microsoft network server will negotiate SMB packet signing as requested by the client. That is, if packet signing has been enabled on the client, packet signing will be negotiated. +- If this policy is disabled, the SMB client will never negotiate SMB packet signing. Default: Enabled on domain controllers only. > [!IMPORTANT] -> For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the server running Windows 2000 HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature Notes All Windows operating systems support both a client-side SMB component and a server-side SMB component. For Windows 2000 and above, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings Microsoft network client Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference . +> For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the server running Windows 2000: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature Notes All Windows operating systems support both a client-side SMB component and a server-side SMB component. For Windows 2000 and above, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>. @@ -1362,7 +1372,8 @@ Microsoft network server Digitally sign communications (if client agrees) This s -Network access: Allow anonymous SID/name translation This policy setting determines whether an anonymous user can request security identifier (SID) attributes for another user. If this policy is enabled, an anonymous user can request the SID attribute for another user. An anonymous user with knowledge of an administrator's SID could contact a computer that has this policy enabled and use the SID to get the administrator's name. This setting affects both the SID-to-name translation as well as the name-to-SID translation. +Network access: Allow anonymous SID/name translation This policy setting determines whether an anonymous user can request security identifier (SID) attributes for another user. +- If this policy is enabled, an anonymous user can request the SID attribute for another user. An anonymous user with knowledge of an administrator's SID could contact a computer that has this policy enabled and use the SID to get the administrator's name. This setting affects both the SID-to-name translation as well as the name-to-SID translation. - If this policy setting is disabled, an anonymous user cannot request the SID attribute for another user. Default on workstations and member servers: Disabled. Default on domain controllers running Windows Server 2008 or later: Disabled. Default on domain controllers running Windows Server 2003 R2 or earlier: Enabled. @@ -1421,7 +1432,7 @@ Network access: Allow anonymous SID/name translation This policy setting determi -Network access Do not allow anonymous enumeration of SAM accounts This security setting determines what additional permissions will be granted for anonymous connections to the computer. Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. This security option allows additional restrictions to be placed on anonymous connections as follows Enabled Do not allow enumeration of SAM accounts. This option replaces Everyone with Authenticated Users in the security permissions for resources. Disabled No additional restrictions. Rely on default permissions. Default on workstations Enabled. Default on serverEnabled +Network access: Do not allow anonymous enumeration of SAM accounts This security setting determines what additional permissions will be granted for anonymous connections to the computer. Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. This security option allows additional restrictions to be placed on anonymous connections as follows: Enabled: Do not allow enumeration of SAM accounts. This option replaces Everyone with Authenticated Users in the security permissions for resources. Disabled: No additional restrictions. Rely on default permissions. Default on workstations: Enabled. Default on server:Enabled. > [!IMPORTANT] > This policy has no impact on domain controllers. @@ -1646,9 +1657,10 @@ Network access: Restrict clients allowed to make remote calls to SAM This policy -Network security Allow Local System to use computer identity for NTLM This policy setting allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. +Network security: Allow Local System to use computer identity for NTLM This policy setting allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. + - If you enable this policy setting, services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error. -- If you disable this policy setting, services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. By default, this policy is enabled on Windows 7 and above. By default, this policy is disabled on Windows Vista. This policy is supported on at least Windows Vista or Windows Server 2008 +- If you disable this policy setting, services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. By default, this policy is enabled on Windows 7 and above. By default, this policy is disabled on Windows Vista. This policy is supported on at least Windows Vista or Windows Server 2008. > [!NOTE] > Windows Vista or Windows Server 2008 do not expose this setting in Group Policy. @@ -1772,7 +1784,7 @@ Network security: Allow PKU2U authentication requests to this computer to use on -Network security Do not store LAN Manager hash value on next password change This security setting determines if, at the next password change, the LAN Manager (LM) hash value for the new password is stored. The LM hash is relatively weak and prone to attack, as compared with the cryptographically stronger Windows NT hash. Since the LM hash is stored on the local computer in the security database the passwords can be compromised if the security database is attacked. Default on Windows Vista and above Enabled Default on Windows XP Disabled +Network security: Do not store LAN Manager hash value on next password change This security setting determines if, at the next password change, the LAN Manager (LM) hash value for the new password is stored. The LM hash is relatively weak and prone to attack, as compared with the cryptographically stronger Windows NT hash. Since the LM hash is stored on the local computer in the security database the passwords can be compromised if the security database is attacked. Default on Windows Vista and above: Enabled Default on Windows XP: Disabled. > [!IMPORTANT] > Windows 2000 Service Pack 2 (SP2) and above offer compatibility with authentication to previous versions of Windows, such as Microsoft Windows NT 4.0. This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP, and the Windows Server 2003 family to communicate with computers running Windows 95 and Windows 98. @@ -1833,7 +1845,7 @@ Network security Do not store LAN Manager hash value on next password change Thi -Network security Force logoff when logon hours expire This security setting determines whether to disconnect users who are connected to the local computer outside their user account's valid logon hours. This setting affects the Server Message Block (SMB) component. When this policy is enabled, it causes client sessions with the SMB server to be forcibly disconnected when the client's logon hours expire. If this policy is disabled, an established client session is allowed to be maintained after the client's logon hours have expired. Default Enabled +Network security: Force logoff when logon hours expire This security setting determines whether to disconnect users who are connected to the local computer outside their user account's valid logon hours. This setting affects the Server Message Block (SMB) component. When this policy is enabled, it causes client sessions with the SMB server to be forcibly disconnected when the client's logon hours expire. If this policy is disabled, an established client session is allowed to be maintained after the client's logon hours have expired. Default: Enabled. > [!NOTE] > This security setting behaves as an account policy. For domain accounts, there can be only one account policy. The account policy must be defined in the Default Domain Policy, and it is enforced by the domain controllers that make up the domain. A domain controller always pulls the account policy from the Default Domain Policy Group Policy object (GPO), even if there is a different account policy applied to the organizational unit that contains the domain controller. By default, workstations and servers that are joined to a domain (for example, member computers) also receive the same account policy for their local accounts. However, local account policies for member computers can be different from the domain account policy by defining an account policy for the organizational unit that contains the member computers. Kerberos settings are not applied to member computers. @@ -1894,10 +1906,10 @@ Network security Force logoff when logon hours expire This security setting dete -Network security LAN Manager authentication level This security setting determines which challenge/response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers as follows Send LM and NTLM responses Clients use LM and NTLM authentication and never use NTLMv2 session security; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send LM and NTLM - use NTLMv2 session security if negotiated Clients use LM and NTLM authentication and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLM response only Clients use NTLM authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLMv2 response only Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLMv2 response only\refuse LM Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM (accept only NTLM and NTLMv2 authentication). Send NTLMv2 response only\refuse LM and NTLM Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM and NTLM (accept only NTLMv2 authentication) +Network security LAN Manager authentication level This security setting determines which challenge/response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers as follows: Send LM and NTLM responses: Clients use LM and NTLM authentication and never use NTLMv2 session security; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send LM and NTLM - use NTLMv2 session security if negotiated: Clients use LM and NTLM authentication and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLM response only: Clients use NTLM authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLMv2 response only: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLMv2 response only\refuse LM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM (accept only NTLM and NTLMv2 authentication). Send NTLMv2 response only\refuse LM and NTLM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM and NTLM (accept only NTLMv2 authentication). > [!IMPORTANT] -> This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP Professional, and the Windows Server 2003 family to communicate with computers running Windows NT 4.0 and earlier over the network. For example, at the time of this writing, computers running Windows NT 4.0 SP4 and earlier did not support NTLMv2. Computers running Windows 95 and Windows 98 did not support NTLM. Default Windows 2000 and windows XP send LM and NTLM responses Windows Server 2003 Send NTLM response only Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 Send NTLMv2 response only +> This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP Professional, and the Windows Server 2003 family to communicate with computers running Windows NT 4.0 and earlier over the network. For example, at the time of this writing, computers running Windows NT 4.0 SP4 and earlier did not support NTLMv2. Computers running Windows 95 and Windows 98 did not support NTLM. Default: Windows 2000 and windows XP: send LM and NTLM responses Windows Server 2003: Send NTLM response only Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send NTLMv2 response only. @@ -1959,7 +1971,7 @@ Network security LAN Manager authentication level This security setting determin -Network security: Minimum session security for NTLM SSP based (including secure RPC) clients This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. Default: Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. Windows 7 and Windows Server 2008 R2: Require 128-bit encryption +Network security: Minimum session security for NTLM SSP based (including secure RPC) clients This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. Default: Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. Windows 7 and Windows Server 2008 R2: Require 128-bit encryption. @@ -2019,7 +2031,7 @@ Network security: Minimum session security for NTLM SSP based (including secure -Network security: Minimum session security for NTLM SSP based (including secure RPC) servers This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated. Default: Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. Windows 7 and Windows Server 2008 R2: Require 128-bit encryption +Network security: Minimum session security for NTLM SSP based (including secure RPC) servers This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated. Default: Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. Windows 7 and Windows Server 2008 R2: Require 128-bit encryption. @@ -2079,7 +2091,8 @@ Network security: Minimum session security for NTLM SSP based (including secure -Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication This policy setting allows you to create an exception list of remote servers to which clients are allowed to use NTLM authentication if the "Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers" policy setting is configured. If you configure this policy setting, you can define a list of remote servers to which clients are allowed to use NTLM authentication. +Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication This policy setting allows you to create an exception list of remote servers to which clients are allowed to use NTLM authentication if the "Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers" policy setting is configured. +- If you configure this policy setting, you can define a list of remote servers to which clients are allowed to use NTLM authentication. - If you do not configure this policy setting, no exceptions will be applied. The naming format for servers on this exception list is the fully qualified domain name (FQDN) or NetBIOS server name used by the application, listed one per line. To ensure exceptions the name used by all applications needs to be in the list, and to ensure an exception is accurate, the server name should be listed in both naming formats . A single asterisk (*) can be used anywhere in the string as a wildcard character. @@ -2129,7 +2142,7 @@ Network security: Restrict NTLM: Add remote server exceptions for NTLM authentic -Network security Restrict NTLM Audit Incoming NTLM Traffic This policy setting allows you to audit incoming NTLM traffic. If you select "Disable", or do not configure this policy setting, the server will not log events for incoming NTLM traffic. If you select "Enable auditing for domain accounts", the server will log events for NTLM pass-through authentication requests that would be blocked when the "Network Security Restrict NTLM Incoming NTLM traffic" policy setting is set to the "Deny all domain accounts" option. If you select "Enable auditing for all accounts", the server will log events for all NTLM authentication requests that would be blocked when the "Network Security Restrict NTLM Incoming NTLM traffic" policy setting is set to the "Deny all accounts" option. This policy is supported on at least Windows 7 or Windows Server 2008 R2 +Network security: Restrict NTLM: Audit Incoming NTLM Traffic This policy setting allows you to audit incoming NTLM traffic. If you select "Disable", or do not configure this policy setting, the server will not log events for incoming NTLM traffic. If you select "Enable auditing for domain accounts", the server will log events for NTLM pass-through authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all domain accounts" option. If you select "Enable auditing for all accounts", the server will log events for all NTLM authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all accounts" option. This policy is supported on at least Windows 7 or Windows Server 2008 R2. > [!NOTE] > Audit events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. @@ -2191,7 +2204,7 @@ Network security Restrict NTLM Audit Incoming NTLM Traffic This policy setting a -Network security Restrict NTLM Incoming NTLM traffic This policy setting allows you to deny or allow incoming NTLM traffic. If you select "Allow all" or do not configure this policy setting, the server will allow all NTLM authentication requests. If you select "Deny all domain accounts," the server will deny NTLM authentication requests for domain logon and display an NTLM blocked error, but allow local account logon. If you select "Deny all accounts," the server will deny NTLM authentication requests from incoming traffic and display an NTLM blocked error. This policy is supported on at least Windows 7 or Windows Server 2008 R2 +Network security: Restrict NTLM: Incoming NTLM traffic This policy setting allows you to deny or allow incoming NTLM traffic. If you select "Allow all" or do not configure this policy setting, the server will allow all NTLM authentication requests. If you select "Deny all domain accounts," the server will deny NTLM authentication requests for domain logon and display an NTLM blocked error, but allow local account logon. If you select "Deny all accounts," the server will deny NTLM authentication requests from incoming traffic and display an NTLM blocked error. This policy is supported on at least Windows 7 or Windows Server 2008 R2. > [!NOTE] > Block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. @@ -2253,7 +2266,7 @@ Network security Restrict NTLM Incoming NTLM traffic This policy setting allows -Network security Restrict NTLM Outgoing NTLM traffic to remote servers This policy setting allows you to deny or audit outgoing NTLM traffic from this Windows 7 or this Windows Server 2008 R2 computer to any Windows remote server. If you select "Allow all" or do not configure this policy setting, the client computer can authenticate identities to a remote server by using NTLM authentication. If you select "Audit all," the client computer logs an event for each NTLM authentication request to a remote server. This allows you to identify those servers receiving NTLM authentication requests from the client computer. If you select "Deny all," the client computer cannot authenticate identities to a remote server by using NTLM authentication. You can use the "Network security Restrict NTLM Add remote server exceptions for NTLM authentication" policy setting to define a list of remote servers to which clients are allowed to use NTLM authentication. This policy is supported on at least Windows 7 or Windows Server 2008 R2 +Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers This policy setting allows you to deny or audit outgoing NTLM traffic from this Windows 7 or this Windows Server 2008 R2 computer to any Windows remote server. If you select "Allow all" or do not configure this policy setting, the client computer can authenticate identities to a remote server by using NTLM authentication. If you select "Audit all," the client computer logs an event for each NTLM authentication request to a remote server. This allows you to identify those servers receiving NTLM authentication requests from the client computer. If you select "Deny all," the client computer cannot authenticate identities to a remote server by using NTLM authentication. You can use the "Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication" policy setting to define a list of remote servers to which clients are allowed to use NTLM authentication. This policy is supported on at least Windows 7 or Windows Server 2008 R2. > [!NOTE] > Audit and block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. @@ -2373,8 +2386,7 @@ Shutdown: Allow system to be shut down without having to log on This security se -Shutdown: Clear virtual memory pagefile This security setting determines whether the virtual memory pagefile is cleared when the system is shut down. Virtual memory support uses a system pagefile to swap pages of memory to disk when they are not used. On a running system, this pagefile is opened exclusively by the operating system, and it is well protected. However, systems that are configured to allow booting to other operating systems might have to make sure that the system pagefile is wiped clean when this system shuts down. This ensures that sensitive information from process memory that might go into the pagefile is not available to an unauthorized user who manages to directly access the pagefile. When this policy is enabled, it causes the system pagefile to be cleared upon clean shutdown. -- If you enable this security option, the hibernation file (hiberfil.sys) is also zeroed out when hibernation is disabled. Default: Disabled. +Shutdown: Clear virtual memory pagefile This security setting determines whether the virtual memory pagefile is cleared when the system is shut down. Virtual memory support uses a system pagefile to swap pages of memory to disk when they are not used. On a running system, this pagefile is opened exclusively by the operating system, and it is well protected. However, systems that are configured to allow booting to other operating systems might have to make sure that the system pagefile is wiped clean when this system shuts down. This ensures that sensitive information from process memory that might go into the pagefile is not available to an unauthorized user who manages to directly access the pagefile. When this policy is enabled, it causes the system pagefile to be cleared upon clean shutdown. If you enable this security option, the hibernation file (hiberfil.sys) is also zeroed out when hibernation is disabled. Default: Disabled. @@ -2490,10 +2502,10 @@ User Account Control: Allow UIAccess applications to prompt for elevation withou -User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode This policy setting controls the behavior of the elevation prompt for administrators. The options are - Elevate without prompting Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials +User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode This policy setting controls the behavior of the elevation prompt for administrators. The options are: - Elevate without prompting: Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials. > [!NOTE] -> Use this option only in the most constrained environments. - Prompt for credentials on the secure desktop When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. - Prompt for consent on the secure desktop When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - Prompt for credentials When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - Prompt for consent When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - Prompt for consent for non-Windows binaries (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. +> Use this option only in the most constrained environments. - Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. - Prompt for consent on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - Prompt for credentials: When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - Prompt for consent: When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - Prompt for consent for non-Windows binaries: (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. @@ -2788,7 +2800,7 @@ User Account Control: Only elevate UIAccess applications that are installed in s -User Account Control Turn on Admin Approval Mode This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. The options are - Enabled (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. - Disabled Admin Approval Mode and all related UAC policy settings are disabled +User Account Control: Turn on Admin Approval Mode This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. The options are: - Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. - Disabled: Admin Approval Mode and all related UAC policy settings are disabled. > [!NOTE] > If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. diff --git a/windows/client-management/mdm/policy-csp-localusersandgroups.md b/windows/client-management/mdm/policy-csp-localusersandgroups.md index f2cfa06fb3..bf0872d969 100644 --- a/windows/client-management/mdm/policy-csp-localusersandgroups.md +++ b/windows/client-management/mdm/policy-csp-localusersandgroups.md @@ -4,7 +4,7 @@ description: Learn more about the LocalUsersAndGroups Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,10 +37,16 @@ ms.topic: reference -This Setting allows an administrator to manage local groups on a Device. Possible settings: +This Setting allows an administrator to manage local groups on a Device. +Possible settings: -1. Update Group Membership Update a group and add and/or remove members though the 'U' action. When using Update, existing group members that are not specified in the policy remain untouched. -2. Replace Group Membership Restrict a group by replacing group membership through the 'R' action. When using Replace, existing group membership is replaced by the list of members specified in the add member section. This option works in the same way as a Restricted Group and any group members that are not specified in the policy are removed. +1. Update Group Membership: Update a group and add and/or remove members though the 'U' action. +When using Update, existing group members that are not specified in the policy remain untouched. + +2. Replace Group Membership: Restrict a group by replacing group membership through the 'R' action. +When using Replace, existing group membership is replaced by the list of members specified in +the add member section. This option works in the same way as a Restricted Group and any group +members that are not specified in the policy are removed. > [!CAUTION] > If the same group is configured with both Replace and Update, then Replace will win. diff --git a/windows/client-management/mdm/policy-csp-multitasking.md b/windows/client-management/mdm/policy-csp-multitasking.md index ee17cf4ab6..c4a07c645d 100644 --- a/windows/client-management/mdm/policy-csp-multitasking.md +++ b/windows/client-management/mdm/policy-csp-multitasking.md @@ -4,7 +4,7 @@ description: Learn more about the Multitasking Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,8 +36,12 @@ ms.topic: reference - -Configures the inclusion of Microsoft Edge tabs into Alt-Tab. + +This setting controls the inclusion of Microsoft Edge tabs into Alt+Tab. + +This can be set to show all tabs, the most recent 3 or 5 tabs, or no tabs from Microsoft Edge. + +If this is set to show "Open windows only", the whole feature will be disabled. @@ -77,9 +81,13 @@ This policy only applies to the Alt+Tab switcher. When the policy isn't enabled, | Name | Value | |:--|:--| -| Name | MultiTaskingAltTabFilter | -| Path | multitasking > AT > WindowsComponents > MULTITASKING | -| Element Name | AltTabFilterDropdown | +| Name | BrowserAltTabBlowout | +| Friendly Name | Configure the inclusion of Microsoft Edge tabs into Alt-Tab | +| Element Name | Pressing Alt + Tab shows. | +| Location | User Configuration | +| Path | Windows Components > Multitasking | +| Registry Key Name | Software\Policies\Microsoft\Windows\Explorer | +| ADMX File Name | Multitasking.admx | diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md index 2805dfa3b0..ec7813abdb 100644 --- a/windows/client-management/mdm/policy-csp-networkisolation.md +++ b/windows/client-management/mdm/policy-csp-networkisolation.md @@ -4,7 +4,7 @@ description: Learn more about the NetworkIsolation Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,8 +36,18 @@ ms.topic: reference - -Contains a list of Enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the EnterpriseInternalProxyServers policy. This domain list is a pipe-separated list of cloud resources. Each cloud resource can also be paired optionally with an internal proxy server by using a trailing comma followed by the proxy address. For example, ``|``|``,``|``|``,``|. + +This setting does not apply to desktop apps. + +A pipe-separated list of domain cloud resources. Each cloud resource can also be paired optionally with an internal proxy server by using a trailing comma followed by the proxy address. + +Contains a list of Enterprise resource domains hosted in the cloud. Connections to these resources are considered connections to enterprise networks. + +If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the Intranet proxy servers for apps policy. + +Example: [cloudresource]|[cloudresource]|[cloudresource],[proxy]|[cloudresource]|[cloudresource],[proxy]| + +For more information see: @@ -61,7 +71,7 @@ Contains a list of Enterprise resource domains hosted in the cloud that need to |:--|:--| | Name | WF_NetIsolation_EnterpriseCloudResources | | Friendly Name | Enterprise resource domains hosted in the cloud | -| Element Name | Enterprise cloud resources | +| Element Name | Enterprise cloud resources. | | Location | Computer Configuration | | Path | Network > Network Isolation | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation | @@ -90,8 +100,20 @@ Contains a list of Enterprise resource domains hosted in the cloud that need to - -This is the comma-separated list of internal proxy servers. For example 157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59. These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the EnterpriseCloudResources policy to force traffic to the matched cloud resources through these proxies. + +This setting does not apply to desktop apps. + +A semicolon-separated list of intranet proxy server IP addresses. These addresses are categorized as private by Windows Network Isolation and are accessible to apps that have the Home/Work Networking capability. + +- If you enable this policy setting, it allows an administrator to configure a set of proxies that provide access to intranet resources. + +- If you disable or do not configure this policy setting, Windows Network Isolation attempts to discover proxies and configures them as Internet nodes. + +This setting should NOT be used to configure Internet proxies. + +Example: [3efe:3022::1000]; 18.0.0.1; 18.0.0.2 + +For more information see: @@ -115,7 +137,7 @@ This is the comma-separated list of internal proxy servers. For example 157.54.1 |:--|:--| | Name | WF_NetIsolation_Intranet_Proxies | | Friendly Name | Intranet proxy servers for apps | -| Element Name | Type a proxy server IP address for the intranet | +| Element Name | Type a proxy server IP address for the intranet. | | Location | Computer Configuration | | Path | Network > Network Isolation | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation | @@ -144,8 +166,22 @@ This is the comma-separated list of internal proxy servers. For example 157.54.1 - -Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of IPv4 and IPv6 ranges. + +This setting does not apply to desktop apps. + +A comma-separated list of IP address ranges that are in your corporate network. + +- If you enable this policy setting, it ensures that apps with the Home/Work Networking capability have appropriate access to your corporate network. These addresses are only accessible to apps if and only if the app has declared the Home/Work Networking capability. + +Windows Network Isolation attempts to automatically discover private network hosts. By default, the addresses configured with this policy setting are merged with the hosts that are declared as private through automatic discovery. + +To ensure that these addresses are the only addresses ever classified as private, enable the "Subnet definitions are authoritative" policy setting. + +- If you disable or do not configure this policy setting, Windows Network Isolation attempts to automatically discover your private network hosts. + +Example: 3efe:1092::/96,18.1.1.1/10 + +For more information see: @@ -169,7 +205,7 @@ Sets the enterprise IP ranges that define the computers in the enterprise networ |:--|:--| | Name | WF_NetIsolation_PrivateSubnet | | Friendly Name | Private network ranges for apps | -| Element Name | Private subnets | +| Element Name | Private subnets. | | Location | Computer Configuration | | Path | Network > Network Isolation | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation | @@ -280,10 +316,10 @@ For more information see: -This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of domains, for example contoso. sharepoint. com, Fabrikam. com +This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of domains, for example contoso. sharepoint. com, Fabrikam. com. > [!NOTE] -> The client requires domain name to be canonical, otherwise the setting will be rejected by the client. Here are the steps to create canonical domain namesTransform the ASCII characters (A-Z only) to lower case. For example, Microsoft. COM -> microsoft. com. Call IdnToAscii with IDN_USE_STD3_ASCII_RULES as the flags. Call IdnToUnicode with no flags set (dwFlags = 0). +> The client requires domain name to be canonical, otherwise the setting will be rejected by the client. Here are the steps to create canonical domain names:Transform the ASCII characters (A-Z only) to lower case. For example, Microsoft. COM -> microsoft. com. Call IdnToAscii with IDN_USE_STD3_ASCII_RULES as the flags. Call IdnToUnicode with no flags set (dwFlags = 0). @@ -327,8 +363,18 @@ For more information, see the following APIs: - -This is a comma-separated list of proxy servers. Any server on this list is considered non-enterprise. For example 157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59. + +This setting does not apply to desktop apps. + +A semicolon-separated list of Internet proxy server IP addresses. These addresses are categorized as Internet by Windows Network Isolation and are accessible to apps that have the Internet Client or Internet Client/Server capabilities. + +- If you enable this policy setting, apps on proxied networks can access the Internet without relying on the Private Network capability. However, in most situations Windows Network Isolation will be able to correctly discover proxies. By default, any proxies configured with this setting are merged with proxies that are auto-discovered. To make this policy configuration the sole list of allowed proxies, enable the "Proxy definitions are authoritative" setting. + +- If you disable or do not configure this policy setting, apps will use the Internet proxies auto-discovered by Windows Network Isolation. + +Example: [3efe:3022::1000];18.0.0.1;18.0.0.2 + +For more information see: @@ -352,7 +398,7 @@ This is a comma-separated list of proxy servers. Any server on this list is cons |:--|:--| | Name | WF_NetIsolation_Domain_Proxies | | Friendly Name | Internet proxy servers for apps | -| Element Name | Domain Proxies | +| Element Name | Domain Proxies. | | Location | Computer Configuration | | Path | Network > Network Isolation | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation | @@ -452,8 +498,12 @@ For more information see: - -List of domain names that can used for work or personal resource. + +This setting does not apply to desktop apps. + +A comma-separated list of domain names that can be used as both work or personal resource. + +For more information see: @@ -477,7 +527,7 @@ List of domain names that can used for work or personal resource. |:--|:--| | Name | WF_NetIsolation_NeutralResources | | Friendly Name | Domains categorized as both work and personal | -| Element Name | Neutral resources | +| Element Name | Neutral resources. | | Location | Computer Configuration | | Path | Network > Network Isolation | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation | diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md index 4669b6c300..783e4f6580 100644 --- a/windows/client-management/mdm/policy-csp-networklistmanager.md +++ b/windows/client-management/mdm/policy-csp-networklistmanager.md @@ -4,7 +4,7 @@ description: Learn more about the NetworkListManager Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -26,7 +26,7 @@ ms.topic: reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042] and later | @@ -37,7 +37,7 @@ ms.topic: reference -List of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated. +List of URLs (seperated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated. @@ -79,7 +79,7 @@ Invoke-WebRequest -Uri https://nls.corp.contoso.com -Method get -UseBasicParsing | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042] and later | @@ -90,7 +90,7 @@ Invoke-WebRequest -Uri https://nls.corp.contoso.com -Method get -UseBasicParsing -The string will be used to name the network authenticated against one of the endpoints listed in AllowedTlsAuthenticationEndpoints policy +The string will be used to name the network authenticated against one of the endpoints listed in AllowedTlsAuthenticationEndpoints policy. diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index 1e4d224152..5f2769f2f1 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -4,7 +4,7 @@ description: Learn more about the Notifications Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -242,6 +242,67 @@ No reboots or service restarts are required for this policy setting to take effe + +## EnableExpandedToastNotifications + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1620] and later | + + + +```User +./User/Vendor/MSFT/Policy/Config/Notifications/EnableExpandedToastNotifications +``` + + + + +This policy setting turns on multiple expanded toast notifications in action center. + +- If you enable this policy setting, the first three notifications of each application will be expanded by default in action center. +- If you disable or do not configure this policy setting, only the first notification of each application will be expanded by default in action center. Windows 10 only. This will be immediately deprecated for Windows 11. No reboots or service restarts are required for this policy setting to take effect. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disable multiple expanded toasts in action center. | +| 1 | Enable multiple expanded toasts in action center. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ExpandedToastNotifications | +| Path | WPN > AT > StartMenu > NotificationsCategory | + + + + + + + + ## WnsEndpoint @@ -258,8 +319,8 @@ No reboots or service restarts are required for this policy setting to take effe - -FQDN for the WNS endpoint + +This policy sets a special WNS FQDN for specific environments. @@ -289,7 +350,7 @@ If you disable or don't configure this setting, the push notifications will conn |:--|:--| | Name | WnsEndpoint_Policy | | Friendly Name | Enables group policy for the WNS FQDN | -| Element Name | FQDN for WNS | +| Element Name | FQDN for WNS. | | Location | Computer Configuration | | Path | Start Menu and Taskbar > Notifications | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications | diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 1af9f3391f..a8a8f001c3 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -4,7 +4,7 @@ description: Learn more about the Power Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -332,9 +332,11 @@ If the user has configured a slide show to run on the lock screen when the machi - + This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + - If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. + - If you disable or do not configure this policy setting, users control this setting. @@ -389,9 +391,11 @@ This policy setting allows you to specify battery charge level at which Energy S - + This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + - If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. + - If you disable or do not configure this policy setting, users control this setting. @@ -688,8 +692,17 @@ This policy setting specifies whether or not the user is prompted for a password - -This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action. + +This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +Possible actions include: +-Take no action +-Sleep +-Hibernate +-Shut down + +- If you enable this policy setting, you must select the desired action. + - If you disable this policy setting or do not configure it, users can see and change this setting. @@ -725,7 +738,7 @@ This policy setting specifies the action that Windows takes when a user closes t |:--|:--| | Name | DCSystemLidAction_2 | | Friendly Name | Select the lid switch action (on battery) | -| Element Name | Lid Switch Action | +| Element Name | Lid Switch Action. | | Location | Computer Configuration | | Path | System > Power Management > Button Settings | | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\5CA83367-6E45-459F-A27B-476B1D01C936 | @@ -754,8 +767,17 @@ This policy setting specifies the action that Windows takes when a user closes t - -This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action. + +This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +Possible actions include: +-Take no action +-Sleep +-Hibernate +-Shut down + +- If you enable this policy setting, you must select the desired action. + - If you disable this policy setting or do not configure it, users can see and change this setting. @@ -791,7 +813,7 @@ This policy setting specifies the action that Windows takes when a user closes t |:--|:--| | Name | ACSystemLidAction_2 | | Friendly Name | Select the lid switch action (plugged in) | -| Element Name | Lid Switch Action | +| Element Name | Lid Switch Action. | | Location | Computer Configuration | | Path | System > Power Management > Button Settings | | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\5CA83367-6E45-459F-A27B-476B1D01C936 | @@ -820,8 +842,17 @@ This policy setting specifies the action that Windows takes when a user closes t - -This policy setting specifies the action that Windows takes when a user presses the power button. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action. + +This policy setting specifies the action that Windows takes when a user presses the power button. + +Possible actions include: +-Take no action +-Sleep +-Hibernate +-Shut down + +- If you enable this policy setting, you must select the desired action. + - If you disable this policy setting or do not configure it, users can see and change this setting. @@ -857,7 +888,7 @@ This policy setting specifies the action that Windows takes when a user presses |:--|:--| | Name | DCPowerButtonAction_2 | | Friendly Name | Select the Power button action (on battery) | -| Element Name | Power Button Action | +| Element Name | Power Button Action. | | Location | Computer Configuration | | Path | System > Power Management > Button Settings | | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\7648EFA3-DD9C-4E3E-B566-50F929386280 | @@ -886,8 +917,17 @@ This policy setting specifies the action that Windows takes when a user presses - -This policy setting specifies the action that Windows takes when a user presses the power button. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action. + +This policy setting specifies the action that Windows takes when a user presses the power button. + +Possible actions include: +-Take no action +-Sleep +-Hibernate +-Shut down + +- If you enable this policy setting, you must select the desired action. + - If you disable this policy setting or do not configure it, users can see and change this setting. @@ -923,7 +963,7 @@ This policy setting specifies the action that Windows takes when a user presses |:--|:--| | Name | ACPowerButtonAction_2 | | Friendly Name | Select the Power button action (plugged in) | -| Element Name | Power Button Action | +| Element Name | Power Button Action. | | Location | Computer Configuration | | Path | System > Power Management > Button Settings | | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\7648EFA3-DD9C-4E3E-B566-50F929386280 | @@ -952,8 +992,17 @@ This policy setting specifies the action that Windows takes when a user presses - -This policy setting specifies the action that Windows takes when a user presses the sleep button. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action. + +This policy setting specifies the action that Windows takes when a user presses the sleep button. + +Possible actions include: +-Take no action +-Sleep +-Hibernate +-Shut down + +- If you enable this policy setting, you must select the desired action. + - If you disable this policy setting or do not configure it, users can see and change this setting. @@ -989,7 +1038,7 @@ This policy setting specifies the action that Windows takes when a user presses |:--|:--| | Name | DCSleepButtonAction_2 | | Friendly Name | Select the Sleep button action (on battery) | -| Element Name | Sleep Button Action | +| Element Name | Sleep Button Action. | | Location | Computer Configuration | | Path | System > Power Management > Button Settings | | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\96996BC0-AD50-47EC-923B-6F41874DD9EB | @@ -1018,8 +1067,17 @@ This policy setting specifies the action that Windows takes when a user presses - -This policy setting specifies the action that Windows takes when a user presses the sleep button. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action. + +This policy setting specifies the action that Windows takes when a user presses the sleep button. + +Possible actions include: +-Take no action +-Sleep +-Hibernate +-Shut down + +- If you enable this policy setting, you must select the desired action. + - If you disable this policy setting or do not configure it, users can see and change this setting. @@ -1055,7 +1113,7 @@ This policy setting specifies the action that Windows takes when a user presses |:--|:--| | Name | ACSleepButtonAction_2 | | Friendly Name | Select the Sleep button action (plugged in) | -| Element Name | Sleep Button Action | +| Element Name | Sleep Button Action. | | Location | Computer Configuration | | Path | System > Power Management > Button Settings | | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\96996BC0-AD50-47EC-923B-6F41874DD9EB | @@ -1340,10 +1398,14 @@ This policy setting allows you to turn off hybrid sleep. - + This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + - If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. -- If you disable or do not configure this policy setting, users control this setting. If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + +- If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. @@ -1397,10 +1459,14 @@ This policy setting allows you to specify the period of inactivity before Window - + This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + - If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. -- If you disable or do not configure this policy setting, users control this setting. If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + +- If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index d6abd1659d..61ca4d4ecc 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -4,7 +4,7 @@ description: Learn more about the Printers Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -166,7 +166,7 @@ Manages how Queue-specific files are processed during printer installation. At p You can enable this setting to change the default behavior involving queue-specific files. To use this setting, select one of the options below from the "Manage processing of Queue-specific files" box. -- If you disable or do not configure this policy setting, the default behavior is "Limit Queue-specific files to Color profiles". +If you disable or do not configure this policy setting, the default behavior is "Limit Queue-specific files to Color profiles". - "Do not allow Queue-specific files" specifies that no queue-specific files will be allowed/processed during print queue/printer connection installation. @@ -238,7 +238,7 @@ As part of this validation the catalog/embedded signature is verified and all fi You can enable this setting to change the default signature validation method. To use this setting, select one of the options below from the "Select the driver signature mechanism for this computer" box. -- If you disable or do not configure this policy setting, the default method is "Allow all validly signed drivers". +If you disable or do not configure this policy setting, the default method is "Allow all validly signed drivers". - "Require inbox signed drivers" specifies only drivers that are shipped as part of a Windows image are allowed on this computer. @@ -508,15 +508,15 @@ This policy setting controls which protocol and protocol settings to use for out By default, RPC over TCP is used and authentication is always enabled. For RPC over named pipes, authentication is always enabled for domain joined machines but disabled for non domain joined machines. Protocol to use for outgoing RPC connections: -- "RPC over TCP": Use RPC over TCP for outgoing RPC connections to a remote print spooler -- "RPC over named pipes": Use RPC over named pipes for outgoing RPC connections to a remote print spooler + - "RPC over TCP": Use RPC over TCP for outgoing RPC connections to a remote print spooler + - "RPC over named pipes": Use RPC over named pipes for outgoing RPC connections to a remote print spooler Use authentication for outgoing RPC over named pipes connections: -- "Default": By default domain joined computers enable RPC authentication for RPC over named pipes while non domain joined computers disable RPC authentication for RPC over named pipes -- "Authentication enabled": RPC authentication will be used for outgoing RPC over named pipes connections -- "Authentication disabled": RPC authentication will not be used for outgoing RPC over named pipes connections + - "Default": By default domain joined computers enable RPC authentication for RPC over named pipes while non domain joined computers disable RPC authentication for RPC over named pipes + - "Authentication enabled": RPC authentication will be used for outgoing RPC over named pipes connections + - "Authentication disabled": RPC authentication will not be used for outgoing RPC over named pipes connections -- If you disable or do not configure this policy setting, the above defaults will be used. +If you disable or do not configure this policy setting, the above defaults will be used. @@ -576,15 +576,15 @@ This policy setting controls which protocols incoming RPC connections to the pri By default, RPC over TCP is enabled and Negotiate is used for the authentication protocol. Protocols to allow for incoming RPC connections: -- "RPC over named pipes": Incoming RPC connections are only allowed over named pipes -- "RPC over TCP": Incoming RPC connections are only allowed over TCP (the default option) -- "RPC over named pipes and TCP": Incoming RPC connections will be allowed over TCP and named pipes + - "RPC over named pipes": Incoming RPC connections are only allowed over named pipes + - "RPC over TCP": Incoming RPC connections are only allowed over TCP (the default option) + - "RPC over named pipes and TCP": Incoming RPC connections will be allowed over TCP and named pipes Authentication protocol to use for incoming RPC connections: -- "Negotiate": Use the Negotiate authentication protocol (the default option) -- "Kerberos": Use the Kerberos authentication protocol + - "Negotiate": Use the Negotiate authentication protocol (the default option) + - "Kerberos": Use the Kerberos authentication protocol -- If you disable or do not configure this policy setting, the above defaults will be used. +If you disable or do not configure this policy setting, the above defaults will be used. @@ -644,9 +644,9 @@ This policy setting controls which port is used for RPC over TCP for incoming co By default dynamic TCP ports are used. RPC over TCP port: -- The port to use for RPC over TCP. A value of 0 is the default and indicates that dynamic TCP ports will be used + - The port to use for RPC over TCP. A value of 0 is the default and indicates that dynamic TCP ports will be used -- If you disable or do not configure this policy setting, dynamic TCP ports are used. +If you disable or do not configure this policy setting, dynamic TCP ports are used. @@ -831,7 +831,7 @@ This checks outranks the signature check and allows drivers that have a valid si Entries in the exclusion list consist of a SHA256 hash (or SHA1 hash for Win7) of the INF file and/or main driver DLL file of the driver and the name of the file. -- If you disable or do not configure this policy setting, the registry key and values associated with this policy setting will be deleted, if currently set to a value. +If you disable or do not configure this policy setting, the registry key and values associated with this policy setting will be deleted, if currently set to a value. diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index 24f10738e5..f4fa8a6e6a 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -4,7 +4,7 @@ description: Learn more about the Privacy Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -90,6 +90,7 @@ Allows or disallows the automatic acceptance of the pairing and privacy user con This policy setting determines whether Clipboard contents can be synchronized across devices. + - If you enable this policy setting, Clipboard contents are allowed to be synchronized across devices logged in under the same Microsoft account or Azure AD account. - If you disable this policy setting, Clipboard contents cannot be shared to other devices. Policy change takes effect immediately. @@ -372,6 +373,7 @@ In some managed environments, the privacy settings may be set by other policies. This policy setting determines whether ActivityFeed is enabled. + - If you enable this policy setting, all activity types (as applicable) are allowed to be published and ActivityFeed shall roam these activities across device graph of the user. - If you disable this policy setting, activities can't be published and ActivityFeed shall disable cloud sync. Policy change takes effect immediately. @@ -436,8 +438,20 @@ Policy change takes effect immediately. - + This policy setting specifies whether Windows apps can access account information. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access account information and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access account information and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -473,7 +487,7 @@ The most restrictive value is `2` to deny apps access to account information. |:--|:--| | Name | LetAppsAccessAccountInfo | | Friendly Name | Let Windows apps access account information | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -502,8 +516,20 @@ The most restrictive value is `2` to deny apps access to account information. - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access account information. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access account information and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access account information and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -555,8 +581,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access account information. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access account information and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access account information and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -608,8 +646,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the account information privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access account information. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access account information and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access account information and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -841,8 +891,20 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. The use - + This policy setting specifies whether Windows apps can access the calendar. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the calendar and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the calendar and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -878,7 +940,7 @@ The most restrictive value is `2` to deny apps access to the calendar. |:--|:--| | Name | LetAppsAccessCalendar | | Friendly Name | Let Windows apps access the calendar | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -907,8 +969,20 @@ The most restrictive value is `2` to deny apps access to the calendar. - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access the calendar. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the calendar and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the calendar and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -960,8 +1034,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access the calendar. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the calendar and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the calendar and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1013,8 +1099,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the calendar privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access the calendar. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the calendar and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the calendar and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1066,8 +1164,20 @@ List of semi-colon delimited Package Family Names of Windows apps. The user is a - + This policy setting specifies whether Windows apps can access call history. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access call history by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the call history and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the call history and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the call history by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1103,7 +1213,7 @@ The most restrictive value is `2` to deny apps access to call history. |:--|:--| | Name | LetAppsAccessCallHistory | | Friendly Name | Let Windows apps access call history | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -1132,8 +1242,20 @@ The most restrictive value is `2` to deny apps access to call history. - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access call history. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access call history by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the call history and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the call history and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the call history by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1185,8 +1307,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access call history. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access call history by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the call history and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the call history and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the call history by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1238,8 +1372,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the call history privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access call history. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access call history by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the call history and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the call history and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the call history by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1291,8 +1437,20 @@ List of semi-colon delimited Package Family Names of Windows apps. The user is a - + This policy setting specifies whether Windows apps can access the camera. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the camera and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the camera and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1328,7 +1486,7 @@ The most restrictive value is `2` to deny apps access to the camera. |:--|:--| | Name | LetAppsAccessCamera | | Friendly Name | Let Windows apps access the camera | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -1357,8 +1515,20 @@ The most restrictive value is `2` to deny apps access to the camera. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access the camera. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the camera and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the camera and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1410,8 +1580,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access the camera. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the camera and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the camera and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1463,8 +1645,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access the camera. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the camera and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the camera and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1516,8 +1710,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access contacts. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access contacts and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access contacts and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1553,7 +1759,7 @@ The most restrictive value is `2` to deny apps access to contacts. |:--|:--| | Name | LetAppsAccessContacts | | Friendly Name | Let Windows apps access contacts | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -1582,8 +1788,20 @@ The most restrictive value is `2` to deny apps access to contacts. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access contacts. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access contacts and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access contacts and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1635,8 +1853,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access contacts. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access contacts and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access contacts and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1688,8 +1918,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access contacts. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access contacts and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access contacts and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1741,8 +1983,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access email. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access email and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access email and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1778,7 +2032,7 @@ The most restrictive value is `2` to deny apps access to email. |:--|:--| | Name | LetAppsAccessEmail | | Friendly Name | Let Windows apps access email | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -1807,8 +2061,20 @@ The most restrictive value is `2` to deny apps access to email. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access email. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access email and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access email and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1860,8 +2126,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access email. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access email and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access email and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1913,8 +2191,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access email. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access email and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access email and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2127,8 +2417,20 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. The use - -This policy setting specifies whether Windows apps can use screen capture on arbitrary windows or displays. + +This policy setting specifies whether Windows apps can take screenshots of various windows or displays. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2181,8 +2483,20 @@ This policy setting specifies whether Windows apps can use screen capture on arb - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to use screen capture on arbitrary windows or displays. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps. + +This policy setting specifies whether Windows apps can take screenshots of various windows or displays. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2234,8 +2548,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied the use of screen capture on arbitrary windows or displays. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps. + +This policy setting specifies whether Windows apps can take screenshots of various windows or displays. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2287,8 +2613,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the programmatic screen capture setting for the listed apps. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps. + +This policy setting specifies whether Windows apps can take screenshots of various windows or displays. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2340,8 +2678,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - -This policy setting specifies whether Windows apps can disable the screen capture border. + +This policy setting specifies whether Windows apps can turn off the screenshot border. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2366,7 +2716,7 @@ This policy setting specifies whether Windows apps can disable the screen captur |:--|:--| | Name | LetAppsAccessGraphicsCaptureWithoutBorder | | Friendly Name | Let Windows apps turn off the screenshot border | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -2395,8 +2745,20 @@ This policy setting specifies whether Windows apps can disable the screen captur - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to disable the screen capture border. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps. + +This policy setting specifies whether Windows apps can turn off the screenshot border. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2448,8 +2810,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied configuration access to the screen capture border. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps. + +This policy setting specifies whether Windows apps can turn off the screenshot border. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2501,8 +2875,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the screen capture border privacy setting for the listed apps. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps. + +This policy setting specifies whether Windows apps can turn off the screenshot border. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2538,6 +2924,216 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u + +## LetAppsAccessHumanPresence + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessHumanPresence +``` + + + + +This policy setting specifies whether Windows apps can access the human presence sensor. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | User in control. | +| 1 | Force allow. | +| 2 | Force deny. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | LetAppsAccessHumanPresence | +| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | +| Element Name | LetAppsAccessHumanPresence_Enum | + + + + + + + + + +## LetAppsAccessHumanPresence_ForceAllowTheseApps + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessHumanPresence_ForceAllowTheseApps +``` + + + + +List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the human presence sensor. This setting overrides the default LetAppsAccessHumanPresence policy setting for the specified apps. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `;`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | LetAppsAccessHumanPresence | +| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | +| Element Name | LetAppsAccessHumanPresence_ForceAllowTheseApps_List | + + + + + + + + + +## LetAppsAccessHumanPresence_ForceDenyTheseApps + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessHumanPresence_ForceDenyTheseApps +``` + + + + +List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the human presence sensor. This setting overrides the default LetAppsAccessHumanPresence policy setting for the specified apps. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `;`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | LetAppsAccessHumanPresence | +| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | +| Element Name | LetAppsAccessHumanPresence_ForceDenyTheseApps_List | + + + + + + + + + +## LetAppsAccessHumanPresence_UserInControlOfTheseApps + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessHumanPresence_UserInControlOfTheseApps +``` + + + + +List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the human presence privacy setting for the listed apps. This setting overrides the default LetAppsAccessHumanPresence policy setting for the specified apps. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `;`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | LetAppsAccessHumanPresence | +| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | +| Element Name | LetAppsAccessHumanPresence_UserInControlOfTheseApps_List | + + + + + + + + ## LetAppsAccessLocation @@ -2554,8 +3150,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access location. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access location and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access location and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2591,7 +3199,7 @@ The most restrictive value is `2` to deny apps access to the device's location. |:--|:--| | Name | LetAppsAccessLocation | | Friendly Name | Let Windows apps access location | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -2620,8 +3228,20 @@ The most restrictive value is `2` to deny apps access to the device's location. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access location. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access location and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access location and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2673,8 +3293,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access location. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access location and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access location and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2726,8 +3358,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access location. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access location and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access location and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2779,8 +3423,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can read or send messages (text or MMS). + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps can read or send messages and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps cannot read or send messages and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2816,7 +3472,7 @@ The most restrictive value is `2` to deny apps access to messaging. |:--|:--| | Name | LetAppsAccessMessaging | | Friendly Name | Let Windows apps access messaging | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -2845,8 +3501,20 @@ The most restrictive value is `2` to deny apps access to messaging. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + +This policy setting specifies whether Windows apps can read or send messages (text or MMS). + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps can read or send messages and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps cannot read or send messages and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2898,8 +3566,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + +This policy setting specifies whether Windows apps can read or send messages (text or MMS). + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps can read or send messages and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps cannot read or send messages and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2951,8 +3631,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + +This policy setting specifies whether Windows apps can read or send messages (text or MMS). + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps can read or send messages and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps cannot read or send messages and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3004,8 +3696,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access the microphone. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the microphone and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the microphone and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3041,7 +3745,7 @@ The most restrictive value is `2` to deny apps access to the microphone. |:--|:--| | Name | LetAppsAccessMicrophone | | Friendly Name | Let Windows apps access the microphone | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -3070,8 +3774,20 @@ The most restrictive value is `2` to deny apps access to the microphone. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access the microphone. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the microphone and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the microphone and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3123,8 +3839,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access the microphone. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the microphone and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the microphone and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3176,8 +3904,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access the microphone. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the microphone and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the microphone and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3229,8 +3969,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access motion data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access motion data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access motion data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3266,7 +4018,7 @@ The most restrictive value is `2` to deny apps access to motion data. |:--|:--| | Name | LetAppsAccessMotion | | Friendly Name | Let Windows apps access motion | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -3295,8 +4047,20 @@ The most restrictive value is `2` to deny apps access to motion data. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access motion data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access motion data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access motion data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3348,8 +4112,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access motion data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access motion data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access motion data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3401,8 +4177,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access motion data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access motion data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access motion data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3454,8 +4242,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access notifications. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access notifications and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access notifications and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3491,7 +4291,7 @@ The most restrictive value is `2` to deny apps access to notifications. |:--|:--| | Name | LetAppsAccessNotifications | | Friendly Name | Let Windows apps access notifications | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -3520,8 +4320,20 @@ The most restrictive value is `2` to deny apps access to notifications. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access notifications. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access notifications and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access notifications and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3573,8 +4385,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access notifications. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access notifications and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access notifications and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3626,8 +4450,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access notifications. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access notifications and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access notifications and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3679,8 +4515,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - -This policy setting specifies whether Windows apps can make phone calls + +This policy setting specifies whether Windows apps can make phone calls. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to make phone calls and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to make phone calls and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3716,7 +4564,7 @@ The most restrictive value is `2` to deny apps access to make phone calls. |:--|:--| | Name | LetAppsAccessPhone | | Friendly Name | Let Windows apps make phone calls | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -3745,8 +4593,20 @@ The most restrictive value is `2` to deny apps access to make phone calls. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + +This policy setting specifies whether Windows apps can make phone calls. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to make phone calls and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to make phone calls and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3798,8 +4658,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + +This policy setting specifies whether Windows apps can make phone calls. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to make phone calls and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to make phone calls and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3851,8 +4723,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + +This policy setting specifies whether Windows apps can make phone calls. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to make phone calls and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to make phone calls and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3904,8 +4788,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps have access to control radios. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps will have access to control radios and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps will not have access to control radios and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3941,7 +4837,7 @@ The most restrictive value is `2` to deny apps access to control radios. |:--|:--| | Name | LetAppsAccessRadios | | Friendly Name | Let Windows apps control radios | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -3970,8 +4866,20 @@ The most restrictive value is `2` to deny apps access to control radios. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + +This policy setting specifies whether Windows apps have access to control radios. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps will have access to control radios and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps will not have access to control radios and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4023,8 +4931,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + +This policy setting specifies whether Windows apps have access to control radios. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps will have access to control radios and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps will not have access to control radios and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4076,8 +4996,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + +This policy setting specifies whether Windows apps have access to control radios. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps will have access to control radios and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps will not have access to control radios and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4129,8 +5061,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access tasks. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access tasks and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access tasks and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4155,7 +5099,7 @@ This policy setting specifies whether Windows apps can access tasks. |:--|:--| | Name | LetAppsAccessTasks | | Friendly Name | Let Windows apps access Tasks | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -4184,8 +5128,20 @@ This policy setting specifies whether Windows apps can access tasks. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access tasks. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access tasks and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access tasks and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4237,8 +5193,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access tasks. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access tasks and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access tasks and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4290,8 +5258,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access tasks. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access tasks and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access tasks and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4343,8 +5323,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access trusted devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access trusted devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access trusted devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4380,7 +5372,7 @@ The most restrictive value is `2` to deny apps access trusted devices. |:--|:--| | Name | LetAppsAccessTrustedDevices | | Friendly Name | Let Windows apps access trusted devices | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -4409,8 +5401,20 @@ The most restrictive value is `2` to deny apps access trusted devices. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access trusted devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access trusted devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access trusted devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4462,8 +5466,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access trusted devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access trusted devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access trusted devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4515,8 +5531,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access trusted devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access trusted devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access trusted devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4568,8 +5596,18 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can be activated by voice. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can be activated with a voice keyword by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to be activated with a voice keyword and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to be activated with a voice keyword and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can be activated with a voice keyword by using Settings > Privacy on the device. + +This policy is applied to Windows apps and Cortana. @@ -4603,7 +5641,7 @@ This policy setting specifies whether Windows apps can be activated by voice. |:--|:--| | Name | LetAppsActivateWithVoice | | Friendly Name | Let Windows apps activate with voice | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -4632,8 +5670,18 @@ This policy setting specifies whether Windows apps can be activated by voice. - + This policy setting specifies whether Windows apps can be activated by voice while the system is locked. + +If you choose the "User is in control" option, employees in your organization can decide whether users can interact with applications using speech while the system is locked by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, users can interact with applications using speech while the system is locked and employees in your organization cannot change it. + +If you choose the "Force Deny" option, users cannot interact with applications using speech while the system is locked and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether users can interact with applications using speech while the system is locked by using Settings > Privacy on the device. + +This policy is applied to Windows apps and Cortana. It takes precedence of the "Allow Cortana above lock" policy. This policy is applicable only when "Allow voice activation" policy is configured to allow applications to be activated with voice. @@ -4667,7 +5715,7 @@ This policy setting specifies whether Windows apps can be activated by voice whi |:--|:--| | Name | LetAppsActivateWithVoiceAboveLock | | Friendly Name | Let Windows apps activate with voice while the system is locked | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -4696,8 +5744,20 @@ This policy setting specifies whether Windows apps can be activated by voice whi - -This policy setting specifies whether Windows apps can get diagnostic information about other apps, including user names. + +This policy setting specifies whether Windows apps can get diagnostic information about other Windows apps, including user name. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can get diagnostic information about other apps using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can get diagnostic information about other apps by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4733,7 +5793,7 @@ The most restrictive value is `2` to deny apps access to diagnostic data. |:--|:--| | Name | LetAppsGetDiagnosticInfo | | Friendly Name | Let Windows apps access diagnostic information about other apps | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -4762,8 +5822,20 @@ The most restrictive value is `2` to deny apps access to diagnostic data. - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed to get diagnostic information about other apps, including user names. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can get diagnostic information about other Windows apps, including user name. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can get diagnostic information about other apps using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can get diagnostic information about other apps by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4815,8 +5887,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are not allowed to get diagnostic information about other apps, including user names. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can get diagnostic information about other Windows apps, including user name. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can get diagnostic information about other apps using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can get diagnostic information about other apps by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4868,8 +5952,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the app diagnostics privacy setting for the listed Windows apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can get diagnostic information about other Windows apps, including user name. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can get diagnostic information about other apps using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can get diagnostic information about other apps by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4921,8 +6017,20 @@ List of semi-colon delimited Package Family Names of Windows apps. The user is a - + This policy setting specifies whether Windows apps can run in the background. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to run in the background and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to run in the background and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4960,7 +6068,7 @@ The most restrictive value is `2` to deny apps from running in the background. |:--|:--| | Name | LetAppsRunInBackground | | Friendly Name | Let Windows apps run in the background | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -4989,8 +6097,20 @@ The most restrictive value is `2` to deny apps from running in the background. - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can run in the background. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to run in the background and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to run in the background and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -5042,8 +6162,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are not allowed to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can run in the background. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to run in the background and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to run in the background and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -5095,8 +6227,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the background apps privacy setting for the listed Windows apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can run in the background. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to run in the background and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to run in the background and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -5148,8 +6292,20 @@ List of semi-colon delimited Package Family Names of Windows apps. The user is a - + This policy setting specifies whether Windows apps can communicate with unpaired wireless devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -5185,7 +6341,7 @@ The most restrictive value is `2` to deny apps syncing with devices. |:--|:--| | Name | LetAppsSyncWithDevices | | Friendly Name | Let Windows apps communicate with unpaired devices | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -5214,8 +6370,20 @@ The most restrictive value is `2` to deny apps syncing with devices. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + +This policy setting specifies whether Windows apps can communicate with unpaired wireless devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -5267,8 +6435,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + +This policy setting specifies whether Windows apps can communicate with unpaired wireless devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -5320,8 +6500,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + +This policy setting specifies whether Windows apps can communicate with unpaired wireless devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -5375,6 +6567,7 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u This policy setting determines whether User Activities can be published. + - If you enable this policy setting, activities of type User Activity are allowed to be published. - If you disable this policy setting, activities of type User Activity are not allowed to be published. Policy change takes effect immediately. @@ -5443,6 +6636,7 @@ For more information, see [Windows activity history and your privacy](https://su This policy setting determines whether published User Activities can be uploaded. + - If you enable this policy setting, activities of type User Activity are allowed to be uploaded. - If you disable this policy setting, activities of type User Activity are not allowed to be uploaded. Deletion of activities of type User Activity are independent of this setting. diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md index 4cfd15a4b7..247dadacdb 100644 --- a/windows/client-management/mdm/policy-csp-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-remoteassistance.md @@ -4,7 +4,7 @@ description: Learn more about the RemoteAssistance Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -277,7 +277,7 @@ For computers running Windows Server 2003 with Service Pack 1 (SP1) Port 135:TCP %WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe %WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe -Allow Remote Desktop Exception +Allow Remote Desktop Exception. diff --git a/windows/client-management/mdm/policy-csp-remotedesktop.md b/windows/client-management/mdm/policy-csp-remotedesktop.md index a82841ffd5..6144dbef4f 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktop.md +++ b/windows/client-management/mdm/policy-csp-remotedesktop.md @@ -4,7 +4,7 @@ description: Learn more about the RemoteDesktop Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,7 +37,7 @@ ms.topic: reference -Controls the list of URLs that the user should be auto-subscribed to +Controls the list of URLs that the user should be auto-subscribed to. diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md index 1545ea14b2..1025e2c4b0 100644 --- a/windows/client-management/mdm/policy-csp-remotemanagement.md +++ b/windows/client-management/mdm/policy-csp-remotemanagement.md @@ -4,7 +4,7 @@ description: Learn more about the RemoteManagement Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -299,7 +299,7 @@ For example, if you want the service to listen only on IPv4 addresses, leave the Ranges are specified using the syntax IP1-IP2. Multiple ranges are separated using "," (comma) as the delimiter. Example IPv4 filters:\n2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22 -Example IPv6 filters:\n3FFE:FFFF:7654:FEDA:1245:BA98:0000:0000-3. FFE:FFFF:7654:FEDA:1245:BA98:3210:4562 +Example IPv6 filters:\n3FFE:FFFF:7654:FEDA:1245:BA98:0000:0000-3. FFE:FFFF:7654:FEDA:1245:BA98:3210:4562. diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md index 35fe66ae1a..f0153f08b7 100644 --- a/windows/client-management/mdm/policy-csp-remoteshell.md +++ b/windows/client-management/mdm/policy-csp-remoteshell.md @@ -4,7 +4,7 @@ description: Learn more about the RemoteShell Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference This policy setting configures access to remote shells. -- If you enable or do not configure this policy setting, new remote shell connections are accepted by the server. +If you enable or do not configure this policy setting, new remote shell connections are accepted by the server. If you set this policy to 'disabled', new remote shell connections are rejected by the server. @@ -169,7 +169,7 @@ Any value from 0 to 0x7FFFFFFF can be set. A minimum of 60000 milliseconds (1 mi - If you enable this policy setting, the server will wait for the specified amount of time since the last received message from the client before terminating the open shell. -If you do not configure or disable this policy setting, the default value of 900000 or 15 min will be used. +- If you do not configure or disable this policy setting, the default value of 900000 or 15 min will be used. diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 1da17f0f74..f148ceb767 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -4,7 +4,7 @@ description: Learn more about the RestrictedGroups Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -42,7 +42,7 @@ ms.topic: reference -This security setting allows an administrator to define the members of a security-sensitive (restricted) group. When a Restricted Groups Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list who is not currently a member of the restricted group is added. You can use Restricted Groups policy to control group membership. Using the policy, you can specify what members are part of a group. Any members that are not specified in the policy are removed during configuration or refresh. For example, you can create a Restricted Groups policy to only allow specified users (for example, Alice and John) to be members of the Administrators group. When policy is refreshed, only Alice and John will remain as members of the Administrators group +This security setting allows an administrator to define the members of a security-sensitive (restricted) group. When a Restricted Groups Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list who is not currently a member of the restricted group is added. You can use Restricted Groups policy to control group membership. Using the policy, you can specify what members are part of a group. Any members that are not specified in the policy are removed during configuration or refresh. For example, you can create a Restricted Groups policy to only allow specified users (for example, Alice and John) to be members of the Administrators group. When policy is refreshed, only Alice and John will remain as members of the Administrators group. > [!CAUTION] > If a Restricted Groups policy is applied, any current member not on the Restricted Groups policy members list is removed. This can include default members, such as administrators. Restricted Groups should be used primarily to configure membership of local groups on workstation or member servers. An empty Members list means that the restricted group has no members. diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 00120ee4f2..dc4d67697d 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -4,7 +4,7 @@ description: Learn more about the Search Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/01/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -39,8 +39,8 @@ ms.topic: reference - -Allow search and Cortana to search cloud sources like OneDrive and SharePoint. This policy allows corporate administrators to control whether employees can turn off/on the search of these cloud sources. The default policy value is to allow employees access to the setting that controls search of cloud sources. + +Allow search and Cortana to search cloud sources like OneDrive and SharePoint. @@ -73,7 +73,7 @@ Allow search and Cortana to search cloud sources like OneDrive and SharePoint. T |:--|:--| | Name | AllowCloudSearch | | Friendly Name | Allow Cloud Search | -| Element Name | Cloud Search Setting | +| Element Name | Cloud Search Setting. | | Location | Computer Configuration | | Path | Windows Components > Search | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\Windows Search | @@ -103,7 +103,7 @@ Allow search and Cortana to search cloud sources like OneDrive and SharePoint. T -Allow the cortana opt-in page during windows setup out of the box experience +Allow the cortana opt-in page during windows setup out of the box experience. @@ -166,7 +166,7 @@ Allow the cortana opt-in page during windows setup out of the box experience -This feature allows you to disable find my files completely on the machine +This feature allows you to disable find my files completely on the machine. @@ -190,7 +190,7 @@ This policy controls whether the user can configure search to *Find My Files* mo | Value | Description | |:--|:--| -| 1 (Default) | , and the settings UI is present. | +| 1 (Default) | Find My Files feature can be toggled (still off by default), and the settings UI is present. | | 0 | Find My Files feature is turned off completely, and the settings UI is disabled. | @@ -227,6 +227,7 @@ This policy controls whether the user can configure search to *Find My Files* mo This policy setting allows encrypted items to be indexed. + - If you enable this policy setting, indexing will attempt to decrypt and index the content (access restrictions will still apply). - If you disable this policy setting, the search service components (including non-Microsoft components) are expected not to index encrypted items or encrypted stores. This policy setting is not configured by default. - If you do not configure this policy setting, the local setting, configured through Control Panel, will be used. By default, the Control Panel setting is set to not index encrypted content. @@ -481,6 +482,7 @@ This policy has been deprecated. This policy setting allows words that contain diacritic characters to be treated as separate words. + - If you enable this policy setting, words that only differ in diacritics are treated as different words. - If you disable this policy setting, words with diacritics and words without diacritics are treated as identical words. This policy setting is not configured by default. - If you do not configure this policy setting, the local setting, configured through Control Panel, will be used. @@ -593,6 +595,7 @@ Allow Windows indexer. Value type is integer. This policy setting determines when Windows uses automatic language detection results, and when it relies on indexing history. + - If you enable this policy setting, Windows will always use automatic language detection to index (as it did in Windows 7). Using automatic language detection can increase memory usage. We recommend enabling this policy setting only on PCs where documents are stored in many languages. - If you disable or do not configure this policy setting, Windows will use automatic language detection only when it can determine the language of a document with high confidence. @@ -704,7 +707,7 @@ This policy setting allows you to configure search on the taskbar. |:--|:--| | Name | ConfigureSearchOnTaskbarMode | | Friendly Name | Configures search on the taskbar | -| Element Name | Search on the taskbar | +| Element Name | Search on the taskbar. | | Location | Computer Configuration | | Path | Windows Components > Search | | Registry Key Name | Software\Policies\Microsoft\Windows\Windows Search | @@ -853,7 +856,7 @@ This policy setting configures whether or not locations on removable drives can | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | @@ -864,6 +867,7 @@ This policy setting configures whether or not locations on removable drives can + - If you enable this policy, the Search UI will be disabled along with all its entry points, such as keyboard shortcuts, touchpad gestures, and type-to-search in the Start menu. The Start menu's search box and Search Taskbar button will also be hidden. - If you disable or don't configure this policy setting, the user will be able to open the Search UI and its different entry points will be shown. @@ -929,13 +933,13 @@ This policy setting configures whether or not locations on removable drives can -This policy setting allows you to control whether or not Search can perform queries on the web, and if the web results are displayed in Search. +This policy setting allows you to control whether or not Search can perform queries on the web, if web results are displayed in Search, and if search highlights are shown in the search box and in search home. -- If you enable this policy setting, queries won't be performed on the web and web results won't be displayed when a user performs a query in Search. +- If you enable this policy setting, queries won't be performed on the web, web results won't be displayed when a user performs a query in Search, and search highlights will not be shown in the search box and in search home. -- If you disable this policy setting, queries will be performed on the web and web results will be displayed when a user performs a query in Search. +- If you disable this policy setting, queries will be performed on the web, web results will be displayed when a user performs a query in Search, and search highlights will be shown in the search box and in search home. -- If you don't configure this policy setting, a user can choose whether or not Search can perform queries on the web, and if the web results are displayed in Search. +- If you don't configure this policy setting, a user can choose whether or not Search can perform queries on the web, and if the web results are displayed in Search, and if search highlights are shown in the search box and in search home. @@ -1109,10 +1113,13 @@ If enabled, clients will be unable to query this computer's index remotely. Thus ## SafeSearchPermissions +> [!NOTE] +> This policy is deprecated and may be removed in a future release. + | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | @@ -1122,7 +1129,8 @@ If enabled, clients will be unable to query this computer's index remotely. Thus - + +This policy is deprecated. diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index f4b72810bf..da0b3fb337 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -4,7 +4,7 @@ description: Learn more about the Security Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -302,7 +302,7 @@ This policy setting configures the system to prompt the user to clear the TPM if -Configures the use of passwords for Windows features +Configures the use of passwords for Windows features. @@ -578,7 +578,7 @@ Specifies whether provisioning packages must have a certificate signed by a devi -Specifies whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service (HAS) when a device boots or reboots. Setting this policy to 1 (Required)Determines whether a device is capable of Remote Device Health Attestation, by verifying if the device has TPM 2. 0. Improves the performance of the device by enabling the device to fetch and cache data to reduce the latency during Device Health Verification +Specifies whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service (HAS) when a device boots or reboots. Setting this policy to 1 (Required):Determines whether a device is capable of Remote Device Health Attestation, by verifying if the device has TPM 2. 0. Improves the performance of the device by enabling the device to fetch and cache data to reduce the latency during Device Health Verification. > [!NOTE] > We recommend that this policy is set to Required after MDM enrollment. Most restricted value is 1. diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index e26697bc7e..4102db4c23 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -4,7 +4,7 @@ description: Learn more about the Settings Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,7 +37,7 @@ ms.topic: reference -Allows the user to change Auto Play settings +Allows the user to change Auto Play settings. > [!NOTE] > Setting this policy to 0 (Not allowed) does not affect the autoplay dialog box that appears when a device is connected. @@ -287,8 +287,10 @@ Allows the user to change the language settings. - -Enables or disables the retrieval of online tips and help for the Settings app. If disabled, Settings will not contact Microsoft content services to retrieve tips and help content. + +Enables or disables the retrieval of online tips and help for the Settings app. + +If disabled, Settings will not contact Microsoft content services to retrieve tips and help content. @@ -719,8 +721,22 @@ By default, the calendar is set according to the locale of the operating system, - -Allows IT Admins to either prevent specific pages in the System Settings app from being visible or accessible, or to do so for all pages except those specified. The mode will be specified by the policy string beginning with either the string showonly or hide. Pages are identified by a shortened version of their already published URIs, which is the URI minus the ms-settings prefix. For example, if the URI for a settings page is ms-settingsbluetooth, the page identifier used in the policy will be just bluetooth. Multiple page identifiers are separated by semicolons. The following example illustrates a policy that would allow access only to the about and bluetooth pages, which have URI ms-settingsabout and ms-settingsbluetooth respectivelyshowonlyabout;bluetooth. If the policy is not specified, the behavior will be that no pages are affected. If the policy string is formatted incorrectly, it will be ignored entirely (i. e. treated as not set) to prevent the machine from becoming unserviceable if data corruption occurs. **Note** that if a page is already hidden for another reason, then it will remain hidden even if it is in a showonly list. The format of the PageVisibilityList value is as follows The value is a unicode string up to 10,000 characters long, which will be used without case sensitivity. There are two variants one that shows only the given pages and one which hides the given pages. The first variant starts with the string showonly and the second with the string hide. Following the variant identifier is a semicolon-delimited list of page identifiers, which must not have any extra whitespace. Each page identifier is the ms-settingsxyz URI for the page, minus the ms-settings prefix, so the identifier for the page with URI ms-settingsnetwork-wifi would be just network-wifi. The default value for this setting is an empty string, which is interpreted as show everything. Example 1, specifies that only the wifi and bluetooth pages should be shown (they have URIs ms-settingsnetwork-wifi and ms-settingsbluetooth). All other pages (and the categories they're in) will be hiddenshowonlynetwork-wifi;bluetooth. Example 2, specifies that the wifi page should not be shownhidenetwork-wifi + +Specifies the list of pages to show or hide from the System Settings app. + +This policy allows an administrator to block a given set of pages from the System Settings app. Blocked pages will not be visible in the app, and if all pages in a category are blocked the category will be hidden as well. Direct navigation to a blocked page via URI, context menu in Explorer or other means will result in the front page of Settings being shown instead. + +This policy has two modes: it can either specify a list of settings pages to show or a list of pages to hide. To specify a list of pages to show, the policy string must begin with "showonly:" (without quotes), and to specify a list of pages to hide, it must begin with "hide:". If a page in a showonly list would normally be hidden for other reasons (such as a missing hardware device), this policy will not force that page to appear. After this, the policy string must contain a semicolon-delimited list of settings page identifiers. The identifier for any given settings page is the published URI for that page, minus the "ms-settings:" protocol part. + +Example: to specify that only the About and Bluetooth pages should be shown (their respective URIs are ms-settings:about and ms-settings:bluetooth) and all other pages hidden: + +showonly:about;bluetooth + +Example: to specify that only the Bluetooth page (which has URI ms-settings:bluetooth) should be hidden: + +hide:bluetooth + +The availability of per-user support is documented here: @@ -751,7 +767,7 @@ To validate this policy, use the following steps: |:--|:--| | Name | SettingsPageVisibility | | Friendly Name | Settings Page Visibility | -| Element Name | Settings Page Visibility | +| Element Name | Settings Page Visibility. | | Location | Computer and User Configuration | | Path | Control Panel | | Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\Explorer | diff --git a/windows/client-management/mdm/policy-csp-settingssync.md b/windows/client-management/mdm/policy-csp-settingssync.md index e0f18ffd48..c879d37038 100644 --- a/windows/client-management/mdm/policy-csp-settingssync.md +++ b/windows/client-management/mdm/policy-csp-settingssync.md @@ -4,7 +4,7 @@ description: Learn more about the SettingsSync Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -21,6 +21,9 @@ ms.topic: reference > > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + @@ -44,7 +47,7 @@ ms.topic: reference Prevent the "accessibility" group from syncing to and from this PC. This turns off and disables the "accessibility" group on the "Windows backup" settings page in PC settings. -- If you enable this policy setting, the "accessibility", group will not be synced. +If you enable this policy setting, the "accessibility", group will not be synced. Use the option "Allow users to turn accessibility syncing on" so that syncing is turned off by default but not disabled. diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index 907c344a75..8c3978aae7 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -4,7 +4,7 @@ description: Learn more about the SmartScreen Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -193,8 +193,23 @@ Some information is sent to Microsoft about files and programs run on PCs with t - -Allows IT Admins to control whether users can ignore SmartScreen warnings and run malicious files. + +This policy allows you to turn Windows Defender SmartScreen on or off. SmartScreen helps protect PCs by warning users before running potentially malicious programs downloaded from the Internet. This warning is presented as an interstitial dialog shown before running an app that has been downloaded from the Internet and is unrecognized or known to be malicious. No dialog is shown for apps that do not appear to be suspicious. + +Some information is sent to Microsoft about files and programs run on PCs with this feature enabled. + +- If you enable this policy, SmartScreen will be turned on for all users. Its behavior can be controlled by the following options: + +- Warn and prevent bypass +- Warn + +- If you enable this policy with the "Warn and prevent bypass" option, SmartScreen's dialogs will not present the user with the option to disregard the warning and run the app. SmartScreen will continue to show the warning on subsequent attempts to run the app. + +- If you enable this policy with the "Warn" option, SmartScreen's dialogs will warn the user that the app appears suspicious, but will permit the user to disregard the warning and run the app anyway. SmartScreen will not warn the user again for that app if the user tells SmartScreen to run the app. + +- If you disable this policy, SmartScreen will be turned off for all users. Users will not be warned if they try to run suspicious apps from the Internet. + +- If you do not configure this policy, SmartScreen will be enabled by default, but users may change their settings. @@ -227,7 +242,7 @@ Allows IT Admins to control whether users can ignore SmartScreen warnings and ru |:--|:--| | Name | ShellConfigureSmartScreen | | Friendly Name | Configure Windows Defender SmartScreen | -| Element Name | Pick one of the following settings | +| Element Name | Pick one of the following settings. | | Location | Computer Configuration | | Path | Windows Components > Windows Defender SmartScreen > Explorer | | Registry Key Name | Software\Policies\Microsoft\Windows\System | diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index f0db80b75a..19a927a634 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -4,7 +4,7 @@ description: Learn more about the Start Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -601,7 +601,7 @@ This string policy takes a JSON file named `LayoutModification.json`. The file e This policy allows you to prevent users from being able to open context menus in the Start Menu. -- If you enable this policy, then invocations of context menus within the Start Menu will be ignored. +If you enable this policy, then invocations of context menus within the Start Menu will be ignored. @@ -668,7 +668,7 @@ This policy setting removes Quick Settings from the bottom right area on the tas The quick settings area is located at the left of the clock in the taskbar and includes icons for current network and volume. -- If this setting is enabled, Quick Settings is not displayed in the quick settings area. +If this setting is enabled, Quick Settings is not displayed in the quick settings area. A reboot is required for this policy setting to take effect. @@ -732,6 +732,7 @@ A reboot is required for this policy setting to take effect. + - If you enable this policy, the user will be unable to modify Quick Settings. - If you disable or don't configure this policy setting, the user will be able to edit Quick Settings, such as pinning or unpinning buttons. @@ -801,6 +802,7 @@ A reboot is required for this policy setting to take effect. + - If you enable this policy and set it to Start menu or full screen Start, Start will be that size and users will be unable to change the size of Start in Settings. - If you disable or don't configure this policy setting, Windows will automatically select the size based on hardware form factor and users will be able to change the size of Start in Settings. @@ -993,6 +995,7 @@ Enabling this policy hides "Change account settings" from appearing in the user + - If you enable this setting, the frequently used programs list is removed from the Start menu. - If you disable this setting or do not configure it, the frequently used programs list remains on the simple Start menu. @@ -1174,7 +1177,7 @@ Enabling this policy hides "Lock" from appearing in the user tile in the start m This policy allows you to remove the People Bar from the taskbar and disables the My People experience. -- If you enable this policy the people icon will be removed from the taskbar, the corresponding settings toggle is removed from the taskbar settings page, and users will not be able to pin people to the taskbar. +If you enable this policy the people icon will be removed from the taskbar, the corresponding settings toggle is removed from the taskbar settings page, and users will not be able to pin people to the taskbar. @@ -1363,7 +1366,7 @@ To validate this policy, do the following steps: This policy allows you to prevent the Start Menu from displaying a list of recently installed applications. -- If you enable this policy, the Start Menu will no longer display the "Recently added" list. The corresponding setting will also be disabled in Settings. +If you enable this policy, the Start Menu will no longer display the "Recently added" list. The corresponding setting will also be disabled in Settings. @@ -1444,7 +1447,7 @@ To validate this policy, do the following steps: This policy allows you to prevent the Start Menu from displaying a list of recommended applications and files. -- If you enable this policy setting, the Start Menu will no longer show the section containing a list of recommended files and apps. +If you enable this policy setting, the Start Menu will no longer show the section containing a list of recommended files and apps. @@ -1490,6 +1493,68 @@ This policy allows you to prevent the Start Menu from displaying a list of recom + +## HideRecoPersonalizedSites + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | | + + + +```User +./User/Vendor/MSFT/Policy/Config/Start/HideRecoPersonalizedSites +``` + +```Device +./Device/Vendor/MSFT/Policy/Config/Start/HideRecoPersonalizedSites +``` + + + + +This policy setting allows you to hide the personalized websites in the recommended section of the Start Menu. If you enable this policy setting, the Start Menu will no longer show personalized website recommendations in the recommended section of the start menu. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Personalized Website Recommendations shown. | +| 1 | Personalized Website Recommendations hidden. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | HideRecoPersonalizedSites | +| Path | StartMenu > AT > StartMenu | + + + + + + + + ## HideRestart @@ -1759,7 +1824,7 @@ Enabling this policy hides "Switch account" from appearing in the user tile in t This policy setting allows you to hide the TaskView button. -- If you enable this policy setting, the TaskView button will be hidden and the Settings toggle will be disabled. +If you enable this policy setting, the TaskView button will be hidden and the Settings toggle will be disabled. @@ -1931,6 +1996,7 @@ To validate this policy, do the following steps: This policy setting allows you to control pinning programs to the Taskbar. + - If you enable this policy setting, users cannot change the programs currently pinned to the Taskbar. If any programs are already pinned to the Taskbar, these programs continue to show in the Taskbar. However, users cannot unpin these programs already pinned to the Taskbar, and they cannot pin new programs to the Taskbar. - If you disable or do not configure this policy setting, users can change the programs currently pinned to the Taskbar. @@ -1993,6 +2059,7 @@ To validate this policy, do the following steps: + - If you enable this policy setting, you can configure Start menu to show or hide the list of user's most used apps, regardless of user settings. Selecting "Show" will force the "Most used" list to be shown, and user cannot change to hide it using the Settings app. @@ -2064,6 +2131,7 @@ Selecting "Not Configured", or if you disable or do not configure this policy se + - If you enable this policy, Quick Settings will be reduced to only having the WiFi, Bluetooth, Accessibility, and VPN buttons; the brightness and volume sliders; and battery indicator and link to the Settings app. - If you disable or don't configure this policy setting, the regular Quick Settings layout will appear whenever Quick Settings is invoked. @@ -2140,7 +2208,7 @@ To use this setting, you must first manually configure a device's Start layout t Once the XML file is generated and moved to the desired file path, type the fully qualified path and name of the XML file. You can type a local path, such as C:\StartLayouts\myLayout.xml or a UNC path, such as \\Server\Share\Layout.xml. If the specified file is not available when the user logs on, the layout won't be changed. Users cannot customize their Start screen while this setting is enabled. -- If you disable this setting or do not configure it, the Start screen layout won't be changed and users will be able to customize it. +If you disable this setting or do not configure it, the Start screen layout won't be changed and users will be able to customize it. diff --git a/windows/client-management/mdm/policy-csp-stickers.md b/windows/client-management/mdm/policy-csp-stickers.md index b466e095ca..c977508f6e 100644 --- a/windows/client-management/mdm/policy-csp-stickers.md +++ b/windows/client-management/mdm/policy-csp-stickers.md @@ -4,7 +4,7 @@ description: Learn more about the Stickers Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -26,7 +26,7 @@ ms.topic: reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | @@ -37,7 +37,7 @@ ms.topic: reference -This policy setting allows you to control whether you want to allow stickers to be edited and placed on Desktop +This policy setting allows you to control whether you want to allow stickers to be edited and placed on Desktop. diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index fd1abf6088..3af6abb66f 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -4,7 +4,7 @@ description: Learn more about the System Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -21,6 +21,9 @@ ms.topic: reference > > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + @@ -112,14 +115,14 @@ This policy is only supported up to Windows 10, Version 1703. Please use 'Manage -AllowCommercialDataPipeline configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at . +AllowCommercialDataPipeline configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>. To enable this behavior: 1. Enable this policy setting 2. Join an Azure Active Directory account to the device Windows diagnostic data is collected when the Allow Telemetry policy setting is set to value 1 - Required or above. Configuring this setting does not change the Windows diagnostic data collection level set for the device -- If you disable or do not configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft's privacy statement at unless you have enabled policies like 'Allow Update Compliance Processing' or 'Allow Desktop Analytics Processing". +If you disable or do not configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft's privacy statement at unless you have enabled policies like 'Allow Update Compliance Processing' or 'Allow Desktop Analytics Processing". See the documentation at for information on this and other policies that will result in Microsoft being the processor of Windows diagnostic data. @@ -187,7 +190,7 @@ See the documentation at for i -This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor for Windows diagnostic data collected from the device, subject to the Product Terms at . +This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor for Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>. To enable this behavior: 1. Enable this policy setting @@ -197,8 +200,7 @@ To enable this behavior: 4. Set the Configure the Commercial ID setting for your Desktop Analytics workspace When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. -This setting has no effect on devices unless they are properly enrolled in Desktop Analytics. -- If you disable this policy setting, devices will not appear in Desktop Analytics. +This setting has no effect on devices unless they are properly enrolled in Desktop Analytics. If you disable this policy setting, devices will not appear in Desktop Analytics. @@ -264,7 +266,7 @@ This setting has no effect on devices unless they are properly enrolled in Deskt This policy allows the device name to be sent to Microsoft as part of Windows diagnostic data. -- If you disable or do not configure this policy setting, then device name will not be sent to Microsoft as part of Windows diagnostic data. +If you disable or do not configure this policy setting, then device name will not be sent to Microsoft as part of Windows diagnostic data. @@ -375,6 +377,7 @@ Specifies whether set general purpose device to be in embedded mode. Most restri + > [!NOTE] > This policy is not supported in Windows 10, version 1607. This policy setting determines the level that Microsoft can experiment with the product to study user preferences or device behavior. Most restricted value is 0. @@ -566,11 +569,10 @@ Specifies whether to allow app access to the Location service. Most restricted v This policy is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows. -This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at . +This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>. For customers who enroll into the Microsoft Managed Desktop service, enabling this policy is required to allow Microsoft to process data for operational and analytic needs. See for more information. hen these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. -This setting has no effect on devices unless they are properly enrolled in Microsoft Managed Desktop. -- If you disable this policy setting, devices may not appear in Microsoft Managed Desktop. +This setting has no effect on devices unless they are properly enrolled in Microsoft Managed Desktop. If you disable this policy setting, devices may not appear in Microsoft Managed Desktop. @@ -680,7 +682,7 @@ By configuring this policy setting you can adjust what diagnostic data is collec - Send required diagnostic data. This is the minimum diagnostic data necessary to keep Windows secure, up to date, and performing as expected. Using this value disables the "Optional diagnostic data" control in the Settings app. - Send optional diagnostic data. Additional diagnostic data is collected that helps us to detect, diagnose and fix issues, as well as make product improvements. Required diagnostic data will always be included when you choose to send optional diagnostic data. Optional diagnostic data can also include diagnostic log files and crash dumps. Use the "Limit Dump Collection" and the "Limit Diagnostic Log Collection" policies for more granular control of what optional diagnostic data is sent. -- If you disable or do not configure this policy setting, the device will send required diagnostic data and the end user can choose whether to send optional diagnostic data from the Settings app. +If you disable or do not configure this policy setting, the device will send required diagnostic data and the end user can choose whether to send optional diagnostic data from the Settings app. **Note**: The "Configure diagnostic data opt-in settings user interface" group policy can be used to prevent end users from changing their data collection settings. @@ -703,7 +705,12 @@ The "Configure diagnostic data opt-in settings user interface" group policy can **Allowed values**: -
+| Value | Description | +|:--|:--| +| 0 | Security. Information that is required to help keep Windows more secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
Note: This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016. Using this setting on other devices is equivalent to setting the value of 1. | +| 1 (Default) | Basic. Basic device info, including: quality-related data, app compatibility, app usage data, and data from the Security level. | +| 3 | Full. All data necessary to identify and help to fix problems, plus data from the Security, Basic, and Enhanced levels. | + **Group policy mapping**: @@ -741,7 +748,7 @@ The "Configure diagnostic data opt-in settings user interface" group policy can -This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at . +This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>. To enable this behavior: 1. Enable this policy setting @@ -751,7 +758,7 @@ To enable this behavior: 4. Set the Configure the Commercial ID setting for your Update Compliance workspace When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. -- If you disable or do not configure this policy setting, devices will not appear in Update Compliance. +If you disable or do not configure this policy setting, devices will not appear in Update Compliance. @@ -864,7 +871,7 @@ Specifies whether to allow the user to factory reset the device by using control -This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at . +This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>. To enable this behavior: 1. Enable this policy setting @@ -873,7 +880,7 @@ To enable this behavior: 3. Set Allow Telemetry to value 1 - Required, or higher When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. -- If you disable or do not configure this policy setting, devices enrolled to the Windows Update for Business deployment service will not be able to take advantage of some deployment service features. +If you disable or do not configure this policy setting, devices enrolled to the Windows Update for Business deployment service will not be able to take advantage of some deployment service features. @@ -938,10 +945,10 @@ When these policies are configured, Windows diagnostic data collected from the d This policy setting allows you to specify which boot-start drivers are initialized based on a classification determined by an Early Launch Antimalware boot-start driver. The Early Launch Antimalware boot-start driver can return the following classifications for each boot-start driver: -- Good: The driver has been signed and has not been tampered with. -- Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized. -- Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver. -- Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot-start driver. + - Good: The driver has been signed and has not been tampered with. + - Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized. + - Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver. + - Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot-start driver. - If you enable this policy setting you will be able to choose which boot-start drivers to initialize the next time the computer is started. @@ -1029,7 +1036,7 @@ The value for this setting will be provided by Microsoft as part of the onboardi |:--|:--| | Name | ConfigureMicrosoft365UploadEndpoint | | Friendly Name | Configure diagnostic data upload endpoint for Desktop Analytics | -| Element Name | Desktop Analytics Custom Upload Endpoint | +| Element Name | Desktop Analytics Custom Upload Endpoint. | | Location | Computer Configuration | | Path | WindowsComponents > Data Collection and Preview Builds | | Registry Key Name | Software\Policies\Microsoft\Windows\DataCollection | @@ -1129,7 +1136,7 @@ This policy setting determines whether an end user can change diagnostic data se If you set this policy setting to "Disable diagnostic data opt-in settings", diagnostic data settings are disabled in the Settings app. -- If you don't configure this policy setting, or you set it to "Enable diagnostic data opt-in settings", end users can change the device diagnostic settings in the Settings app. +If you don't configure this policy setting, or you set it to "Enable diagnostic data opt-in settings", end users can change the device diagnostic settings in the Settings app. **Note**: To set a limit on the amount of diagnostic data that is sent to Microsoft by your organization, use the "Allow Diagnostic Data" policy setting. @@ -1384,8 +1391,7 @@ This group policy allows control over whether the DirectX Database Updater task -This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. -- If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy. +This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy. @@ -1448,6 +1454,7 @@ This policy setting blocks the Connected User Experience and Telemetry service f This policy setting lets you prevent apps and features from working with files on OneDrive. + - If you enable this policy setting: * Users can't access OneDrive from the OneDrive app and file picker. @@ -1837,7 +1844,7 @@ This policy setting controls whether additional diagnostic logs are collected wh By enabling this policy setting, diagnostic logs will not be collected. -- If you disable or do not configure this policy setting, we may occasionally collect diagnostic logs if the device has been configured to send optional diagnostic data. +If you disable or do not configure this policy setting, we may occasionally collect diagnostic logs if the device has been configured to send optional diagnostic data. @@ -1903,7 +1910,7 @@ This policy setting limits the type of dumps that can be collected when more inf By enabling this setting, Windows Error Reporting is limited to sending kernel mini dumps and user mode triage dumps. -- If you disable or do not configure this policy setting, we may occasionally collect full or heap dumps if the user has opted to send optional diagnostic data. +If you disable or do not configure this policy setting, we may occasionally collect full or heap dumps if the user has opted to send optional diagnostic data. @@ -1975,9 +1982,9 @@ To enable the behavior described above, complete the following steps: 3. Enable the "Limit Dump Collection" policy 4. Enable the "Limit Diagnostic Log Collection" policy -When these policies are configured, Microsoft will collect only required diagnostic data and the events required by Desktop Analytics, which can be viewed at . +When these policies are configured, Microsoft will collect only required diagnostic data and the events required by Desktop Analytics, which can be viewed at< https://go.microsoft.com/fwlink/?linkid=2116020>. -- If you disable or do not configure this policy setting, diagnostic data collection is determined by the "Allow Diagnostic Data" policy setting or by the end user from the Settings app. +If you disable or do not configure this policy setting, diagnostic data collection is determined by the "Allow Diagnostic Data" policy setting or by the end user from the Settings app. @@ -2038,9 +2045,12 @@ When these policies are configured, Microsoft will collect only required diagnos - -Allows you to specify the fully qualified domain name (FQDN) or IP address of a proxy server to forward Connected User Experiences and Telemetry requests. The format for this setting is ``:``. The connection is made over a Secure Sockets Layer (SSL) connection. If the named proxy fails, or if there is no proxy specified when this policy is enabled, the Connected User Experiences and Telemetry data will not be transmitted and will remain on the local device. -- If you disable or do not configure this policy setting, Connected User Experiences and Telemetry will go to Microsoft using the default proxy configuration. + +With this policy setting, you can forward Connected User Experience and Telemetry requests to a proxy server. + +- If you enable this policy setting, you can specify the FQDN or IP address of the destination device within your organization's network (and optionally a port number, if desired). The connection will be made over a Secure Sockets Layer (SSL) connection. If the named proxy fails, or if you disable or do not configure this policy setting, Connected User Experience and Telemetry data will be sent to Microsoft using the default proxy configuration. + +The format for this setting is ``:`` @@ -2063,7 +2073,7 @@ Allows you to specify the fully qualified domain name (FQDN) or IP address of a |:--|:--| | Name | TelemetryProxy | | Friendly Name | Configure Connected User Experiences and Telemetry | -| Element Name | Proxy Server Name | +| Element Name | Proxy Server Name. | | Location | Computer Configuration | | Path | WindowsComponents > Data Collection and Preview Builds | | Registry Key Name | Software\Policies\Microsoft\Windows\DataCollection | diff --git a/windows/client-management/mdm/policy-csp-taskmanager.md b/windows/client-management/mdm/policy-csp-taskmanager.md index 6c58c87151..398334874d 100644 --- a/windows/client-management/mdm/policy-csp-taskmanager.md +++ b/windows/client-management/mdm/policy-csp-taskmanager.md @@ -4,7 +4,7 @@ description: Learn more about the TaskManager Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,7 +37,7 @@ ms.topic: reference -This setting determines whether non-administrators can use Task Manager to end tasks - enabled (1) or disabled (0). Default: enabled +This setting determines whether non-administrators can use Task Manager to end tasks - enabled (1) or disabled (0). Default: enabled. diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 656d59762c..4d0a66c573 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -4,7 +4,7 @@ description: Learn more about the TextInput Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -86,8 +86,7 @@ Placeholder only. Do not use in production environment. -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input. Most restricted value is 0. +Allows the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input. Most restricted value is 0. @@ -185,8 +184,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the IT admin to disable the touch/handwriting keyboard on Windows. Most restricted value is 0. +Allows the IT admin to disable the touch/handwriting keyboard on Windows. Most restricted value is 0. @@ -235,8 +233,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the Japanese IME surrogate pair characters. Most restricted value is 0. +Allows the Japanese IME surrogate pair characters. Most restricted value is 0. @@ -285,8 +282,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows Japanese Ideographic Variation Sequence (IVS) characters. Most restricted value is 0. +Allows Japanese Ideographic Variation Sequence (IVS) characters. Most restricted value is 0. @@ -335,8 +331,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the Japanese non-publishing standard glyph. Most restricted value is 0. +Allows the Japanese non-publishing standard glyph. Most restricted value is 0. @@ -385,8 +380,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the Japanese user dictionary. Most restricted value is 0. +Allows the Japanese user dictionary. Most restricted value is 0. @@ -435,8 +429,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Specifies whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. When this policy is set to disabled, text prediction is disabled. Most restricted value is 0. +Specifies whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. When this policy is set to disabled, text prediction is disabled. Most restricted value is 0. @@ -1005,8 +998,7 @@ This policy allows the IT admin to enable the touch keyboard to automatically sh -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the users to restrict character code range of conversion by setting the character filter. +Allows the users to restrict character code range of conversion by setting the character filter. @@ -1055,8 +1047,7 @@ This policy allows the IT admin to enable the touch keyboard to automatically sh -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the users to restrict character code range of conversion by setting the character filter. +Allows the users to restrict character code range of conversion by setting the character filter. @@ -1105,8 +1096,7 @@ This policy allows the IT admin to enable the touch keyboard to automatically sh -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the users to restrict character code range of conversion by setting the character filter. +Allows the users to restrict character code range of conversion by setting the character filter. diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 6aac2cbd12..28b396eb2f 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -4,7 +4,7 @@ description: Learn more about the Update Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/03/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -26,7 +26,6 @@ ms.topic: reference Update CSP policies are listed below based on the group policy area: - [Windows Insider Preview](#windows-insider-preview) - - [AllowTemporaryEnterpriseFeatureControl](#allowtemporaryenterprisefeaturecontrol) - [ConfigureDeadlineNoAutoRebootForFeatureUpdates](#configuredeadlinenoautorebootforfeatureupdates) - [ConfigureDeadlineNoAutoRebootForQualityUpdates](#configuredeadlinenoautorebootforqualityupdates) - [Manage updates offered from Windows Update](#manage-updates-offered-from-windows-update) @@ -63,6 +62,7 @@ Update CSP policies are listed below based on the group policy area: - [AllowAutoUpdate](#allowautoupdate) - [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](#allowautowindowsupdatedownloadovermeterednetwork) - [AllowMUUpdateService](#allowmuupdateservice) + - [AllowTemporaryEnterpriseFeatureControl](#allowtemporaryenterprisefeaturecontrol) - [ConfigureDeadlineForFeatureUpdates](#configuredeadlineforfeatureupdates) - [ConfigureDeadlineForQualityUpdates](#configuredeadlineforqualityupdates) - [ConfigureDeadlineGracePeriod](#configuredeadlinegraceperiod) @@ -107,75 +107,6 @@ Update CSP policies are listed below based on the group policy area: ## Windows Insider Preview - -### AllowTemporaryEnterpriseFeatureControl - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | - - - -```Device -./Device/Vendor/MSFT/Policy/Config/Update/AllowTemporaryEnterpriseFeatureControl -``` - - - - -Features introduced via servicing (outside of the annual feature update) are off by default for devices that have their Windows updates managed*. - -- If this policy is configured to "Enabled", then all features available in the latest monthly quality update installed will be on. - -- If this policy is set to "Not Configured" or "Disabled" then features that are shipped via a monthly quality update (servicing) will remain off until the feature update that includes these features is installed. - -*Windows update managed devices are those that have their Windows updates managed via policy; whether via the cloud using Windows Update for Business or on-premises with Windows Server Update Services (WSUS). - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | int | -| Access Type | Add, Delete, Get, Replace | -| Default Value | 0 | - - - -**Allowed values**: - -| Value | Description | -|:--|:--| -| 0 (Default) | Not allowed. | -| 1 | Allowed. | - - - -**Group policy mapping**: - -| Name | Value | -|:--|:--| -| Name | AllowTemporaryEnterpriseFeatureControl | -| Friendly Name | Enable features introduced via servicing that are off by default | -| Location | Computer Configuration | -| Path | Windows Components > Windows Update > Manage end user experience | -| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | -| Registry Value Name | AllowTemporaryEnterpriseFeatureControl | -| ADMX File Name | WindowsUpdate.admx | - - - - - - - - ### ConfigureDeadlineNoAutoRebootForFeatureUpdates @@ -430,8 +361,12 @@ The maintenance wakeup policy specifies if Automatic Maintenance should make a w - -Allows the IT admin to set which branch a device receives their updates from. As of 1903, the branch readiness levels of Semi-Annual Channel (Targeted) and Semi-Annual Channel have been combined into one Semi-Annual Channel set with a value of 16. For devices on 1903 and later releases, the value of 32 is not a supported value. + +Enable this policy to specify when to receive Feature Updates. + +Defer Updates | This enables devices to defer taking the next Feature Update available for their current product (or a new product if specified in the Select the target Feature Update version policy). You can defer a Feature Update for up to 14 days for all pre-release channels and up to 365 days for the General Availability Channel. To learn more about the current releases, please see aka.ms/WindowsTargetVersioninfo + +Pause Updates | To prevent Feature Updates from being offered to the device, you can temporarily pause Feature Updates. This pause will remain in effect for 35 days from the specified start date or until the field is cleared. Note, Quality Updates will still be offered even if Feature Updates are paused. @@ -496,11 +431,12 @@ Allows the IT admin to set which branch a device receives their updates from. As - -Defers Feature Updates for the specified number of days. Supported values are 0-365 days. + +Enable this policy to specify when to receive Feature Updates. -> [!IMPORTANT] -> The default maximum number of days to defer an update has been increased from 180 (Windows 10, version 1607) to 365 in Windows 10, version 1703. +Defer Updates | This enables devices to defer taking the next Feature Update available for their current product (or a new product if specified in the Select the target Feature Update version policy). You can defer a Feature Update for up to 14 days for all pre-release channels and up to 365 days for the General Availability Channel. To learn more about the current releases, please see aka.ms/WindowsTargetVersioninfo + +Pause Updates | To prevent Feature Updates from being offered to the device, you can temporarily pause Feature Updates. This pause will remain in effect for 35 days from the specified start date or until the field is cleared. Note, Quality Updates will still be offered even if Feature Updates are paused. @@ -554,8 +490,16 @@ Defers Feature Updates for the specified number of days. Supported values are 0- - -Defers Quality Updates for the specified number of days. Supported values are 0-30. + +Enable this policy to specify when to receive quality updates. + +You can defer receiving quality updates for up to 30 days. + +To prevent quality updates from being received on their scheduled time, you can temporarily pause quality updates. The pause will remain in effect for 35 days or until you clear the start date field. + +To resume receiving Quality Updates which are paused, clear the start date field. + +If you disable or do not configure this policy, Windows Update will not alter its behavior. @@ -580,7 +524,7 @@ Defers Quality Updates for the specified number of days. Supported values are 0- |:--|:--| | Name | DeferQualityUpdates | | Friendly Name | Select when Quality Updates are received | -| Element Name | After a quality update is released, defer receiving it for this many days | +| Element Name | After a quality update is released, defer receiving it for this many days. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Update | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -671,7 +615,7 @@ IT admins can, if necessary, opt devices out of safeguard protections using this Enable this policy to not include drivers with Windows quality updates. -- If you disable or do not configure this policy, Windows Update will include updates that have a Driver classification. +If you disable or do not configure this policy, Windows Update will include updates that have a Driver classification. @@ -733,8 +677,25 @@ Enable this policy to not include drivers with Windows quality updates. - -Used to manage Windows 10 Insider Preview builds. Value type is integer. + +Enable this policy to manage which updates you receive prior to the update being released to the world. + +Dev Channel +Ideal for highly technical users. Insiders in the Dev Channel will receive builds from our active development branch that is earliest in a development cycle. These builds are not matched to a specific Windows 10 release. + +Beta Channel +Ideal for feature explorers who want to see upcoming Windows 10 features. Your feedback will be especially important here as it will help our engineers ensure key issues are fixed before a major release. + +Release Preview Channel (default) +Insiders in the Release Preview Channel will have access to the upcoming release of Windows 10 prior to it being released to the world. These builds are supported by Microsoft. The Release Preview Channel is where we recommend companies preview and validate upcoming Windows 10 releases before broad deployment within their organization. + +Release Preview Channel, Quality Updates Only +Ideal for those who want to validate the features and fixes coming soon to their current version. Note, released feature updates will continue to be offered in accordance with configured policies when this option is selected. + +> [!NOTE] +> Preview Build enrollment requires a telemetry level setting of 2 or higher and your domain registered on insider.windows.com. For additional information on Preview Builds, see: + +If you disable or do not configure this policy, Windows Update will not offer you any pre-release updates and you will receive such content once released to the world. Disabling this policy will cause any devices currently on a pre-release build to opt out and stay on the latest Feature Update once released. @@ -797,8 +758,12 @@ Used to manage Windows 10 Insider Preview builds. Value type is integer. - -Allows IT Admins to pause Feature Updates for up to 60 days. + +Enable this policy to specify when to receive Feature Updates. + +Defer Updates | This enables devices to defer taking the next Feature Update available for their current product (or a new product if specified in the Select the target Feature Update version policy). You can defer a Feature Update for up to 14 days for all pre-release channels and up to 365 days for the General Availability Channel. To learn more about the current releases, please see aka.ms/WindowsTargetVersioninfo + +Pause Updates | To prevent Feature Updates from being offered to the device, you can temporarily pause Feature Updates. This pause will remain in effect for 35 days from the specified start date or until the field is cleared. Note, Quality Updates will still be offered even if Feature Updates are paused. @@ -861,8 +826,12 @@ Allows IT Admins to pause Feature Updates for up to 60 days. - -Specifies the date and time when the IT admin wants to start pausing the Feature Updates. Value type is string (yyyy-mm-dd, ex. 2018-10-28). + +Enable this policy to specify when to receive Feature Updates. + +Defer Updates | This enables devices to defer taking the next Feature Update available for their current product (or a new product if specified in the Select the target Feature Update version policy). You can defer a Feature Update for up to 14 days for all pre-release channels and up to 365 days for the General Availability Channel. To learn more about the current releases, please see aka.ms/WindowsTargetVersioninfo + +Pause Updates | To prevent Feature Updates from being offered to the device, you can temporarily pause Feature Updates. This pause will remain in effect for 35 days from the specified start date or until the field is cleared. Note, Quality Updates will still be offered even if Feature Updates are paused. @@ -885,7 +854,7 @@ Specifies the date and time when the IT admin wants to start pausing the Feature |:--|:--| | Name | DeferFeatureUpdates | | Friendly Name | Select when Preview Builds and Feature Updates are received | -| Element Name | Pause Preview Builds or Feature Updates starting | +| Element Name | Pause Preview Builds or Feature Updates starting. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Update | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -914,8 +883,16 @@ Specifies the date and time when the IT admin wants to start pausing the Feature - -Allows IT Admins to pause Quality Updates. + +Enable this policy to specify when to receive quality updates. + +You can defer receiving quality updates for up to 30 days. + +To prevent quality updates from being received on their scheduled time, you can temporarily pause quality updates. The pause will remain in effect for 35 days or until you clear the start date field. + +To resume receiving Quality Updates which are paused, clear the start date field. + +If you disable or do not configure this policy, Windows Update will not alter its behavior. @@ -978,8 +955,16 @@ Allows IT Admins to pause Quality Updates. - -Specifies the date and time when the IT admin wants to start pausing the Quality Updates. Value type is string (yyyy-mm-dd, ex. 2018-10-28). + +Enable this policy to specify when to receive quality updates. + +You can defer receiving quality updates for up to 30 days. + +To prevent quality updates from being received on their scheduled time, you can temporarily pause quality updates. The pause will remain in effect for 35 days or until you clear the start date field. + +To resume receiving Quality Updates which are paused, clear the start date field. + +If you disable or do not configure this policy, Windows Update will not alter its behavior. @@ -1004,7 +989,7 @@ Specifies the date and time when the IT admin wants to start pausing the Quality |:--|:--| | Name | DeferQualityUpdates | | Friendly Name | Select when Quality Updates are received | -| Element Name | Pause Quality Updates starting | +| Element Name | Pause Quality Updates starting. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Update | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1033,8 +1018,16 @@ Specifies the date and time when the IT admin wants to start pausing the Quality - -Enables IT administrators to specify the product version associated with the target feature update they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy. For details about different Windows 10 versions, see [Windows release information](/windows/release-health/release-information). + +Enter the product and version as listed on the Windows Update target version page: + +aka.ms/WindowsTargetVersioninfo + +The device will request that Windows Update product and version in subsequent scans. + +Entering a target product and clicking OK or Apply means I accept the Microsoft Software License Terms for it found at aka.ms/WindowsTargetVersioninfo. If an organization is licensing the software, I am authorized to bind the organization. + +If you enter an invalid value, you will remain on your current version until you correct the values to a supported product and version. @@ -1064,7 +1057,7 @@ Supported value type is a string containing a Windows product. For example, "Win |:--|:--| | Name | TargetReleaseVersion | | Friendly Name | Select the target Feature Update version | -| Element Name | Which Windows product version would you like to receive feature updates for? e.g., Windows 10 | +| Element Name | Which Windows product version would you like to receive feature updates for? e.g., Windows 10. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Update | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1093,8 +1086,16 @@ Supported value type is a string containing a Windows product. For example, "Win - -Enables IT administrators to specify which version they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy. For details about different Windows 10 versions, see [Windows 10 release information](/windows/release-health/release-information). + +Enter the product and version as listed on the Windows Update target version page: + +aka.ms/WindowsTargetVersioninfo + +The device will request that Windows Update product and version in subsequent scans. + +Entering a target product and clicking OK or Apply means I accept the Microsoft Software License Terms for it found at aka.ms/WindowsTargetVersioninfo. If an organization is licensing the software, I am authorized to bind the organization. + +If you enter an invalid value, you will remain on your current version until you correct the values to a supported product and version. @@ -1118,7 +1119,7 @@ Supported value type is a string containing Windows version number. For example, |:--|:--| | Name | TargetReleaseVersion | | Friendly Name | Select the target Feature Update version | -| Element Name | Target Version for Feature Updates | +| Element Name | Target Version for Feature Updates. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Update | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1214,8 +1215,21 @@ Specifies whether the device could use Microsoft Update, Windows Server Update S - -Specifies the scan frequency from every 1 - 22 hours. Default is 22 hours. + +Specifies the hours that Windows will use to determine how long to wait before checking for available updates. The exact wait time is a sum of the specific value and a random variant of 0-4 hours. + +If the status is set to Enabled, Windows will check for available updates at the specified interval. + +If the status is set to Disabled or Not Configured, Windows will check for available updates at the default interval of 22 hours. + +> [!NOTE] +> The "Specify intranet Microsoft update service location" setting must be enabled for this policy to have effect. + +> [!NOTE] +> If the "Configure Automatic Updates" policy is disabled, this policy has no effect. + +> [!NOTE] +> This policy is not supported on %WINDOWS_ARM_VERSION_6_2%. Setting this policy will not have any effect on %WINDOWS_ARM_VERSION_6_2% PCs. @@ -1273,8 +1287,7 @@ This policy should be enabled only when [UpdateServiceUrl](#updateserviceurl) is - -Do not enforce TLS certificate pinning for Windows Update client for detecting updates. + @@ -1680,8 +1693,7 @@ Configure this policy to specify whether to receive **Windows Quality Updates** - -Select the proxy behavior for Windows Update client for detecting updates + @@ -1720,7 +1732,7 @@ This policy setting doesn't impact those customers who have, per Microsoft recom |:--|:--| | Name | CorpWuURL | | Friendly Name | Specify intranet Microsoft update service location | -| Element Name | Select the proxy behavior for Windows Update client for detecting updates | +| Element Name | Select the proxy behavior for Windows Update client for detecting updates. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1778,7 +1790,7 @@ The following list shows the supported values: |:--|:--| | Name | CorpWuURL | | Friendly Name | Specify intranet Microsoft update service location | -| Element Name | Set the intranet update service for detecting updates | +| Element Name | Set the intranet update service for detecting updates. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1825,7 +1837,7 @@ The following list shows the supported values: -Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. To use this setting, you must set two server name values the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update agent, and download updates from an alternate download server instead of WSUS Server. Value type is string and the default value is an empty string, . If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. +Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update agent, and download updates from an alternate download server instead of WSUS Server. Value type is string and the default value is an empty string, . If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. > [!NOTE] > If the Configure Automatic Updates Group Policy is disabled, then this policy has no effect. If the Alternate Download Server Group Policy is not set, it will use the WSUS server by default to download updates. This policy is not supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs. @@ -1851,7 +1863,7 @@ Specifies an alternate intranet server to host updates from Microsoft Update. Yo |:--|:--| | Name | CorpWuURL | | Friendly Name | Specify intranet Microsoft update service location | -| Element Name | Set the alternate download server | +| Element Name | Set the alternate download server. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1882,11 +1894,20 @@ Specifies an alternate intranet server to host updates from Microsoft Update. Yo - -Allows the IT admin (when used with Update/ActiveHoursStart) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12 hour maximum from start time. + -> [!NOTE] -> The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See Update/ActiveHoursMaxRange below for more information. Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. The default is 17 (5 PM). +- If you enable this policy, the PC will not automatically restart after updates during active hours. The PC will attempt to restart outside of active hours. + +**Note** that the PC must restart for certain updates to take effect. + +- If you disable or do not configure this policy and have no other reboot group policies, the user selected active hours will be in effect. + +If any of the following two policies are enabled, this policy has no effect: + +1. No auto-restart with logged on users for scheduled automatic updates installations. +2. Always automatically restart at scheduled time. + +**Note** that the default max active hours range is 18 hours from the active hours start time unless otherwise configured via the Specify active hours range for auto-restarts policy. @@ -1911,7 +1932,7 @@ Allows the IT admin (when used with Update/ActiveHoursStart) to manage a range o |:--|:--| | Name | ActiveHours | | Friendly Name | Turn off auto-restart for updates during active hours | -| Element Name | End | +| Element Name | End. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1945,7 +1966,7 @@ Enable this policy to specify the maximum number of hours from the start time th The max active hours range can be set between 8 and 18 hours. -- If you disable or do not configure this policy, the default max active hours range will be used. +If you disable or do not configure this policy, the default max active hours range will be used. @@ -1970,7 +1991,7 @@ The max active hours range can be set between 8 and 18 hours. |:--|:--| | Name | ActiveHoursMaxRange | | Friendly Name | Specify active hours range for auto-restarts | -| Element Name | Max range | +| Element Name | Max range. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1999,11 +2020,20 @@ The max active hours range can be set between 8 and 18 hours. - -Allows the IT admin (when used with Update/ActiveHoursEnd) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12 hour maximum from end time. + -> [!NOTE] -> The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See Update/ActiveHoursMaxRange above for more information. Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. The default value is 8 (8 AM). +- If you enable this policy, the PC will not automatically restart after updates during active hours. The PC will attempt to restart outside of active hours. + +**Note** that the PC must restart for certain updates to take effect. + +- If you disable or do not configure this policy and have no other reboot group policies, the user selected active hours will be in effect. + +If any of the following two policies are enabled, this policy has no effect: + +1. No auto-restart with logged on users for scheduled automatic updates installations. +2. Always automatically restart at scheduled time. + +**Note** that the default max active hours range is 18 hours from the active hours start time unless otherwise configured via the Specify active hours range for auto-restarts policy. @@ -2028,7 +2058,7 @@ Allows the IT admin (when used with Update/ActiveHoursEnd) to manage a range of |:--|:--| | Name | ActiveHours | | Friendly Name | Turn off auto-restart for updates during active hours | -| Element Name | Start | +| Element Name | Start. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -2057,8 +2087,41 @@ Allows the IT admin (when used with Update/ActiveHoursEnd) to manage a range of - -Enables the IT admin to manage automatic update behavior to scan, download, and install updates. Important. This option should be used only for systems under regulatory compliance, as you will not get security updates as well. If the policy is not configured, end-users get the default behavior (Auto install and restart). + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -2095,7 +2158,7 @@ Enables the IT admin to manage automatic update behavior to scan, download, and |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Configure automatic updating | +| Element Name | Configure automatic updating. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -2190,8 +2253,41 @@ This policy is accessible through the Update setting in the user interface or Gr - -Allows the IT admin to manage whether to scan for app updates from Microsoft Update. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -2231,7 +2327,7 @@ Allows the IT admin to manage whether to scan for app updates from Microsoft Upd |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Install updates for other Microsoft products | +| Element Name | Install updates for other Microsoft products. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -2244,6 +2340,77 @@ Allows the IT admin to manage whether to scan for app updates from Microsoft Upd + +### AllowTemporaryEnterpriseFeatureControl + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621.1344] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AllowTemporaryEnterpriseFeatureControl +``` + + + + +Features introduced via servicing (outside of the annual feature update) are off by default for devices that have their Windows updates managed*. + +- If this policy is configured to "Enabled", then all features available in the latest monthly quality update installed will be on. + +- If this policy is set to "Not Configured" or "Disabled" then features that are shipped via a monthly quality update (servicing) will remain off until the feature update that includes these features is installed. + +*Windows update managed devices are those that have their Windows updates managed via policy; whether via the cloud using Windows Update for Business or on-premises with Windows Server Update Services (WSUS). + + + + +> [!NOTE] +> In Intune, this setting is known as **Allow Temporary Enterprise Feature Control** and is available in the Settings Catalog. By default, all features introduced via servicing that are behind the commercial control are off for Windows-Update-managed devices. When set to Allowed, these features are enabled and turned on. For more information, see [Blog: Commercial control for continuous innovation](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/commercial-control-for-continuous-innovation/ba-p/3737575). + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Not allowed. | +| 1 | Allowed. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AllowTemporaryEnterpriseFeatureControl | +| Friendly Name | Enable features introduced via servicing that are off by default | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| Registry Value Name | AllowTemporaryEnterpriseFeatureControl | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + ### ConfigureDeadlineForFeatureUpdates @@ -2518,7 +2685,7 @@ When enabled, devices will not automatically restart outside of active hours unt |:--|:--| | Name | ComplianceDeadline | | Friendly Name | Specify deadlines for automatic updates and restarts | -| Element Name | Don't auto-restart until end of grace period | +| Element Name | Don't auto-restart until end of grace period. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -2548,7 +2715,7 @@ When enabled, devices will not automatically restart outside of active hours unt -Enable enterprises/IT admin to configure feature update uninstall period +Enable enterprises/IT admin to configure feature update uninstall period. @@ -2632,7 +2799,7 @@ If you select "Apply only during active hours" in conjunction with Option 1 or 2 |:--|:--| | Name | UpdateNotificationLevel | | Friendly Name | Display options for update notifications | -| Element Name | Apply only during active hours | +| Element Name | Apply only during active hours. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -2661,8 +2828,41 @@ If you select "Apply only during active hours" in conjunction with Option 1 or 2 - -Enables the IT admin to schedule the day of the update installation. The data type is an integer. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -2703,7 +2903,7 @@ Enables the IT admin to schedule the day of the update installation. The data ty |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Scheduled install day | +| Element Name | Scheduled install day. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -2732,8 +2932,41 @@ Enables the IT admin to schedule the day of the update installation. The data ty - -Enables the IT admin to schedule the update installation every week. Value type is integer. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -2768,7 +3001,7 @@ Enables the IT admin to schedule the update installation every week. Value type |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Every week | +| Element Name | Every week. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -2797,8 +3030,41 @@ Enables the IT admin to schedule the update installation every week. Value type - -Enables the IT admin to schedule the update installation on the first week of the month. Value type is integer. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -2833,7 +3099,7 @@ Enables the IT admin to schedule the update installation on the first week of th |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | First week of the month | +| Element Name | First week of the month. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -2862,8 +3128,41 @@ Enables the IT admin to schedule the update installation on the first week of th - -Enables the IT admin to schedule the update installation on the fourth week of the month. Value type is integer. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -2898,7 +3197,7 @@ Enables the IT admin to schedule the update installation on the fourth week of t |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Fourth week of the month | +| Element Name | Fourth week of the month. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -2927,8 +3226,41 @@ Enables the IT admin to schedule the update installation on the fourth week of t - -Enables the IT admin to schedule the update installation on the second week of the month. Value type is integer. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -2963,7 +3295,7 @@ Enables the IT admin to schedule the update installation on the second week of t |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Second week of the month | +| Element Name | Second week of the month. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -2992,8 +3324,41 @@ Enables the IT admin to schedule the update installation on the second week of t - -Enables the IT admin to schedule the update installation on the third week of the month. Value type is integer. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -3028,7 +3393,7 @@ Enables the IT admin to schedule the update installation on the third week of th |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Third week of the month | +| Element Name | Third week of the month. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -3057,8 +3422,41 @@ Enables the IT admin to schedule the update installation on the third week of th - - the IT admin to schedule the time of the update installation. The data type is an integer. Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM. The default value is 3. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -3087,7 +3485,7 @@ Enables the IT admin to schedule the update installation on the third week of th |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Scheduled install time | +| Element Name | Scheduled install time. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -3117,7 +3515,7 @@ Enables the IT admin to schedule the update installation on the third week of th -This setting allows removing access to "Pause updates" feature. +This setting allows to remove access to "Pause updates" feature. Once enabled user access to pause updates is removed. @@ -3184,7 +3582,7 @@ Once enabled user access to pause updates is removed. This setting allows you to remove access to scan Windows Update. -- If you enable this setting user access to Windows Update scan, download and install is removed. +If you enable this setting user access to Windows Update scan, download and install is removed. @@ -3262,7 +3660,6 @@ The following rules are followed regarding battery power: This setting overrides the install deferral behaviour of [AllowAutoUpdate](#allowautoupdate). These settings are designed for education devices that remain in carts overnight that are left in sleep mode. It is not designed for 1:1 devices. - @@ -3399,7 +3796,7 @@ Specify the deadline before the PC will automatically restart to apply updates. The restart may happen inside active hours. -- If you disable or do not configure this policy, the PC will restart according to the default schedule. +If you disable or do not configure this policy, the PC will restart according to the default schedule. Enabling either of the following two policies will override the above policy: @@ -3463,7 +3860,7 @@ Specify the deadline before the PC will automatically restart to apply updates. The restart may happen inside active hours. -- If you disable or do not configure this policy, the PC will restart according to the default schedule. +If you disable or do not configure this policy, the PC will restart according to the default schedule. Enabling either of the following two policies will override the above policy: @@ -3522,8 +3919,12 @@ Enabling either of the following two policies will override the above policy: - -Allows the IT Admin to specify the period for auto-restart reminder notifications. The default value is 15 (minutes). + +Enable this policy to specify when auto-restart reminders are displayed. + +You can specify the amount of time prior to a scheduled restart to notify the user. + +If you disable or do not configure this policy, the default period will be used. @@ -3593,7 +3994,7 @@ Enable this policy to specify the method by which the auto-restart required noti The method can be set to require user action to dismiss the notification. -- If you disable or do not configure this policy, the default method will be used. +If you disable or do not configure this policy, the default method will be used. @@ -3626,7 +4027,7 @@ The method can be set to require user action to dismiss the notification. |:--|:--| | Name | AutoRestartRequiredNotificationDismissal | | Friendly Name | Configure auto-restart required notification for updates | -| Element Name | Method | +| Element Name | Method. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Legacy Policies | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -3803,6 +4204,7 @@ Allows IT Admins to specify additional upgrade delays for up to 8 months. Suppor Enable this policy to not allow update deferral policies to cause scans against Windows Update. If this policy is disabled or not configured, then the Windows Update client may initiate automatic scans against Windows Update while update deferral policies are enabled. + > [!NOTE] > This policy applies only when the intranet Microsoft update service this computer is directed to is configured to support client-side targeting. If the "Specify intranet Microsoft update service location" policy is disabled or not configured, this policy has no effect. @@ -3877,14 +4279,14 @@ You can specify the deadline in days before automatically scheduling and executi If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. -- If you disable or do not configure this policy, the PC will restart following the default schedule. +If you disable or do not configure this policy, the PC will restart following the default schedule. Enabling any of the following policies will override the above policy: 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time -3. Specify deadline before auto-restart for update installation +3. Specify deadline before auto-restart for update installation. @@ -3947,14 +4349,14 @@ You can specify the deadline in days before automatically scheduling and executi If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. -- If you disable or do not configure this policy, the PC will restart following the default schedule. +If you disable or do not configure this policy, the PC will restart following the default schedule. Enabling any of the following policies will override the above policy: 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time -3. Specify deadline before auto-restart for update installation +3. Specify deadline before auto-restart for update installation. @@ -4017,14 +4419,14 @@ You can specify the deadline in days before automatically scheduling and executi If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. -- If you disable or do not configure this policy, the PC will restart following the default schedule. +If you disable or do not configure this policy, the PC will restart following the default schedule. Enabling any of the following policies will override the above policy: 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time -3. Specify deadline before auto-restart for update installation +3. Specify deadline before auto-restart for update installation. @@ -4087,14 +4489,14 @@ You can specify the deadline in days before automatically scheduling and executi If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. -- If you disable or do not configure this policy, the PC will restart following the default schedule. +If you disable or do not configure this policy, the PC will restart following the default schedule. Enabling any of the following policies will override the above policy: 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time -3. Specify deadline before auto-restart for update installation +3. Specify deadline before auto-restart for update installation. @@ -4157,14 +4559,14 @@ You can specify the deadline in days before automatically scheduling and executi If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. -- If you disable or do not configure this policy, the PC will restart following the default schedule. +If you disable or do not configure this policy, the PC will restart following the default schedule. Enabling any of the following policies will override the above policy: 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time -3. Specify deadline before auto-restart for update installation +3. Specify deadline before auto-restart for update installation. @@ -4227,14 +4629,14 @@ You can specify the deadline in days before automatically scheduling and executi If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. -- If you disable or do not configure this policy, the PC will restart following the default schedule. +If you disable or do not configure this policy, the PC will restart following the default schedule. Enabling any of the following policies will override the above policy: 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time -3. Specify deadline before auto-restart for update installation +3. Specify deadline before auto-restart for update installation. @@ -4409,6 +4811,7 @@ To validate this policy: + > [!NOTE] > Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](../device-update-management.md#windows10version1607forupdatemanagement). You can continue to use PauseDeferrals for Windows 10, version 1511 devices. Allows IT Admins to pause updates and upgrades for up to 5 weeks. Paused deferrals will be reset after 5 weeks. If the Specify intranet Microsoft update service location policy is enabled, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. If the Allow Telemetry policy is enabled and the Options value is set to 0, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. @@ -4510,6 +4913,7 @@ This policy is deprecated. Use Update/RequireUpdateApproval instead. + > [!NOTE] > Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](../device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. Allows the IT admin to set a device to Semi-Annual Channel train. @@ -4570,6 +4974,7 @@ This policy is deprecated. Use Update/RequireUpdateApproval instead. + > [!NOTE] > If you previously used the Update/PhoneUpdateRestrictions policy in previous versions of Windows, it has been deprecated. Please use this policy instead. Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved. @@ -4619,8 +5024,14 @@ This policy is deprecated. Use Update/RequireUpdateApproval instead. - -Allows the IT Admin to specify the period for auto-restart imminent warning notifications. The default value is 15 (minutes). + +Enable this policy to control when notifications are displayed to warn users about a scheduled restart for the update installation deadline. Users are not able to postpone the scheduled restart once the deadline has been reached and the restart is automatically executed. + +Specifies the amount of time prior to a scheduled restart to display the warning reminder to the user. + +You can specify the amount of time prior to a scheduled restart to notify the user that the auto restart is imminent to allow them time to save their work. + +If you disable or do not configure this policy, the default notification behaviors will be used. @@ -4690,7 +5101,7 @@ Specifies the amount of time prior to a scheduled restart to display the warning You can specify the amount of time prior to a scheduled restart to notify the user that the auto restart is imminent to allow them time to save their work. -- If you disable or do not configure this policy, the default notification behaviors will be used. +If you disable or do not configure this policy, the default notification behaviors will be used. @@ -4755,8 +5166,12 @@ You can specify the amount of time prior to a scheduled restart to notify the us - -Allows the IT Admin to disable auto-restart notifications for update installations. + +This policy setting allows you to control whether users receive notifications for auto restarts for update installations including reminder and warning notifications. + +Enable this policy to turn off all auto restart notifications. + +If you disable or do not configure this policy, the default notification behaviors will be unchanged. diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index 3e96dc09de..113eac5d6c 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -4,7 +4,7 @@ description: Learn more about the UserRights Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,9 @@ ms.topic: reference # Policy CSP - UserRights +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + User rights are assigned for user accounts or groups. The name of the policy defines the user right in question, and the values are always users or groups. Values can be represented as Security Identifiers (SID) or strings. For more information, see [Well-known SID structures](/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab). @@ -170,7 +173,7 @@ This user right is used by Credential Manager during Backup/Restore. No accounts -This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right +This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right. > [!NOTE] > Remote Desktop Services was called Terminal Services in previous versions of Windows Server. @@ -222,7 +225,7 @@ This user right determines which users and groups are allowed to connect to the -This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned +This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned. > [!CAUTION] > Assigning this user right can be a security risk. Only assign this user right to trusted users. @@ -274,10 +277,10 @@ This user right allows a process to impersonate any user without authentication. -This user right determines which users can log on to the computer +This user right determines which users can log on to the computer. > [!NOTE] -> Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally ( ) at the Microsoft website. +> Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally (https://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website. @@ -326,10 +329,10 @@ This user right determines which users can log on to the computer -This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the systemTraverse Folder/Execute File, Read +This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Read. > [!CAUTION] -> Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, only assign this user right to trusted users +> Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, only assign this user right to trusted users. @@ -534,7 +537,7 @@ This user right determines which users and groups can change the time zone used -This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption +This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. > [!CAUTION] > Assigning this user right can be a security risk. Assign this user right only to trusted users. @@ -586,7 +589,7 @@ This security setting determines whether users can create global objects that ar -This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users +This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users. @@ -684,10 +687,10 @@ This user right determines which accounts can be used by processes to create a d -This user right determines if the user can create a symbolic link from the computer he is logged on to +This user right determines if the user can create a symbolic link from the computer he is logged on to. > [!CAUTION] -> This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them +> This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. > [!NOTE] > This setting can be used in conjunction a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type 'fsutil behavior set symlinkevaluation /?' at the command line to get more information about fsutil and symbolic links. @@ -739,7 +742,7 @@ This user right determines if the user can create a symbolic link from the compu -This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System +This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. > [!CAUTION] > Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. @@ -791,7 +794,7 @@ This user right determines which accounts can be used by processes to create a t -This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components +This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components. > [!CAUTION] > Assigning this user right can be a security risk. Only assign this user right to trusted users. @@ -892,7 +895,7 @@ This user right determines which users are prevented from accessing a computer o -This security setting determines which service accounts are prevented from registering a process as a service +This security setting determines which service accounts are prevented from registering a process as a service. > [!NOTE] > This security setting does not apply to the System, Local Service, or Network Service accounts. @@ -1026,6 +1029,58 @@ This user right determines which users and groups are prohibited from logging on + +## DenyServiceLogonRight + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/DenyServiceLogonRight +``` + + + + +This security setting determines which service accounts are prevented from registering a process as a service. This policy setting supersedes the Log on as a service policy setting if an account is subject to both policies. + +> [!NOTE] +> This security setting does not apply to the System, Local Service, or Network Service accounts. Default: None. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Deny log on as a service | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + + + + + + + + ## EnableDelegation @@ -1043,7 +1098,7 @@ This user right determines which users and groups are prohibited from logging on -This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set +This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set. > [!CAUTION] > Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources. @@ -1144,13 +1199,13 @@ This user right determines which accounts can be used by a process to add entrie -Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels +Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. > [!CAUTION] -> Assigning this user right can be a security risk. Only assign this user right to trusted users +> Assigning this user right can be a security risk. Only assign this user right to trusted users. > [!NOTE] -> By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. 1) The access token that is being impersonated is for this user. 2) The user, in this logon session, created the access token by logging on to the network with explicit credentials. 3) The requested level is less than Impersonate, such as Anonymous or Identify. Because of these factors, users do not usually need this user right +> By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. 1) The access token that is being impersonated is for this user. 2) The user, in this logon session, created the access token by logging on to the network with explicit credentials. 3) The requested level is less than Impersonate, such as Anonymous or Identify. Because of these factors, users do not usually need this user right. > [!WARNING] > If you enable this setting, programs that previously had the Impersonate privilege may lose it, and they may not run. @@ -1202,7 +1257,7 @@ Assigning this user right to a user allows programs running on behalf of that us -Increase a process working set. This privilege determines which user accounts can increase or decrease the size of a process's working set. The working set of a process is the set of memory pages currently visible to the process in physical RAM memory. These pages are resident and available for an application to use without triggering a page fault. The minimum and maximum working set sizes affect the virtual memory paging behavior of a process +Increase a process working set. This privilege determines which user accounts can increase or decrease the size of a process's working set. The working set of a process is the set of memory pages currently visible to the process in physical RAM memory. These pages are resident and available for an application to use without triggering a page fault. The minimum and maximum working set sizes affect the virtual memory paging behavior of a process. > [!WARNING] > Increasing the working set size for a process decreases the amount of physical memory available to the rest of the system. @@ -1308,7 +1363,7 @@ This user right determines which accounts can use a process with Write Property -This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users +This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users. > [!CAUTION] > Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. @@ -1605,7 +1660,7 @@ This user right determines which users and groups can run maintenance tasks on a -This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor. On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows +This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor. On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows. > [!NOTE] > This security setting does not affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties. @@ -1902,7 +1957,7 @@ This security setting determines which user accounts can call the CreateProcessA -This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the systemTraverse Folder/Execute File, Write +This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Write. > [!CAUTION] > Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, only assign this user right to trusted users. @@ -2003,7 +2058,7 @@ This security setting determines which users who are logged on locally to the co -This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads +This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. > [!CAUTION] > Assigning this user right can be a security risk. Since owners of objects have full control of them, only assign this user right to trusted users. diff --git a/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md b/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md index 055490b65d..c0ee21c83b 100644 --- a/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md +++ b/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md @@ -4,7 +4,7 @@ description: Learn more about the VirtualizationBasedTechnology Area in Policy C author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,7 +36,7 @@ ms.topic: reference - + Hypervisor-Protected Code Integrity: 0 - Turns off Hypervisor-Protected Code Integrity remotely if configured previously without UEFI Lock, 1 - Turns on Hypervisor-Protected Code Integrity with UEFI lock, 2 - Turns on Hypervisor-Protected Code Integrity without UEFI lock. @@ -71,7 +71,7 @@ Hypervisor-Protected Code Integrity: 0 - Turns off Hypervisor-Protected Code Int |:--|:--| | Name | VirtualizationBasedSecurity | | Friendly Name | Turn On Virtualization Based Security | -| Element Name | Virtualization Based Protection of Code Integrity | +| Element Name | Virtualization Based Protection of Code Integrity. | | Location | Computer Configuration | | Path | System > Device Guard | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeviceGuard | @@ -100,8 +100,8 @@ Hypervisor-Protected Code Integrity: 0 - Turns off Hypervisor-Protected Code Int - -Require UEFI Memory Attributes Table + +Require UEFI Memory Attributes Table. @@ -134,7 +134,7 @@ Require UEFI Memory Attributes Table |:--|:--| | Name | VirtualizationBasedSecurity | | Friendly Name | Turn On Virtualization Based Security | -| Element Name | Require UEFI Memory Attributes Table | +| Element Name | Require UEFI Memory Attributes Table. | | Location | Computer Configuration | | Path | System > Device Guard | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeviceGuard | diff --git a/windows/client-management/mdm/policy-csp-webthreatdefense.md b/windows/client-management/mdm/policy-csp-webthreatdefense.md index 2862cf0565..3f32d7c225 100644 --- a/windows/client-management/mdm/policy-csp-webthreatdefense.md +++ b/windows/client-management/mdm/policy-csp-webthreatdefense.md @@ -4,7 +4,7 @@ description: Learn more about the WebThreatDefense Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,9 @@ ms.topic: reference # Policy CSP - WebThreatDefense +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + > [!NOTE] diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index 62d4b45e2a..5eb3b2dd3e 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -4,7 +4,7 @@ description: Learn more about the Wifi Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -193,7 +193,7 @@ By default, ICS is disabled when you create a remote access connection, but admi -Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks. Most restricted value is 0 +Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks. Most restricted value is 0. > [!NOTE] > Setting this policy deletes any previously installed user-configured and Wi-Fi sense Wi-Fi profiles from the device. Certain Wi-Fi profiles that are not user configured nor Wi-Fi sense might not be deleted. In addition, not all non-MDM profiles are completely deleted. @@ -343,7 +343,7 @@ Allow WiFi Direct connection. . -Allow an enterprise to control the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected. Supported values are 0-500, where 100 = normal scan frequency and 500 = low scan frequency. The default value is 0. Supported operations are Add, Delete, Get, and Replace. +Allow an enterprise to control the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected. Supported values are 0-500, where 100 = normal scan frequency and 500 = low scan frequency. The default value is 0. diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index 020c169b11..bbe80dfd19 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -4,7 +4,7 @@ description: Learn more about the WindowsDefenderSecurityCenter Area in Policy C author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,9 +36,17 @@ ms.topic: reference - -The company name that is displayed to the users. CompanyName is required for both EnableCustomizedToasts and EnableInAppCustomization. -- If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display the contact options. Value type is string. Supported operations are Add, Get, Replace and Delete. + +Specify the company name that will be displayed in Windows Security and associated notifications. This setting must be enabled for any contact information to appear. + +Enabled: +Enter the company name in the Options section. + +Disabled: +Company information will not be shown at all in either Windows Security or any notifications that it creates. + +Not configured: +Same as Disabled. @@ -61,7 +69,7 @@ The company name that is displayed to the users. CompanyName is required for bot |:--|:--| | Name | EnterpriseCustomization_CompanyName | | Friendly Name | Specify contact company name | -| Element Name | Company name | +| Element Name | Company name. | | Location | Computer Configuration | | Path | Windows Components > Windows Security > Enterprise Customization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Enterprise Customization | @@ -956,9 +964,19 @@ Same as Disabled. - -The email address that is displayed to users. The default mail application is used to initiate email actions. -- If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options. Value type is string. Supported operations are Add, Get, Replace and Delete. + +Specify the email address or email ID that will be displayed in Windows Security and associated notifications. + +Users can click on the contact information to create an email that will be sent to the specified address. The default email application will be used. + +Enabled: +Enter the email address or email ID in the Options section. + +Disabled: +A contact email address or email ID will not be shown in either Windows Security or any notifications it creates. + +Not configured: +Same as Disabled. @@ -981,7 +999,7 @@ The email address that is displayed to users. The default mail application is us |:--|:--| | Name | EnterpriseCustomization_Email | | Friendly Name | Specify contact email address or Email ID | -| Element Name | Email address or email ID | +| Element Name | Email address or email ID. | | Location | Computer Configuration | | Path | Windows Components > Windows Security > Enterprise Customization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Enterprise Customization | @@ -1455,9 +1473,19 @@ Same as Disabled. - -The phone number or Skype ID that is displayed to users. Skype is used to initiate the call. -- If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options. Value type is string. Supported operations are Add, Get, Replace, and Delete. + +Specify the phone number or Skype ID that will be displayed in Windows Security and associated notifications. + +Users can click on the contact information to automatically call the supplied number. Skype will be used to initiate the call. + +Enabled: +Enter the phone number or Skype ID in the Options section. + +Disabled: +A contact phone number or Skype ID will not be shown in either Windows Security or any notifications it creates. + +Not configured: +Same as Disabled. @@ -1480,7 +1508,7 @@ The phone number or Skype ID that is displayed to users. Skype is used to initia |:--|:--| | Name | EnterpriseCustomization_Phone | | Friendly Name | Specify contact phone number or Skype ID | -| Element Name | Phone number or Skype ID | +| Element Name | Phone number or Skype ID. | | Location | Computer Configuration | | Path | Windows Components > Windows Security > Enterprise Customization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Enterprise Customization | @@ -1509,9 +1537,19 @@ The phone number or Skype ID that is displayed to users. Skype is used to initia - -The help portal URL this is displayed to users. The default browser is used to initiate this action. -- If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then the device will not display contact options. Value type is Value type is string. Supported operations are Add, Get, Replace, and Delete. + +Specify the URL that will be displayed in Windows Security and associated notifications. + +Users can click on the contact information to visit the specified website. The default web browser will be used. + +Enabled: +Enter the URL in the Options section. + +Disabled: +A contact website URL will not be shown in either Windows Security or any notifications it creates. + +Not configured: +Same as Disabled. @@ -1534,7 +1572,7 @@ The help portal URL this is displayed to users. The default browser is used to i |:--|:--| | Name | EnterpriseCustomization_URL | | Friendly Name | Specify contact website | -| Element Name | IT or support website | +| Element Name | IT or support website. | | Location | Computer Configuration | | Path | Windows Components > Windows Security > Enterprise Customization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Enterprise Customization | diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index c2a2419ae6..3b22eda9a0 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -4,7 +4,7 @@ description: Learn more about the WindowsInkWorkspace Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,7 +37,7 @@ ms.topic: reference -Allow suggested apps in Windows Ink Workspace +Allow suggested apps in Windows Ink Workspace. @@ -99,8 +99,8 @@ Allow suggested apps in Windows Ink Workspace - -Specifies whether to allow the user to access the ink workspace. + +Allow Windows Ink Workspace. @@ -134,7 +134,7 @@ Specifies whether to allow the user to access the ink workspace. |:--|:--| | Name | AllowWindowsInkWorkspace | | Friendly Name | Allow Windows Ink Workspace | -| Element Name | Choose one of the following actions | +| Element Name | Choose one of the following actions. | | Location | Computer Configuration | | Path | Windows Components > Windows Ink Workspace | | Registry Key Name | Software\Policies\Microsoft\WindowsInkWorkspace | diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index 51b6c8cc5e..3969e76da3 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -4,7 +4,7 @@ description: Learn more about the WindowsLogon Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -21,6 +21,9 @@ ms.topic: reference > > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + @@ -114,8 +117,8 @@ This policy setting controls the configuration under which an automatic restart 1. "Enabled if BitLocker is on and not suspended" specifies that automatic sign on and lock will only occur if BitLocker is active and not suspended during the reboot or shutdown. Personal data can be accessed on the device's hard drive at this time if BitLocker is not on or suspended during an update. BitLocker suspension temporarily removes protection for system components and data but may be needed in certain circumstances to successfully update boot-critical components. BitLocker is suspended during updates if: -- The device doesn't have TPM 2.0 and PCR7, or -- The device doesn't use a TPM-only protector + - The device doesn't have TPM 2.0 and PCR7, or + - The device doesn't use a TPM-only protector 2. "Always Enabled" specifies that automatic sign on will happen even if BitLocker is off or suspended during reboot or shutdown. When BitLocker is not enabled, personal data is accessible on the hard drive. Automatic restart and sign on should only be run under this condition if you are confident that the configured device is in a secure physical location. @@ -581,14 +584,7 @@ The locations that Switch User interface appear are in the Logon UI, the Start m -OverrideShellProgram policy allows IT admin to configure the shell program for Windows OS on a device. This policy has the highest precedence over other ways of configuring the shell program. - -The policy currently supports below options: - -1. Not Configured: Default shell will be launched. -2. Apply Lightweight Shell: Lightweight shell does not have a user interface and helps the device to achieve better performance as the shell consumes limited resources over default shell. Lightweight shell contains a limited set of features which could be consumed by applications. This configuration can be useful if the device needs to have a continuous running user interface application which would consume features offered by Lightweight shell. - -- If you disable or do not configure this policy setting, then the default shell will be launched. +OverrideShellProgram policy allows IT admin to configure the shell program for Windows OS on a device. This policy has the highest precedence over other ways of configuring the shell program. The policy currently supports below options: 1. Not Configured: Default shell will be launched. 2. Apply Lightweight Shell: Lightweight shell does not have a user interface and helps the device to achieve better performance as the shell consumes limited resources over default shell. Lightweight shell contains a limited set of features which could be consumed by applications. This configuration can be useful if the device needs to have a continuous running user interface application which would consume features offered by Lightweight shell. If you disable or do not configure this policy setting, then the default shell will be launched. diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md index 7547dce65b..982bf3c027 100644 --- a/windows/client-management/mdm/policy-csp-windowspowershell.md +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -4,7 +4,7 @@ description: Learn more about the WindowsPowerShell Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -47,6 +47,7 @@ ms.topic: reference This policy setting enables logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. + - If you enable this policy setting, Windows PowerShell will log the processing of commands, script blocks, functions, and scripts - whether invoked interactively, or through automation. diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md index c341176e4b..04eabb0246 100644 --- a/windows/client-management/mdm/reboot-csp.md +++ b/windows/client-management/mdm/reboot-csp.md @@ -4,7 +4,7 @@ description: Learn more about the Reboot CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -29,6 +29,7 @@ The following list shows the Reboot configuration service provider nodes: - [Schedule](#schedule) - [DailyRecurrent](#scheduledailyrecurrent) - [Single](#schedulesingle) + - [WeeklyRecurrent](#scheduleweeklyrecurrent) @@ -126,7 +127,7 @@ The supported operation is Get. -Value in ISO8601, time is required. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. +Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. @@ -187,6 +188,45 @@ Value in ISO8601, both the date and time are required. A reboot will be schedule + +### Schedule/WeeklyRecurrent + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Reboot/Schedule/WeeklyRecurrent +``` + + + + +Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled every week at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + diff --git a/windows/client-management/mdm/reboot-ddf-file.md b/windows/client-management/mdm/reboot-ddf-file.md index a1f1988804..98866efffa 100644 --- a/windows/client-management/mdm/reboot-ddf-file.md +++ b/windows/client-management/mdm/reboot-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/17/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -47,7 +47,7 @@ The following XML file contains the device description framework (DDF) for the R 10.0.14393 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD; @@ -129,7 +129,7 @@ The following XML file contains the device description framework (DDF) for the R - Value in ISO8601, time is required. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. + Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. @@ -147,6 +147,33 @@ The following XML file contains the device description framework (DDF) for the R + + WeeklyRecurrent + + + + + + + + Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled every week at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. + + + + + + + + + + WeeklyRecurrent + + + + + + + diff --git a/windows/client-management/mdm/rootcacertificates-csp.md b/windows/client-management/mdm/rootcacertificates-csp.md index 4375aed8a9..9cb2712daf 100644 --- a/windows/client-management/mdm/rootcacertificates-csp.md +++ b/windows/client-management/mdm/rootcacertificates-csp.md @@ -4,7 +4,7 @@ description: Learn more about the RootCATrustedCertificates CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -125,7 +125,7 @@ The following list shows the RootCATrustedCertificates configuration service pro | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -164,7 +164,7 @@ Node for CA certificates. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -204,7 +204,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -243,7 +243,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -282,7 +282,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -321,7 +321,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -360,7 +360,7 @@ Returns the certificate template name. Supported operation is Get. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -399,7 +399,7 @@ Returns the starting date of the certificate's validity. Supported operation is | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -438,7 +438,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -477,7 +477,7 @@ Node for OEM eSIM certificates. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -517,7 +517,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -556,7 +556,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -595,7 +595,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -634,7 +634,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -673,7 +673,7 @@ Returns the certificate template name. Supported operation is Get. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -712,7 +712,7 @@ Returns the starting date of the certificate's validity. Supported operation is | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -751,7 +751,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -790,7 +790,7 @@ Defines the certificate store that contains root, or self-signed certificates, i | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -829,7 +829,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -869,7 +869,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -908,7 +908,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -947,7 +947,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -986,7 +986,7 @@ Returns the certificate template name. Supported operation is Get. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1025,7 +1025,7 @@ Returns the starting date of the certificate's validity. Supported operation is | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1064,7 +1064,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1103,7 +1103,7 @@ Node for trusted people certificates. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1143,7 +1143,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1182,7 +1182,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1221,7 +1221,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1260,7 +1260,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1299,7 +1299,7 @@ Returns the certificate template name. Supported operation is Get. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1338,7 +1338,7 @@ Returns the starting date of the certificate's validity. Supported operation is | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1377,7 +1377,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1416,7 +1416,7 @@ Node for trusted publisher certificates. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1456,7 +1456,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1495,7 +1495,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1534,7 +1534,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1573,7 +1573,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1612,7 +1612,7 @@ Returns the certificate template name. Supported operation is Get. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1651,7 +1651,7 @@ Returns the starting date of the certificate's validity. Supported operation is | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | @@ -1690,7 +1690,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | @@ -1729,7 +1729,7 @@ Node for certificates that are not trusted. IT admin can use this node to immedi | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | @@ -1769,7 +1769,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | @@ -1808,7 +1808,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | @@ -1847,7 +1847,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | @@ -1886,7 +1886,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | @@ -1925,7 +1925,7 @@ Returns the certificate template name. Supported operation is Get. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | @@ -1964,7 +1964,7 @@ Returns the starting date of the certificate's validity. Supported operation is | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md index d12b3ffc21..f6ea73293b 100644 --- a/windows/client-management/mdm/rootcacertificates-ddf-file.md +++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/24/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -1071,11 +1071,6 @@ The following XML file contains the device description framework (DDF) for the R - - 10.0.10586 - 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD; - Root diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md index e77c419631..7594de5981 100644 --- a/windows/client-management/mdm/supl-csp.md +++ b/windows/client-management/mdm/supl-csp.md @@ -4,7 +4,7 @@ description: Learn more about the SUPL CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -336,7 +336,7 @@ Optional. Determines the full version (X. Y. Z where X, Y and Z are major versio -Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows Phones provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. +Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. @@ -540,7 +540,7 @@ Optional. Time in seconds that the network-initiated location request is display -Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. +Required. Specifies the root certificate for the H-SLP server. Windows does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. @@ -1568,7 +1568,7 @@ Optional. The address of the Position Determination Entity (PDE), in the format -Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows Phones provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. +Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index 07296eebc3..af93e84137 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -245,7 +245,7 @@ The following XML file contains the device description framework (DDF) for the S 0 - Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows Phones provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. + Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. @@ -375,7 +375,7 @@ The following XML file contains the device description framework (DDF) for the S - Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. + Required. Specifies the root certificate for the H-SLP server. Windows does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. @@ -874,7 +874,7 @@ The following XML file contains the device description framework (DDF) for the S 0 - Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows Phones provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. + Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. From 432aedbdf30d4afb552eb6cea237388ad698a024 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 23 Mar 2023 14:11:42 -0400 Subject: [PATCH 07/26] Fix issue 11377 --- windows/client-management/mdm/applicationcontrol-csp.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md index 8e4b0ab2da..f500aff927 100644 --- a/windows/client-management/mdm/applicationcontrol-csp.md +++ b/windows/client-management/mdm/applicationcontrol-csp.md @@ -946,9 +946,9 @@ The ApplicationControl CSP can also be managed locally from PowerShell or via Co 3. Use WMI Interface: ```powershell - $namespace = "root\cimv2\mdm\dmmap" - $policyClassName = "MDM_AppControl_Policies" - $policyBase64 = … + $namespace = "root\cimv2\mdm\dmmap" + $policyClassName = "MDM_ApplicationControl_Policies01_01" + $policyBase64 = "" ``` ### Deploying a policy via WMI Bridge From deb3f68bedb7f3404fc01e393a7f20c01b525ee6 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 23 Mar 2023 16:39:25 -0400 Subject: [PATCH 08/26] Minor updates --- ...icy-csp-admx-microsoftdefenderantivirus.md | 2 +- .../mdm/policy-csp-defender.md | 4 +- .../mdm/rootcacertificates-csp.md | 96 +++++++++---------- .../mdm/rootcacertificates-ddf-file.md | 5 + 4 files changed, 56 insertions(+), 51 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md index 4e89010233..07eef1894d 100644 --- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -724,7 +724,7 @@ After enabling this setting, you can set each rule to the following in the Optio - Not Configured: the rule is enabled with default values - Warn: the rule will be applied and the end-user will have the option to bypass the block -Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules will the value of not configured. +Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules with the value of not configured. Enabled: Specify the state for each ASR rule under the Options section for this setting. diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index d7e2211264..2f84f6c62c 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -955,7 +955,7 @@ After enabling this setting, you can set each rule to the following in the Optio - Not Configured: the rule is enabled with default values - Warn: the rule will be applied and the end-user will have the option to bypass the block -Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules will the value of not configured. +Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules with the value of not configured. Enabled: Specify the state for each ASR rule under the Options section for this setting. @@ -2206,7 +2206,7 @@ This policy setting allows you to specify the scan type to use during a schedule - If you enable this setting, the scan type will be set to the specified value. -- If you disable or do not configure this setting, the default scan type will used. +- If you disable or do not configure this setting, the default scan type will be used. diff --git a/windows/client-management/mdm/rootcacertificates-csp.md b/windows/client-management/mdm/rootcacertificates-csp.md index 9cb2712daf..9da01ea478 100644 --- a/windows/client-management/mdm/rootcacertificates-csp.md +++ b/windows/client-management/mdm/rootcacertificates-csp.md @@ -125,7 +125,7 @@ The following list shows the RootCATrustedCertificates configuration service pro | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -164,7 +164,7 @@ Node for CA certificates. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -204,7 +204,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -243,7 +243,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -282,7 +282,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -321,7 +321,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -360,7 +360,7 @@ Returns the certificate template name. Supported operation is Get. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -399,7 +399,7 @@ Returns the starting date of the certificate's validity. Supported operation is | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -438,7 +438,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -477,7 +477,7 @@ Node for OEM eSIM certificates. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -517,7 +517,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -556,7 +556,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -595,7 +595,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -634,7 +634,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -673,7 +673,7 @@ Returns the certificate template name. Supported operation is Get. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -712,7 +712,7 @@ Returns the starting date of the certificate's validity. Supported operation is | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -751,7 +751,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -790,7 +790,7 @@ Defines the certificate store that contains root, or self-signed certificates, i | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -829,7 +829,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -869,7 +869,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -908,7 +908,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -947,7 +947,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -986,7 +986,7 @@ Returns the certificate template name. Supported operation is Get. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1025,7 +1025,7 @@ Returns the starting date of the certificate's validity. Supported operation is | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1064,7 +1064,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1103,7 +1103,7 @@ Node for trusted people certificates. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1143,7 +1143,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1182,7 +1182,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1221,7 +1221,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1260,7 +1260,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1299,7 +1299,7 @@ Returns the certificate template name. Supported operation is Get. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1338,7 +1338,7 @@ Returns the starting date of the certificate's validity. Supported operation is | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1377,7 +1377,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1416,7 +1416,7 @@ Node for trusted publisher certificates. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1456,7 +1456,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1495,7 +1495,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1534,7 +1534,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1573,7 +1573,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1612,7 +1612,7 @@ Returns the certificate template name. Supported operation is Get. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1651,7 +1651,7 @@ Returns the starting date of the certificate's validity. Supported operation is | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | @@ -1690,7 +1690,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | @@ -1729,7 +1729,7 @@ Node for certificates that are not trusted. IT admin can use this node to immedi | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | @@ -1769,7 +1769,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | @@ -1808,7 +1808,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | @@ -1847,7 +1847,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | @@ -1886,7 +1886,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | @@ -1925,7 +1925,7 @@ Returns the certificate template name. Supported operation is Get. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | @@ -1964,7 +1964,7 @@ Returns the starting date of the certificate's validity. Supported operation is | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md index f6ea73293b..14712bc288 100644 --- a/windows/client-management/mdm/rootcacertificates-ddf-file.md +++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md @@ -1071,6 +1071,11 @@ The following XML file contains the device description framework (DDF) for the R + + 10.0.10586 + 1.0 + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD; + Root From 480beb22a2a2e02f4b8a1624f4fe7fff462ad7a8 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 24 Mar 2023 12:24:29 -0400 Subject: [PATCH 09/26] Change Surface Hub to Windows 10 Team --- .../policies-in-policy-csp-supported-by-surface-hub.md | 10 +++++----- windows/client-management/mdm/surfacehub-csp.md | 2 +- windows/client-management/mdm/surfacehub-ddf-file.md | 2 +- windows/client-management/mdm/toc.yml | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md index f0100f698a..532725ac33 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -1,10 +1,10 @@ --- -title: Policies in Policy CSP supported by Surface Hub -description: Learn about the policies in Policy CSP supported by Surface Hub. +title: Policies in Policy CSP supported by Windows 10 Team +description: Learn about the policies in Policy CSP supported by Windows 10 Team. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 03/23/2023 +ms.date: 03/24/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -13,9 +13,9 @@ ms.topic: reference -# Policies in Policy CSP supported by Surface Hub +# Policies in Policy CSP supported by Windows 10 Team -This article lists the policies in Policy CSP that are applicable for Surface Hub. +This article lists the policies in Policy CSP that are applicable for Windows 10 Team. ## Accounts diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index c16d7da169..87ba8d39de 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -4,7 +4,7 @@ description: Learn more about the SurfaceHub CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 03/17/2023 +ms.date: 03/24/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage diff --git a/windows/client-management/mdm/surfacehub-ddf-file.md b/windows/client-management/mdm/surfacehub-ddf-file.md index 0f0117489c..16e2b4acd8 100644 --- a/windows/client-management/mdm/surfacehub-ddf-file.md +++ b/windows/client-management/mdm/surfacehub-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/24/2023 +ms.date: 03/24/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index bded40d8ed..4b7a21cdcd 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -49,7 +49,7 @@ items: href: policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md - name: Policies supported by Windows 10 IoT Core href: policies-in-policy-csp-supported-by-iot-core.md - - name: Policies supported by Microsoft Surface Hub + - name: Policies supported by Microsoft Windows 10 Team href: policies-in-policy-csp-supported-by-surface-hub.md - name: Policies that can be set using Exchange Active Sync (EAS) href: policies-in-policy-csp-that-can-be-set-using-eas.md From 30329054f8bad4b7bc9c12049d9185ddb252e103 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 27 Mar 2023 15:19:01 -0400 Subject: [PATCH 10/26] Mo Updates --- windows/client-management/mdm/laps-csp.md | 4 +- ...-in-policy-csp-supported-by-surface-hub.md | 6 +-- .../mdm/policy-csp-admx-smartcard.md | 4 +- .../mdm/policy-csp-browser.md | 4 +- .../mdm/policy-csp-defender.md | 9 +---- .../client-management/mdm/surfacehub-csp.md | 40 +++++++++---------- windows/client-management/mdm/toc.yml | 2 +- 7 files changed, 30 insertions(+), 39 deletions(-) diff --git a/windows/client-management/mdm/laps-csp.md b/windows/client-management/mdm/laps-csp.md index f846a1bb50..b5c76b1b14 100644 --- a/windows/client-management/mdm/laps-csp.md +++ b/windows/client-management/mdm/laps-csp.md @@ -4,7 +4,7 @@ description: Learn more about the LAPS CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/27/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -746,7 +746,7 @@ If not specified, this setting will default to 3 (Reset the password and logoff | Value | Description | |:--|:--| | 1 | Reset password: upon expiry of the grace period, the managed account password will be reset. | -| 3 (Default) | Reset the password and logoff the managed account: upon expiry of the grace period, the managed account password will be reset and any interactive logon sessions using the managed account will be terminated. | +| 3 (Default) | Reset the password and logoff the managed account: upon expiry of the grace period, the managed account password will be reset and any interactive logon sessions using the managed account will terminated. | | 5 | Reset the password and reboot: upon expiry of the grace period, the managed account password will be reset and the managed device will be immediately rebooted. | diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md index 532725ac33..4c67e36e15 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -15,11 +15,7 @@ ms.topic: reference # Policies in Policy CSP supported by Windows 10 Team -This article lists the policies in Policy CSP that are applicable for Windows 10 Team. - -## Accounts - -- [AllowMicrosoftAccountConnection](policy-csp-accounts.md#allowmicrosoftaccountconnection) +This article lists the policies in Policy CSP that are applicable for the Surface Hub operating system, **Windows 10 Team**. ## ApplicationDefaults diff --git a/windows/client-management/mdm/policy-csp-admx-smartcard.md b/windows/client-management/mdm/policy-csp-admx-smartcard.md index 66b14b8c2f..9f8cd9d3d9 100644 --- a/windows/client-management/mdm/policy-csp-admx-smartcard.md +++ b/windows/client-management/mdm/policy-csp-admx-smartcard.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Smartcard Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 03/23/2023 +ms.date: 03/27/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -798,7 +798,7 @@ By default the user principal name (UPN) is displayed in addition to the common If you enable this policy setting or do not configure this setting, then the subject name will be reversed. -If you disable, the subject name will be displayed as it appears in the certificate. +If you disable , the subject name will be displayed as it appears in the certificate. diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 7dc55c850b..821501520e 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -4,7 +4,7 @@ description: Learn more about the Browser Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 03/23/2023 +ms.date: 03/27/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -2901,7 +2901,7 @@ Don't enable both this setting and the Keep favorites in sync between Internet E -This policy settings lets you decide whether employees can access the about:flags page, which is used to change developer settings and to enable experimental features. +This policy setting lets you decide whether employees can access the about:flags page, which is used to change developer settings and to enable experimental features. - If you enable this policy setting, employees can't access the about:flags page. diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 2f84f6c62c..99bd8a5bcc 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -4,7 +4,7 @@ description: Learn more about the Defender Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 03/23/2023 +ms.date: 03/27/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -697,12 +697,7 @@ Allows or disallows Windows Defender Realtime Monitoring functionality. - -This policy setting allows you to configure scanning for network files. It is recommended that you do not enable this setting. - -- If you enable this setting, network files will be scanned. - -- If you disable or do not configure this setting, network files will not be scanned. + diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index 87ba8d39de..46e9609e96 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -4,7 +4,7 @@ description: Learn more about the SurfaceHub CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 03/24/2023 +ms.date: 03/27/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,7 +36,7 @@ The following list shows the SurfaceHub configuration service provider nodes: - [ExchangeModernAuthEnabled](#deviceaccountexchangemodernauthenabled) - [ExchangeServer](#deviceaccountexchangeserver) - [Password](#deviceaccountpassword) - - [PasswordRotationPeriod](#deviceaccountpasswordrotationperiod) + - [PasswordRotationEnabled](#deviceaccountpasswordrotationenabled) - [SipAddress](#deviceaccountsipaddress) - [UserName](#deviceaccountusername) - [UserPrincipalName](#deviceaccountuserprincipalname) @@ -482,53 +482,53 @@ Password for the device account. Get is allowed here, but will always return a b - -### DeviceAccount/PasswordRotationPeriod + +### DeviceAccount/PasswordRotationEnabled - + | Scope | Editions | Applicable OS | |:--|:--|:--| | :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | - + - + ```Device -./Vendor/MSFT/SurfaceHub/DeviceAccount/PasswordRotationPeriod +./Vendor/MSFT/SurfaceHub/DeviceAccount/PasswordRotationEnabled ``` - + - + Specifies whether automatic password rotation is enabled. If you enforce a password expiration policy on the device account, use this setting to allow the device to manage its own password by changing it frequently, without requiring you to manually update the account information when the password expires. You can reset the password at any time using Active Directory (or Azure AD). - + - + - + - + **Description framework properties**: | Property name | Property value | |:--|:--| | Format | int | | Access Type | Get, Replace | - + - + **Allowed values**: | Value | Description | |:--|:--| | 0 | Password rotation enabled. | | 1 | Disabled. | - + - + - + - + ### DeviceAccount/SipAddress diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 4b7a21cdcd..e4247312ed 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -49,7 +49,7 @@ items: href: policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md - name: Policies supported by Windows 10 IoT Core href: policies-in-policy-csp-supported-by-iot-core.md - - name: Policies supported by Microsoft Windows 10 Team + - name: Policies supported by Windows 10 Team href: policies-in-policy-csp-supported-by-surface-hub.md - name: Policies that can be set using Exchange Active Sync (EAS) href: policies-in-policy-csp-that-can-be-set-using-eas.md From 750b34aa2e02d55c50e75d7e65454cddebc357de Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 27 Mar 2023 16:30:51 -0400 Subject: [PATCH 11/26] Add override for AllowScanningNetworkFiles --- windows/client-management/mdm/policy-csp-defender.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 99bd8a5bcc..1f26de308e 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -702,6 +702,10 @@ Allows or disallows Windows Defender Realtime Monitoring functionality. +This policy setting allows you to configure real-time scanning for files that are accessed over the network. It is recommended to enable this setting. + +- If you enable this setting or do not configure this setting, network files will be scanned. +- If you disable this setting, network files will not be scanned. From 01014008b35c07dad4719a985f7a178acb6e4fcf Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 28 Mar 2023 17:28:03 -0400 Subject: [PATCH 12/26] Update Surface Hub applicability --- ...-in-policy-csp-supported-by-surface-hub.md | 152 +----------------- 1 file changed, 1 insertion(+), 151 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md index 4c67e36e15..49bdb3e952 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Windows 10 Team author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 03/24/2023 +ms.date: 03/28/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -26,15 +26,6 @@ This article lists the policies in Policy CSP that are applicable for the Surfac - [AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#allowappstoreautoupdate) - [AllowDeveloperUnlock](policy-csp-applicationmanagement.md#allowdeveloperunlock) -## Authentication - -- [AllowAadPasswordReset](policy-csp-authentication.md#allowaadpasswordreset) -- [AllowEAPCertSSO](policy-csp-authentication.md#alloweapcertsso) -- [AllowFastReconnect](policy-csp-authentication.md#allowfastreconnect) -- [AllowSecondaryAuthenticationDevice](policy-csp-authentication.md#allowsecondaryauthenticationdevice) -- [EnableFastFirstSignIn](policy-csp-authentication.md#enablefastfirstsignin) -- [EnableWebSignIn](policy-csp-authentication.md#enablewebsignin) - ## Bluetooth - [AllowAdvertising](policy-csp-bluetooth.md#allowadvertising) @@ -48,48 +39,26 @@ This article lists the policies in Policy CSP that are applicable for the Surfac ## Browser - [AllowAddressBarDropdown](policy-csp-browser.md#allowaddressbardropdown) -- [AllowAddressBarDropdown](policy-csp-browser.md#allowaddressbardropdown) -- [AllowAutofill](policy-csp-browser.md#allowautofill) - [AllowAutofill](policy-csp-browser.md#allowautofill) - [AllowBrowser](policy-csp-browser.md#allowbrowser) -- [AllowBrowser](policy-csp-browser.md#allowbrowser) -- [AllowCookies](policy-csp-browser.md#allowcookies) - [AllowCookies](policy-csp-browser.md#allowcookies) - [AllowDeveloperTools](policy-csp-browser.md#allowdevelopertools) -- [AllowDeveloperTools](policy-csp-browser.md#allowdevelopertools) -- [AllowDoNotTrack](policy-csp-browser.md#allowdonottrack) - [AllowDoNotTrack](policy-csp-browser.md#allowdonottrack) - [AllowFlashClickToRun](policy-csp-browser.md#allowflashclicktorun) -- [AllowFlashClickToRun](policy-csp-browser.md#allowflashclicktorun) -- [AllowMicrosoftCompatibilityList](policy-csp-browser.md#allowmicrosoftcompatibilitylist) - [AllowMicrosoftCompatibilityList](policy-csp-browser.md#allowmicrosoftcompatibilitylist) - [AllowPasswordManager](policy-csp-browser.md#allowpasswordmanager) -- [AllowPasswordManager](policy-csp-browser.md#allowpasswordmanager) -- [AllowPopups](policy-csp-browser.md#allowpopups) - [AllowPopups](policy-csp-browser.md#allowpopups) - [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#allowsearchsuggestionsinaddressbar) -- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#allowsearchsuggestionsinaddressbar) -- [AllowSmartScreen](policy-csp-browser.md#allowsmartscreen) - [AllowSmartScreen](policy-csp-browser.md#allowsmartscreen) - [ClearBrowsingDataOnExit](policy-csp-browser.md#clearbrowsingdataonexit) -- [ClearBrowsingDataOnExit](policy-csp-browser.md#clearbrowsingdataonexit) -- [ConfigureAdditionalSearchEngines](policy-csp-browser.md#configureadditionalsearchengines) - [ConfigureAdditionalSearchEngines](policy-csp-browser.md#configureadditionalsearchengines) - [DisableLockdownOfStartPages](policy-csp-browser.md#disablelockdownofstartpages) -- [DisableLockdownOfStartPages](policy-csp-browser.md#disablelockdownofstartpages) -- [EnterpriseModeSiteList](policy-csp-browser.md#enterprisemodesitelist) - [EnterpriseModeSiteList](policy-csp-browser.md#enterprisemodesitelist) - [HomePages](policy-csp-browser.md#homepages) -- [HomePages](policy-csp-browser.md#homepages) -- [PreventLiveTileDataCollection](policy-csp-browser.md#preventlivetiledatacollection) - [PreventLiveTileDataCollection](policy-csp-browser.md#preventlivetiledatacollection) - [PreventSmartScreenPromptOverride](policy-csp-browser.md#preventsmartscreenpromptoverride) -- [PreventSmartScreenPromptOverride](policy-csp-browser.md#preventsmartscreenpromptoverride) -- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md#preventsmartscreenpromptoverrideforfiles) - [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md#preventsmartscreenpromptoverrideforfiles) - [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md#preventusinglocalhostipaddressforwebrtc) -- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md#preventusinglocalhostipaddressforwebrtc) -- [SetDefaultSearchEngine](policy-csp-browser.md#setdefaultsearchengine) - [SetDefaultSearchEngine](policy-csp-browser.md#setdefaultsearchengine) ## Camera @@ -120,7 +89,6 @@ This article lists the policies in Policy CSP that are applicable for the Surfac - [AllowRealtimeMonitoring](policy-csp-defender.md#allowrealtimemonitoring) - [AllowScanningNetworkFiles](policy-csp-defender.md#allowscanningnetworkfiles) - [AllowScriptScanning](policy-csp-defender.md#allowscriptscanning) -- [AllowUserUIAccess](policy-csp-defender.md#allowuseruiaccess) - [AttackSurfaceReductionOnlyExclusions](policy-csp-defender.md#attacksurfacereductiononlyexclusions) - [AttackSurfaceReductionRules](policy-csp-defender.md#attacksurfacereductionrules) - [AvgCPULoadFactor](policy-csp-defender.md#avgcpuloadfactor) @@ -183,10 +151,6 @@ This article lists the policies in Policy CSP that are applicable for the Surfac - [DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitforegrounddownloadbandwidth) - [DOVpnKeywords](policy-csp-deliveryoptimization.md#dovpnkeywords) -## Experience - -- [DoNotShowFeedbackNotifications](policy-csp-experience.md#donotshowfeedbacknotifications) - ## ExploitGuard - [ExploitProtectionSettings](policy-csp-exploitguard.md#exploitprotectionsettings) @@ -287,74 +251,13 @@ This article lists the policies in Policy CSP that are applicable for the Surfac ## Security -- [RecoveryEnvironmentAuthentication](policy-csp-security.md#recoveryenvironmentauthentication) - [RecoveryEnvironmentAuthentication](policy-csp-security.md#recoveryenvironmentauthentication) - [RequireProvisioningPackageSignature](policy-csp-security.md#requireprovisioningpackagesignature) - [RequireRetrieveHealthCertificateOnBoot](policy-csp-security.md#requireretrievehealthcertificateonboot) -## Settings - -- [ConfigureTaskbarCalendar](policy-csp-settings.md#configuretaskbarcalendar) - ## Start -- [AllowPinnedFolderDocuments](policy-csp-start.md#allowpinnedfolderdocuments) -- [AllowPinnedFolderDownloads](policy-csp-start.md#allowpinnedfolderdownloads) -- [AllowPinnedFolderFileExplorer](policy-csp-start.md#allowpinnedfolderfileexplorer) -- [AllowPinnedFolderHomeGroup](policy-csp-start.md#allowpinnedfolderhomegroup) -- [AllowPinnedFolderMusic](policy-csp-start.md#allowpinnedfoldermusic) -- [AllowPinnedFolderNetwork](policy-csp-start.md#allowpinnedfoldernetwork) -- [AllowPinnedFolderPersonalFolder](policy-csp-start.md#allowpinnedfolderpersonalfolder) -- [AllowPinnedFolderPictures](policy-csp-start.md#allowpinnedfolderpictures) -- [AllowPinnedFolderSettings](policy-csp-start.md#allowpinnedfoldersettings) -- [AllowPinnedFolderVideos](policy-csp-start.md#allowpinnedfoldervideos) -- [ConfigureStartPins](policy-csp-start.md#configurestartpins) -- [ConfigureStartPins](policy-csp-start.md#configurestartpins) -- [DisableContextMenus](policy-csp-start.md#disablecontextmenus) -- [DisableContextMenus](policy-csp-start.md#disablecontextmenus) -- [DisableControlCenter](policy-csp-start.md#disablecontrolcenter) -- [DisableEditingQuickSettings](policy-csp-start.md#disableeditingquicksettings) -- [ForceStartSize](policy-csp-start.md#forcestartsize) -- [ForceStartSize](policy-csp-start.md#forcestartsize) -- [HideAppList](policy-csp-start.md#hideapplist) -- [HideAppList](policy-csp-start.md#hideapplist) -- [HideChangeAccountSettings](policy-csp-start.md#hidechangeaccountsettings) -- [HideFrequentlyUsedApps](policy-csp-start.md#hidefrequentlyusedapps) -- [HideFrequentlyUsedApps](policy-csp-start.md#hidefrequentlyusedapps) -- [HideHibernate](policy-csp-start.md#hidehibernate) -- [HideLock](policy-csp-start.md#hidelock) -- [HidePeopleBar](policy-csp-start.md#hidepeoplebar) -- [HidePowerButton](policy-csp-start.md#hidepowerbutton) -- [HideRecentJumplists](policy-csp-start.md#hiderecentjumplists) -- [HideRecentJumplists](policy-csp-start.md#hiderecentjumplists) -- [HideRecentlyAddedApps](policy-csp-start.md#hiderecentlyaddedapps) -- [HideRecentlyAddedApps](policy-csp-start.md#hiderecentlyaddedapps) -- [HideRecommendedSection](policy-csp-start.md#hiderecommendedsection) -- [HideRecommendedSection](policy-csp-start.md#hiderecommendedsection) -- [HideRecoPersonalizedSites](policy-csp-start.md#hiderecopersonalizedsites) -- [HideRecoPersonalizedSites](policy-csp-start.md#hiderecopersonalizedsites) -- [HideRestart](policy-csp-start.md#hiderestart) -- [HideShutDown](policy-csp-start.md#hideshutdown) -- [HideSignOut](policy-csp-start.md#hidesignout) -- [HideSleep](policy-csp-start.md#hidesleep) -- [HideSwitchAccount](policy-csp-start.md#hideswitchaccount) -- [HideTaskViewButton](policy-csp-start.md#hidetaskviewbutton) -- [HideTaskViewButton](policy-csp-start.md#hidetaskviewbutton) -- [HideUserTile](policy-csp-start.md#hideusertile) -- [ImportEdgeAssets](policy-csp-start.md#importedgeassets) -- [NoPinningToTaskbar](policy-csp-start.md#nopinningtotaskbar) -- [ShowOrHideMostUsedApps](policy-csp-start.md#showorhidemostusedapps) -- [ShowOrHideMostUsedApps](policy-csp-start.md#showorhidemostusedapps) -- [SimplifyQuickSettings](policy-csp-start.md#simplifyquicksettings) - [StartLayout](policy-csp-start.md#startlayout) -- [StartLayout](policy-csp-start.md#startlayout) - -## Storage - -- [WPDDevicesDenyReadAccessPerDevice](policy-csp-storage.md#wpddevicesdenyreadaccessperdevice) -- [WPDDevicesDenyReadAccessPerUser](policy-csp-storage.md#wpddevicesdenyreadaccessperuser) -- [WPDDevicesDenyWriteAccessPerDevice](policy-csp-storage.md#wpddevicesdenywriteaccessperdevice) -- [WPDDevicesDenyWriteAccessPerUser](policy-csp-storage.md#wpddevicesdenywriteaccessperuser) ## System @@ -364,7 +267,6 @@ This article lists the policies in Policy CSP that are applicable for the Surfac - [AllowLocation](policy-csp-system.md#allowlocation) - [AllowStorageCard](policy-csp-system.md#allowstoragecard) - [AllowTelemetry](policy-csp-system.md#allowtelemetry) -- [AllowTelemetry](policy-csp-system.md#allowtelemetry) ## TextInput @@ -412,19 +314,7 @@ This article lists the policies in Policy CSP that are applicable for the Surfac - [AllowNonMicrosoftSignedUpdate](policy-csp-update.md#allownonmicrosoftsignedupdate) - [AllowTemporaryEnterpriseFeatureControl](policy-csp-update.md#allowtemporaryenterprisefeaturecontrol) - [AllowUpdateService](policy-csp-update.md#allowupdateservice) -- [AutomaticMaintenanceWakeUp](policy-csp-update.md#automaticmaintenancewakeup) -- [AutoRestartDeadlinePeriodInDays](policy-csp-update.md#autorestartdeadlineperiodindays) -- [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](policy-csp-update.md#autorestartdeadlineperiodindaysforfeatureupdates) -- [AutoRestartNotificationSchedule](policy-csp-update.md#autorestartnotificationschedule) -- [AutoRestartRequiredNotificationDismissal](policy-csp-update.md#autorestartrequirednotificationdismissal) - [BranchReadinessLevel](policy-csp-update.md#branchreadinesslevel) -- [ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#configuredeadlineforfeatureupdates) -- [ConfigureDeadlineForQualityUpdates](policy-csp-update.md#configuredeadlineforqualityupdates) -- [ConfigureDeadlineGracePeriod](policy-csp-update.md#configuredeadlinegraceperiod) -- [ConfigureDeadlineGracePeriodForFeatureUpdates](policy-csp-update.md#configuredeadlinegraceperiodforfeatureupdates) -- [ConfigureDeadlineNoAutoReboot](policy-csp-update.md#configuredeadlinenoautoreboot) -- [ConfigureDeadlineNoAutoRebootForFeatureUpdates](policy-csp-update.md#configuredeadlinenoautorebootforfeatureupdates) -- [ConfigureDeadlineNoAutoRebootForQualityUpdates](policy-csp-update.md#configuredeadlinenoautorebootforqualityupdates) - [ConfigureFeatureUpdateUninstallPeriod](policy-csp-update.md#configurefeatureupdateuninstallperiod) - [DeferFeatureUpdatesPeriodInDays](policy-csp-update.md#deferfeatureupdatesperiodindays) - [DeferQualityUpdatesPeriodInDays](policy-csp-update.md#deferqualityupdatesperiodindays) @@ -436,23 +326,16 @@ This article lists the policies in Policy CSP that are applicable for the Surfac - [DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection](policy-csp-update.md#donotenforceenterprisetlscertpinningforupdatedetection) - [EngagedRestartDeadline](policy-csp-update.md#engagedrestartdeadline) - [EngagedRestartDeadlineForFeatureUpdates](policy-csp-update.md#engagedrestartdeadlineforfeatureupdates) -- [EngagedRestartSnoozeSchedule](policy-csp-update.md#engagedrestartsnoozeschedule) -- [EngagedRestartSnoozeScheduleForFeatureUpdates](policy-csp-update.md#engagedrestartsnoozescheduleforfeatureupdates) -- [EngagedRestartTransitionSchedule](policy-csp-update.md#engagedrestarttransitionschedule) -- [EngagedRestartTransitionScheduleForFeatureUpdates](policy-csp-update.md#engagedrestarttransitionscheduleforfeatureupdates) - [ExcludeWUDriversInQualityUpdate](policy-csp-update.md#excludewudriversinqualityupdate) - [FillEmptyContentUrls](policy-csp-update.md#fillemptycontenturls) - [IgnoreMOAppDownloadLimit](policy-csp-update.md#ignoremoappdownloadlimit) - [IgnoreMOUpdateDownloadLimit](policy-csp-update.md#ignoremoupdatedownloadlimit) - [ManagePreviewBuilds](policy-csp-update.md#managepreviewbuilds) -- [NoUpdateNotificationsDuringActiveHours](policy-csp-update.md#noupdatenotificationsduringactivehours) - [PauseDeferrals](policy-csp-update.md#pausedeferrals) - [PauseFeatureUpdates](policy-csp-update.md#pausefeatureupdates) - [PauseFeatureUpdatesStartTime](policy-csp-update.md#pausefeatureupdatesstarttime) - [PauseQualityUpdates](policy-csp-update.md#pausequalityupdates) - [PauseQualityUpdatesStartTime](policy-csp-update.md#pausequalityupdatesstarttime) -- [PhoneUpdateRestrictions](policy-csp-update.md#phoneupdaterestrictions) -- [ProductVersion](policy-csp-update.md#productversion) - [RequireDeferUpgrade](policy-csp-update.md#requiredeferupgrade) - [RequireUpdateApproval](policy-csp-update.md#requireupdateapproval) - [ScheduledInstallDay](policy-csp-update.md#scheduledinstallday) @@ -462,19 +345,11 @@ This article lists the policies in Policy CSP that are applicable for the Surfac - [ScheduledInstallSecondWeek](policy-csp-update.md#scheduledinstallsecondweek) - [ScheduledInstallThirdWeek](policy-csp-update.md#scheduledinstallthirdweek) - [ScheduledInstallTime](policy-csp-update.md#scheduledinstalltime) -- [ScheduleImminentRestartWarning](policy-csp-update.md#scheduleimminentrestartwarning) -- [ScheduleRestartWarning](policy-csp-update.md#schedulerestartwarning) -- [SetAutoRestartNotificationDisable](policy-csp-update.md#setautorestartnotificationdisable) -- [SetDisablePauseUXAccess](policy-csp-update.md#setdisablepauseuxaccess) -- [SetDisableUXWUAccess](policy-csp-update.md#setdisableuxwuaccess) -- [SetEDURestart](policy-csp-update.md#setedurestart) - [SetPolicyDrivenUpdateSourceForDriverUpdates](policy-csp-update.md#setpolicydrivenupdatesourcefordriverupdates) - [SetPolicyDrivenUpdateSourceForFeatureUpdates](policy-csp-update.md#setpolicydrivenupdatesourceforfeatureupdates) - [SetPolicyDrivenUpdateSourceForOtherUpdates](policy-csp-update.md#setpolicydrivenupdatesourceforotherupdates) - [SetPolicyDrivenUpdateSourceForQualityUpdates](policy-csp-update.md#setpolicydrivenupdatesourceforqualityupdates) - [SetProxyBehaviorForUpdateDetection](policy-csp-update.md#setproxybehaviorforupdatedetection) -- [TargetReleaseVersion](policy-csp-update.md#targetreleaseversion) -- [UpdateNotificationLevel](policy-csp-update.md#updatenotificationlevel) - [UpdateServiceUrl](policy-csp-update.md#updateserviceurl) - [UpdateServiceUrlAlternate](policy-csp-update.md#updateserviceurlalternate) @@ -486,31 +361,6 @@ This article lists the policies in Policy CSP that are applicable for the Surfac - [AllowWiFiDirect](policy-csp-wifi.md#allowwifidirect) - [WLANScanMode](policy-csp-wifi.md#wlanscanmode) -## WindowsDefenderSecurityCenter - -- [CompanyName](policy-csp-windowsdefendersecuritycenter.md#companyname) -- [DisableAccountProtectionUI](policy-csp-windowsdefendersecuritycenter.md#disableaccountprotectionui) -- [DisableAppBrowserUI](policy-csp-windowsdefendersecuritycenter.md#disableappbrowserui) -- [DisableClearTpmButton](policy-csp-windowsdefendersecuritycenter.md#disablecleartpmbutton) -- [DisableDeviceSecurityUI](policy-csp-windowsdefendersecuritycenter.md#disabledevicesecurityui) -- [DisableEnhancedNotifications](policy-csp-windowsdefendersecuritycenter.md#disableenhancednotifications) -- [DisableFamilyUI](policy-csp-windowsdefendersecuritycenter.md#disablefamilyui) -- [DisableHealthUI](policy-csp-windowsdefendersecuritycenter.md#disablehealthui) -- [DisableNetworkUI](policy-csp-windowsdefendersecuritycenter.md#disablenetworkui) -- [DisableNotifications](policy-csp-windowsdefendersecuritycenter.md#disablenotifications) -- [DisableTpmFirmwareUpdateWarning](policy-csp-windowsdefendersecuritycenter.md#disabletpmfirmwareupdatewarning) -- [DisableVirusUI](policy-csp-windowsdefendersecuritycenter.md#disablevirusui) -- [DisallowExploitProtectionOverride](policy-csp-windowsdefendersecuritycenter.md#disallowexploitprotectionoverride) -- [Email](policy-csp-windowsdefendersecuritycenter.md#email) -- [EnableCustomizedToasts](policy-csp-windowsdefendersecuritycenter.md#enablecustomizedtoasts) -- [EnableInAppCustomization](policy-csp-windowsdefendersecuritycenter.md#enableinappcustomization) -- [HideRansomwareDataRecovery](policy-csp-windowsdefendersecuritycenter.md#hideransomwaredatarecovery) -- [HideSecureBoot](policy-csp-windowsdefendersecuritycenter.md#hidesecureboot) -- [HideTPMTroubleshooting](policy-csp-windowsdefendersecuritycenter.md#hidetpmtroubleshooting) -- [HideWindowsSecurityNotificationAreaControl](policy-csp-windowsdefendersecuritycenter.md#hidewindowssecuritynotificationareacontrol) -- [Phone](policy-csp-windowsdefendersecuritycenter.md#phone) -- [URL](policy-csp-windowsdefendersecuritycenter.md#url) - ## WirelessDisplay - [AllowMdnsAdvertisement](policy-csp-wirelessdisplay.md#allowmdnsadvertisement) From cca3f13f8e8e847d7ec768d5e2894833b6fe947d Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 28 Mar 2023 18:15:33 -0400 Subject: [PATCH 13/26] More exclusions --- .../mdm/policies-in-policy-csp-supported-by-surface-hub.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md index 49bdb3e952..e17a1d7e53 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -324,8 +324,6 @@ This article lists the policies in Policy CSP that are applicable for the Surfac - [DisableDualScan](policy-csp-update.md#disabledualscan) - [DisableWUfBSafeguards](policy-csp-update.md#disablewufbsafeguards) - [DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection](policy-csp-update.md#donotenforceenterprisetlscertpinningforupdatedetection) -- [EngagedRestartDeadline](policy-csp-update.md#engagedrestartdeadline) -- [EngagedRestartDeadlineForFeatureUpdates](policy-csp-update.md#engagedrestartdeadlineforfeatureupdates) - [ExcludeWUDriversInQualityUpdate](policy-csp-update.md#excludewudriversinqualityupdate) - [FillEmptyContentUrls](policy-csp-update.md#fillemptycontenturls) - [IgnoreMOAppDownloadLimit](policy-csp-update.md#ignoremoappdownloadlimit) From 8f4699ff43a9d6f6a66264c7a26ebba2dc5bbcd7 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 30 Mar 2023 16:52:13 -0400 Subject: [PATCH 14/26] Update dynamicmanagement-csp.md Removed highpri tag --- windows/client-management/mdm/dynamicmanagement-csp.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md index 9bb47acd36..5a0260cdc0 100644 --- a/windows/client-management/mdm/dynamicmanagement-csp.md +++ b/windows/client-management/mdm/dynamicmanagement-csp.md @@ -9,9 +9,6 @@ author: vinaypamnani-msft ms.date: 06/26/2017 ms.reviewer: manager: aaroncz -ms.collection: - - highpri - - tier2 --- # DynamicManagement CSP @@ -276,4 +273,4 @@ Get ContextStatus and SignalDefinition from a specific context: ## Related articles -[Configuration service provider reference](index.yml) \ No newline at end of file +[Configuration service provider reference](index.yml) From 0baf6f2c167f4153c55bf3f66e5067b18b35f83b Mon Sep 17 00:00:00 2001 From: Amy Zhou Date: Thu, 30 Mar 2023 14:05:04 -0700 Subject: [PATCH 15/26] added diagnose and solve problems, added links for onboarding to enterprise --- .../mcc-isp-diagnose-solve-troubleshoot.png | Bin 0 -> 52453 bytes .../do/images/mcc-isp-diagnose-solve.png | Bin 0 -> 26735 bytes .../do/mcc-enterprise-prerequisites.md | 2 ++ windows/deployment/do/mcc-isp-signup.md | 3 ++ windows/deployment/do/mcc-isp-support.md | 26 ++++++++++++++---- .../do/waas-microsoft-connected-cache.md | 10 ++++++- 6 files changed, 34 insertions(+), 7 deletions(-) create mode 100644 windows/deployment/do/images/mcc-isp-diagnose-solve-troubleshoot.png create mode 100644 windows/deployment/do/images/mcc-isp-diagnose-solve.png diff --git a/windows/deployment/do/images/mcc-isp-diagnose-solve-troubleshoot.png b/windows/deployment/do/images/mcc-isp-diagnose-solve-troubleshoot.png new file mode 100644 index 0000000000000000000000000000000000000000..75028f213c1d3a7d734eed731fcf7b7be081e519 GIT binary patch literal 52453 zcmdSAWmH^G@F++^2nhrW8Z?C9?k<54EVz4ccXvX96WrYgcXuD$-3E6Z90q15^83Ht z5AW>RZ~OWj4s-kV?XIe>F7IGD88H+jd?YwHI1~x-&kAsG2%T_n&q-cAhxKqS|A4~& zJ#$bH6NW1rCESNSyfFDB{Rs}PG6ET*hX8wiZ7Z(s00)QK{rm43(5Ao;4sO_8;`1jZ zSDm936d@($Rl&33{M!IV|1w5Ho}7WmvfR?9!UFmqvtP^n>hj_=sO4VYqZQ63NIEV> z5+l^ZdB{tZN@rDNMd~R^c+^masu;+no}=`}Ds*xxt@(`d@2)noI_x5R7J+y>&z|r* zoHXvHdzd8Njd1UB6c!d@z<~PGI&$(M?f*Tj5$jX^_j{Ez;5T-^+ZxgTr*7?-P?v$lb_AK%W@9m*17&pIMcLWf zexq&l8r3Soe|TEg7GtcMX^%Mh$Vp+gRFW~YVBf=k+)p8s1i!=yr6^Jz3m;ja`3oN0 zvMZ;$VC?b;w^%sg4lRnvjq`}=sespx0=6!0>xBp%UTkIBkaeZy8&%6+`CO zGiHN&p9^Ub1zZg(bNQ)rRVQs)Jo zm(IyRf34WSk6h5**dvTeq||f->fhX6aYt>h7g~Q!2fO}2%6U=OZq>#ARLJYSdFWTM zdFG!fmiA_h-g|Kod$x)rF8;ixPxCBKZ zB+v6=-9FG%nF(+wxA%)7A!K)6FtUy((e}nfFd-%_8d3dy@khHA(DMZf;?W>psH*+> znUu?^r;11se&aQjgkB2NO9@V0N7eQ^FI9J5NBn!PB;E8s4z~?05Ph?Kn!{VkI0GrZ z+LNJ6y8^gQjr*74`z^w#xD?)vJ8uqSzdT9GMk{QLPdI z74J9%y@7+} z4cCkBQ8wJ-F*yK77dIeMm;3jnO^18E;pNx^+TTNDRKkyDj8}42fTi5R3bWX$Df57hNwM{qNl!gBb=koId(tvDy+YUg>X0n4r1 zN5xH1t+$pX#4Qh_gPHGF&M?Ss?@xbCa~H&bQb4iTX+@678;0}Rr4kP?sPM*X^V)S4 z%U48p0#-jgX(vNz?-FWYd*t{n7V_<4BDyuknHR<#Qrzt&v|JwaCO>UgQbqN)9$r)i zP93NIJ9+r^?m<}xGBW++ z>Tnj7gjs(r^OI+5C)0~sl*1K@mIz5oeETp>lWWiG>dhm(flk!piR7B4*vM-{%#)|J zKvudmKFDKoBgaa=j#WPD!P#wlMAUYz&mluX_elii{1ZpKaLA+7X*u>Er7e#p6*s7{`boF3mP-lf5T4E|7Xw{>i-Gd5g}7#PM@O8RN9a@ zX&w9+sMK(6c8cecTo+z|3R+j>+DJ6WtY7>_uR)nKKq14@45RbXBl(tzj&W_k+ijf%%p;rmML!}L%{kr(pw?vM_`~Jek~i|r^z>6 z<5c3umx0lIDJ5}ynA1t@27Xc(sQAPJ)*8a#CO-pn6s;C>aAxLO#oZ24`aja55b9IS z{TgXGrfl2G=3`yz!Bvhs{_5r_w3l;Etfz)SUxEB`wLfv~SMDqAWCOszV?j;n-=I$U=bN6zYs}x>@STi-Lz6 zU~H}c0qvcH0j4s=)b4c@SM+lSjziHB8oqrp zW{c{z1}75W$|-5F=2L(j*@A*yFq;$7bba`Ju1og7KwV2*KE5KnZ^{a83P)1gtzY?X zsDw6^$CzVpadp({t?AVh`8`H)^N$$Y?+?0b57U#Ff8?6hE}En#Wlfk`2Qv+>1yWk< z`HZM1jaCNJ6L1n^{xrT9_wv}im7J*?Mky&4?qA-X;IYg6#e0`@sLmTOEb$BJZNfq3 z23@&GhR~wJ7Zo#h`XpmQW}#GKC!xItvrz5)^wOFn)(sLAqG5m>5z8XeV}>yfG)igF zeiE0@>J?EBc-$VRrM`NYG`!;^{w)?C>B@PPt#rb!)h|xu?dHksF0)E_94ha7`UkTW z{VHCMIAZC3`@MVl>*J!IVtGj}h-evv?IBKgjVFHT$$ZIu)8OM;Y_#$70@?`d63P*V zkq=)1jds=y@(ZKN_Csj+0&ZCYDg*eGA94~+M*Q{qq$Q0z zolg|4V$%47Nm5!5X@FU1wQ{x(9a{TY&!lHYMBn;{cWleImtaqTn~#?z?Lwt;jKt`} z?r!s}-VlUzt5BWb*rPxZe(+bfY~)7A3diQE@`S-2>2k9i^Hzm(V17eQfA5(ogl3k0 zl-7uR0O1JC5=*OI8Jdplu6&sjgLG~{&B~~(1t)c(<$Q2OQ)&Z@ASo{>pkibM+WwaI zzF*1(45)N17i)}$<{s~_K#$!KvV3=j_0}um8-XOAk=NHt8l~46HXkeDB)@#&83Gmf zfBy1w9D1^PX8(TU!l{8Gw+!d=c0{e=NWr zTD-d3@H4)o@+eQtcADyb^V-5?ad2KWez0mI?NFDEk8jKy?cI{t)MbD=^#X#Cf z!!m7^2hO;nt}9t+FPDkiPW@~ZGF@4y7nZb1498e|RuLqr3{0U)Nwk0ULb@+y&!eV5D;##q6{bE?fAB7OrtNTK|1 zc9|Jpc{rXgrU5h%3CJkE;0HK2$$gVd$Eh4YpXC?bkIKoXA7LmsLw-%Z5bz@25J*5G zORE%tp+)o6WBB%laqtu=A`Gw4LfiVmS-b0}dQ$kYZYB8ySIEhIVrGs}bgJ+`S#5Ak z8h+sE;$&4jGmF0d9voD1X%vzndv5Z2e~^2|jEeikW~4K)|D^97&Y8swkwsr@P=iuT z9*gZOP_xsVhP|AO9{a)M)8)YCMmrVS8|Y!rxc4!QCGQ-NV55p~u)IGBde-1-Pp;&Q zQ9Pkb1)+LcUr6!1!?%(M&BT?k8(OQZp&&hGSZW)oPhA^(+g2B+aMRyE;b-ffGjR7( z>u4pD$n2{Ctqc)CWX>;EV~qob?<%WIO5MrKbUNGHDpd^k6P)0Paa`GL{~@~4_(11L zzA+(&Qbldyg2B{E|PE3{jOPX0`B=07Ok9RG81Y240`L$LSzy)?2@0cV~0^#)bArPN^!& z($LTlyW1Xhc!svrC;)mFB`6(RmiC1eV)iu0&i*j?k)UOv7jj$T=;AjnxY9I3sd!+a8P-r4J~h-G0rkT2C=q%}RHTS@;+vCCHdTMI0o8&;uTL zhU&A9+&EkenC%@;z0V7=s4_fei#|>dd^>{rz~Jd}@JgZUOmxYWH)BP-{&C8am4AIX z51zL@p)UG>W6qFqcQW0mChFL~famN9`J%0YCS>~xqPW44F0|DqWFaHdS_M%&G@0ya zhfI0%L2M~L9%Gd&?)1buLO;$u{G3z~&K%3J&BE=jugN_fzYd8VJN znC%`pU5>Np+%<8&w@4NIh4++TcKT#l{xFk6(5rf~h5%Lu+6!FH$LekQXIg?aNEXlZ z?gMeQX~6NPhKvR6t-4)`srcWcM@PZ@*IpSctwJt(KC+RcR~@hSancnoG*7e^xwh~g z!d*L`oR#}m?Ez(RG#ke>rIaZGP|vWXWz$)pzWI%e^B%h zqjMD0lwt~$ryZ+$rmOgvymZ={QzksPSdv#?5)OVVB8EnZwz*jyZ%tKVIV;0Sy%1~F z&il2qd5G0)&h_|myEsP}-fX?}2PLEKTZvOPCF{jlsfW+0RGVaE0bwc2!;H4$ zu{~S+8*mh#ZucK!Eh~R`wJ#iUGNki~(~jyFM-25#8X~sQ8r3dS)dG^P%VU9lk6V>8 zKo#;<%InitO!=1gu1^M}_&hdc9EQtBmkB-UPP82PxgmlP5jv2Gw>jafW&Mmym%Xvv zu-HWQucYRE9~<8g`=^w4{Kw@m)4+GOkN|u!M5M0K=R63^%GVP`S4Mu&Typ9dth5M- z-=+!!sxr}?vgoJ*OWH)d84lCk{=VT*v^MWH1M%Hy-ciw8;T^+aG>7^6ll|!irm7*Q zBu|+PMWehe&^K+tUhG`}5lfIw??JxXy{^Pd4{q;AW1wga=3rYts8ey;6hO(yVUE?y zf$ZvfDQ@5Tcw6mIPh@`(w~fe$!`jN*2~uqeCeO;2i>!OySekkVb^73iux&Z0bV*&*&zvG*hJo2ze5QdPNnK6|)<2l)yl&z| z4ub$Ky;!q8SmfBZ`+cKtpr`N(7Kxd=A0OlqW6;f1-MS(HZ}xDt%QqsgPN4*uQEHl=JSC0hfQl z{VGDU#k)>0F*J-LpadMPqt%5-E-`@B0qWX|qB8p3ID;-YuKO3K=_)pkrh=N+xJObc z-lM|&#fdT62$n3Wt)KAONRbFRlps3VRSxxmq#RedA>k?GmuDj?`2?QyDT+^oC^0Xb`k%Vv65_pXsWTy`YYE3GScVB-k zSl0s@6g*~KAfY=t_1s-yVclT4(CdT)b2)W zU&uAULd0u>-HI?p3unteqxoigi;;4m-3PKsvS40qd|f_j4`+0J#68BxDgsb!B$3`^ zbI<0gE@49)jQ_R4Rzccl$2Yn4`N_|!vPtH}x;UBiGfmHqA_0s5f&gs)`0OsfmP^1s z=V0{F?EoVUV5vg=CIm_^6M;n;7fbS*Tc78lY|_%Ot1I~X)*IEht@2cCZYtCM+`B`c zs<9)}m9Y)7@8Os;A-QZz7=dp3<|4R9T!CdZ&1-8-|fzKHD!_>OrYn1A>4e* z{k+a4^N;JUGnR&0_KxC*RoaE}>pxzK^#M|dj15agH5-v0Ek1I8yuhiX#I+l?T%~`d z*B9tUnP6ciM8S2&(3bnLPIiDg@J^_PXIEA7810y$RI;6TmcC5sXf#K7St^b?d}OZJ zm8%y?^mwtbEjfjnCsEFuo+!H}y?oMrw%!I5ciNH?71j3eaH@`^uGVh7B1QsD;pD&iAb-9ehZzQFz!Cc*NyTyyZI(v50 zuut6}q*qJ%j7TqfEvvM&@yBt!>(3FQ9G1TqUu1FH%_oG0ce*F!7(}2az^QAywo4wy zw72_+iuS?|BQL`TWW%_RV8Cx9B6FfJ121I6nAaiMTap}^&Ofr7s;5g;$7?I9J*p?B z9b&(Aw$AIZ46`8IzZ(F9KnV3ov-v4KWrSaV>mO0?@$OzFPv!T_@rlXTyc9^!Tdpyb zPqTKIl7SA=Ms3hNi=XbfYEcxwIVth+9=D9i3%XXb^Zpom5gPPdm|{#b?O{c>@m=)- z9dTX6PJU2z>Wk}dL{^fLT0Ytg+c^x5F4Y;8nl%PFHbo5F5G^{8;{sw@Q-#ov#gotW zh$NdVfbR8(VZ5vKPgi;RA{sBIl3mf%q$|fD!)<07!bfLwYNbXA z$?ZHI=RAz1_IZT@_gZx{wf_2^a8z8&4qxgE(9naO3r-qWcO3(dciQ~3!dAh@aFF%h zR48Ub0pA9p@q%1c@`%456Px>hrB~!*$Izgbwb~)U;&JwT(Ij`VWYdor)sg4I#F`c6 z7qWuhlDiKTURc-<7{y;pmj*FH3#?hAFzK;8^=KSZaSKOLsAyrv=7^dVn-D%>!KB&e z!s|fiPo=@vIPPM^;M3uEW08R^gBiaA zYQA3pu(TamE-i^QhYddvZHz7q9O2XQG}rzVmuI=!k_34G2tEdva(J(hk#+C+xU|-$ z$_z}{Wls?Qw8iG~+QGV3E~N9AHMsbSO7^-yaw-3g+Rc&LR%6&OeFp31*0Z)GA7Lof zCjX#AHv^q^v_!tv;rwl7L>RiKP0+l2_8zh>K;3Ew7Z1NRM0$m0WHA%@9gR1LW=yMk zaOcdbj_+dAX(PNQOGIt{Lj`824c6)Mz$TZ{z%B)7Hx=dG$K#V@$53-BQp5MiTuB_2 z-7Q%(bsq(;7df&P#_t##(K4_#_eX-$0#=oyqw$?cPv_UW?iBjQOrT+xm$UvSMZKk3xdHw}q~) zAM<0nGcr;RT)wd7T5pj3;Sf23@g=tRCq;!Gk>%Qy5jBmuy6B3agR+(pqh?N%rPLkK zA_w?E$vP{$RwfQ_`H!!X$4PbcscHplJXzZ@nzh|_C@}9LywOwm24-5DK5Z3^jx%rCIr9oaxDtJ_hV#ztFMlPgj70+Oi^+4E3`oBsWm z%p5gF-iFimO$o@ktJ_9(&lNR1x3U+#8?TkOqx`Or$%HesO)zU>RC8snnKCR%teCjt zL>n&&7!{R`-Oulo1Ml!L@A3F~>uz@FM-?F@I>wTTt%EyvP4*G#=f=XFRaAj2{*pr; zmBCxldpFaLtE$-@ErpS3c4b z<}IV3d>*;eqCQB(6m`)*f;Bop)7$*0sP(!)e|vR%>S@2bU3Sw@D%j0Cc&J6($x4WK$-EZ%hmyylV#v2&O&TN`Gj*}I$~d9~G1XsmSCaRq zpfqi>N;RRWY~(^zV_IAmtp>yOM@yHc*9xsFI%SjY^-e?a-+#RHx;$@h4({(-aRJfG zM*PWX{*sMJwn$tBS-^=FmXsX%LvNthCo8N*gPYJ(e_U7dO?|0QrjVO)b_QC>D#Y+Q z`Zhsx{>KpxE^9@VSWni_jmv(!A+tG`?hxT#^mo~Y-6a4W){6(kW?L#qe_sP&CuOBq zaw~e}RBHY);N0$5 zMG4K*Bnl>|LmmJ5rnO#bXb@A-ddaA?0Evm=fyImtI;s_gX_IL1K^2uzjLYcp8t8|) zMR035^%7t{FQIvd@CJ`ZfmZFp1t)d3Z{#RF+IW^ad4-S!E8+MS>22`-Ag*Ymo6ct~ zmDi;R^c7Roi=VNZxTkpO$y8$(d&!1^(b5gT$m0QT8ac;L6(l}AF=#frb{`qudCRud z#$DpuHP+Bn8KWeb;Pi{KxSy9{k3L2p%=*5tNFAt5URF}fbJcqVdGY!?1}#g%yp7Rj z*}LFHqQ&{WhUiNyf&m`MrE@HP3!^yU!$?@1f5}F?WcC$=CxPLcU{!*);9`Fr1}##; zndLzo)>!yZaa`-=*3`ixO{o|x(hF+00ToP)Mpc(;)-A8p+i(uw{r39C@n%{{LgwHG z*Sjw{FGE6*z~5QO_`SY1c%QEF=ZFc8tHD#9{9==N+m49pKEDQT6;)o##cl){<@LxA zPEvO0-pk0eWdw$$3;0;+Wb^Zoz2c|Hw|t^@SUBp3rGUUUAECY-&&U9b5H8hwnT>(W zM6Ow}97}@@mV3?Clk=IKqpkfMk*(*C&!4m3$cAawIpP=lBxFTlh_Gwto_;JHI0>^G zsv5C}^WWoQvmWu;TTTU&_Ajg|zK{zF$5a%MPWNn&HzEUpK7jglNE{*n`}EpQgxo$c zT-c@=aBZY_#7@wj#+Y0^1pNTz^BM`a0ORB5O@TiJTEFp=1Sz4>$i&7HZbl3`Lp&c7 z>$}K(vxRZ1-IZIIa}Dy2H5GT_;g5xNwM5&RK%*IP`^Mgu-lw9QzP>|sY566;1XV66 zMy`6_KGs5pPXwLMaZ^-!-U&l!k-^m*#>P-J85ujs0c0e^X4G#KPpXKLkZfjX(R9&4 zg@A{j`ay88JpaicW*|;Pb{nBGwIq#vgspELJHIx)4H{EAODX#<`<(W{Omk;fFdoFu zygyV@&}`xIguS?*V3@KRi8OqlEr*Byu>XSWxNW?%_0`g zveS!4A4R?mFer>!A;dkA2H>h%sl1R|9`7~W4#lmoP1NZ~;`ZMrI!$Xi+k}W-fmtrS z<7RWLSDG4M%DsvXg8R)@LI%n}Zz>&ls(1VQw5rBu*zySs+Sxe<#KfH8sOOGeV%$GVixPHh8*C8 zT50YK$b=b0?|k&uTMr) zvCxJ7CG>qYf66k$$Z1ijHaIwV+w|($e+m5tr&}zMcTDfMy6!HL2sqOPePHfFCfwiz z3gg(Cg3DP=z-B)sV>@I3qb<9F-+#`nuLXrhw)lhCfrs%w5F6G#lhOR~*v@poHixsN zPMw{z@Q9e!U~>Tm5CEB3%DUs(zXBm4?b~TI z|9M!7YARp$bh_~36|^(Bi#9lG>Xm;druZj$14$&=pu5w2S3>Jf@q-Z=}~cA886Yl|MM zdcemgrf<)rLWyP#CZiG7)8M;s+q&VYM(-jl6U71#f+XOj%vwbD#rFrww3S~zi_-6< z7r&ATVaKQgFx>0CUqB|ms^v~fp+B+uuG2rF@04=h?L{}{_gyeAnBX7HJ5F=H_sO|C zo@%HZ@bn%;O~yO|B-0e#`SkbNZxC@lza9q$5plY|d513N9%eJ|gO4oxhGbrr?nvBh zVPN?)$I{^ef0smb-D6# zgni+>JKg)`?g>qr+W`L)ACvF#VQz&!B^7?}$uuazbILar1G`-r1h{NG&O z_~vi6M&je0v5DQo|+xi9F`kMOL2 z3&OFXqd3w1&ZPZrLLz>6f8xHd-@YzE|1-!HR^0Sw!2c25(&pyox7i*ZPY)o7l_rB$ zL&w~+GQe!9W?(qs3N*rJ>%S5w6kl29*m{-R&oZ95QgdaVL~HIm@*2sF=P|p+z2{DU zG4_4g0jT7|WzZ6WL$JoPugsdl{QH89EfMWM$jJElj z!t886x=2{=Q|eDG6D(lo40B=^%y|VRr}9OHj6JnKE5IracW7n8tzF$F(BNUR;p?%6 z`%l4Vwxw$0Js?nfcJ>EuxBY^N9Ce<*0C&_D2YOQxY0Oqdj=~2n58wt0vJ@ifE~gJR z=eM-17sSSP#TXASbqLdc+}@Vu7*FLBT{Zu5fXa+mDIzICnV|U^ITMzUAVkjW0gheW z+?dGzQ%73O7QeE7I$AW&IDan}=aUYw-;Mk(Y@O}kxY-}zX7STZe=gP^-bbxxhi&2M z2b1zw4RnUBe6KFvlGr3E#ONCG8253wkQQZE)$5uHlaZTCx9GPOoSLXWq0N9l#s>_3 zEgKmA`{Pv$RMLlYPYxmF$X&2%UWc!FY`SET~c)Ha*}Cng3rp!DZ^O z!RoiyLr>_vHm@2P+lEyMv14`cp`B4?KX^P<)R@=PolO{2tSZxd*h?;Mzn!+i)d7ap z99TR%qb2yAb4S%$0|6oTvL2MqiMCrY378{BbmT(qYgc0KkC%|`^DJVN zn$+wqm_vSaA1}~uChXVpH`k*bc3t*Es&?CJ>G9Li%56tMx$|5KR{2Oa1Ti}ew@gf+_}nhAFMbeqirCiek!H*0 zt6=^u*uJ5MI^cuJ8oG!X-2u7?skJBGb}2S>6eh|3q%yt)EY{V={r@~ezA2wpfM68U;sI3uwlFYsJWvo{wt!yAHmpHqB~raf^pbs^PR;8uTGhN}%$9L(j}$o)t6i1hVJpQullhn(mmYHml z7rlwZ4MzMh?mYAmeljA({=1dF?()D&K7P==ZUP*Vugw8R{BB>f`oU|sakzE*-!_vq zkJC}0{a$Y~#{aUdfVHbjcyN4FRIP05-DEi`#2+H|2_n)Om3lM&&62R?r`MltPAy$Q! zn!Qs~kHN46LGCWqgM}!R3)`sQ6L-)fF=P22Zo{NWF{RV#LM68*%KjpFrb4D#I?qxW zAwoaM`u67HSiRBDyOZ~{!Yn=O*%>+buejojgh@k~l+2)Vg7%_i>O_V9(z5s5&aa(u z_KwY$4vZhUZ3@awg_XpsrbaRjU&<(-GATC4>i~3K5IY`+H*5Yq%MIHwyY(7!(|)&9 zr`2Hly&PUkwp6nom593uN&@YlBVa<~jGH&-l_iFqyPd;mm|V0UeNAtPIkCC!*Zj|g4Vd`dsw=<$rtJ+ zR~XkO&e|OC+I9C*CjGX+cG9tM7k1b(V>Br!UhLtvJiRKNj*``pp(DccX5qXsgchFm z(A49?&e}I}WC(Tg!Z5O&N{VW9$vDremS_d97UTEJ34Bg4d#@+QwvgEB*HPKj%clwr zKB~fro(AQ8AuqGC#<03cCeiLe{~$N56d6kt`0}{cMy$ZGrI2ImeumjDa9J-;wbuas zQO9bo{mTdLtI|(BrCJC1-x%d8kwrxckI98(7r8ZqocGGNhR$isH`cSGiwy;FOnYo~ zf0ti1+)cv?X_G%*ka!OC?uV+1853^NM*nEnc9xDMeA+r4ssN z5cRxI!Ak!n@G#kqHkG?Q#@C&ZXF+W!x_E$DB~%}W1Q=rUvj6O<@;$bLQ{K9)pkv)9 zhDC{^WI?9-0_pJqvnf+tUP)73q6vAMWyyc;4YAaYQ_j%n2vz*`jjX8@HEYmF7k*?W zBGq;lul~?rz9Jjf$S|hFxm&X~Wm~v;&}QtDRXuvX}s5F%C~NSyF7K%cYBM z)VdF<_O~70s6%-`SARa^GcEf!#Y<-o_sEpm5sdHol3jxEh%tyOZV>k)?+IK{zh$M#9_(ZaG0Q zjlmlqt67ad?xb&l0wX-TC^O<-+HrB&m#}5hLaRyxJj-{aPPi;rb1ZxTHV4N zp>$QAc{vG_ho0Al5vtuhHfakEhUK%0h)z^NGvR30yWD*E#PuDkud_i)cG2n#&Uh)p zT^%a8do$e#bGOG+dKYAQMuRq|G+H-1T0)N_Dw-tZB=q#kf**`-Mc6rVSMi@+dVgWj zH93blpNAhgf92k~qEQ%)cY43lAux2ME1gl&tDQm#-v7vzhc>Y*PCwloKTmxltP#LC z6XGDMEc<ZF2 zdOpUsEt4!<#YhUq{x1y|hx#g=%W|~OZW)LeT9CELeqFLtzs3(92sjR>&V9b%@qkv6 z!Pq^gV6SeCQ@$B+sioI}p1^q4jd)EvB%R>yKW;}3A9!ZkpME5(2ELx287=*kEX4%i z4xlveocqM@7%OLuUmoB}X72u~jWfui9$z$4ylr(l*yAp`{tZza8N+mlENdxP_J?M zBNOb$$XObWZdGTCsth~w;Dm}ifQLd$ryrtT%5O3ZED=wJQE8|iea3xODpk4rL5?B`RL*W|IBu}$Al&LF<X*l9>4_9}6G`KIhtbp)JSc_1O?hN_KyPb@GF_ewW~8T(|S^dCd!+c*@n`7*pfA z#zaF#m9U+P&vkS*{~{@HYyAMc!TLZ(ohA)0v8DW*l?8p^ldhPlhK5gTGS9GAbTi*6~tlsvEmpeuJ)4Dq#iq`;$7ivG!tKsEZK^=j}V(Hc>+@K=@ zPh0)d$UXv_dsJ@_J3hK6H(|bxZo+bu;{aG?)R+4H#!a1~M_Ro8Y9bJsul+bP6S-=k z$H*al052c#H~b2t7=vd>7Q{WPsH&;S=z>BxCb{UKh{IbtJWh9D!N(g?w7CVULRKB9 zj#Iv@bjv`C88WZMZ~Hi9`lAQ>)BmtUr7|XHCYAPQpqYPa4VIoW8*=F7M4%KY+9#$j zK+|4?)>S#v+K^BfCIQTYLP7NOBZfiiUOJ|^JHE=}<~9C}Zieu7xa-d~>(tZy82{}c zoU=f$+)GCryM6O3*}R01p)%CdrTwMu1SCnuU@zGsH8iX?EoCn;0urPx`M2aLwcXN!Ya!z`k3r%q?xN(xHq~W}ken zOY8_B0re3HSO%8cIr^d@>zSINlaC!RRrOW)jS0{SL~D73MzU0MrkD}-7{x}u-_x(g zP6@rJsDRAEYgB~_Xp}b4h5r|7gOl4;e6t<(>d9ix9KqL}H*s9A z=;@uxymV8)5Ex30RhXI02Utoa>^G49hahJ%%$ztAB_R}W*zPyG;yn%9n@MK8^XrrT z>Z#6@uNI9>W?S+O^9}VPw!giGo%>e9HclNO+tQ_3O+Y?jkcxHhbLPooZ`cj0FBWeY zKQ%JKGsYYDqX0ysu#-R8mi!m&^!>5e`#<3mYiWUB|0B#AdjB^Uob?2-e4BVxz*xA`VCsM|oNgnslY&=CrrZE=N(-y(lzM374A@*%s2g9?yikKX6 z_g6&Bc3;)xI+C(&>R;uk_WjzC<(C=W%Z6dZ&U^e)}0 zuXsM2LXJ=#Xl|@r_4u^ie62s=Y+K`Y#ov9@>kK%ZN_V1D3Em#4EHP+y{dN$Y`u64@7;l^@p4dV%kEAz2>sP89?4%<80C98b1Z&Veo<3?Q}WXgv8DP`!fvzo?~8*N?|MB)g1H5# zxK@W%Jq@Hn3yvw^+IUQtC|`YYDZX0bsdicqLm-fOIxplDgcxowBmN{Zt4^<##Qc@e0TtcaxFv>@wUG}Y1rTA=F$m>$vkiYz|c1E_7%Zilyt{-

i@7Hc zg1WbpMIwCK^9e~)&N{0uAoB3*mV^~EiNF(Ctqa(9O~((GouS2OV8?;Bn{+RZoPxP( z67Q>ls`FB3x?h@2KY;2jL@V`$%(Tw8{53~0j8CnWgG6yA^D2Ku!(1ASKnDlO#mY0P zJwD|sszXDnxkl+@CTu^mE^xXt?J%ijGxokpsVI@uZG6qpQc5fVNO7NcVoqA=e-MIq z+^fE^_daI#T5kcKo-VN(PC{ZEo|GR1pwTZ83!Y*&hz~)WhJ%}EPMD*&{AWkY6HRRf z8Fv=CpSZlM!getrK)z2?VuHMOiSHr!e0I+kww@9t$i(-75)_Qh==ZXocJ~$OUSjQM zx2B(NpW5x46vn78cEVBim!O@EuVb2DKeVrYK#*UQ2{KNzXgPuf_=Axtt|&bu#9dp8 zD;Rx>3H>pwR?be^>Na=VnJZ6;_yc>tNSi+#2GD~l04;=RC8Etbu=tVTPKUdDOxH<8&h2R#litnBnigdNt3f=)TAR?DXGg6T9T!OLb zI)1MV48*NB#C#sz+@Bge4BeLPL%)Sg zA&BOyZwpZGxZ1_BQc}G&1I2SwWSKU~&V zkfo+&yP+W+hV*R&B_cs*1@y&QqxJVPOT{*<>*41Tx?bmT5OKWDjLSY~8z8~!`ihf; z0@4UhiA6Xqyw3TnEed>U@rE4yuQ>~oqLuSKkN7mG^XC`>^ha6WbzgSPGxr^_Jz!D7 z*w*1EmXv%}UO(27CSHnGgIS#nQ*`Vw-h&n2rQR2*vZRPv3LJm6=2z>T_F;YT3A8HHOFa52)CdI`;~L>Bcv| zJo+nh25Ji0q!57fA{i^ExJU&_CvT7Ff# zAE==0b*~?Hd}*|A=T9GbS*%=}gqFv}&%abaA{Bq>E}~~me0uW7M#|`OZ9IB?_-|zckt^_pJuNo`j?T~$TRn3#% zu&;`Z9NTl7iKR_&WBOCN+K^(hb5d%Qyb7!x78WwGJt@?(Q&X|R>~#H^J`oUS!R(SK zR~D-H&x#Fr?QfKEuDH8wj#DbGG&A&ZrYN(SP(My8`9AQ8pD0^}+038Sy@!C?s(_w; zVeDzKJ!$m7mQqcd-EL>d$a;3xhG{zHr+n5l0grMcv5FzJPamf*-?0x;k$X?ICYH^& z#{9Da{S~uj#}gHgSB4lc=jp<2)$c-)q!;^|@jIVU%tX6>oUVn9?gNHiF|QtxdwK@S zsJjcn=GpVe9=u{@)LWg-&i0qPFivyLlBsw}wVTEYnrlHL%Xo{VHp>>hQen)pI=R!H z85^ZV?M?#UE7@O4jIKvcOAEJ8T>jpEJE`O(?e>gIqGf9xSbja(^N3^T=MbOrDPh5Z z9Aj`Bm}|~#SUf5Qm_jfE-F#n;9CCPb?6X8&sj5~qbhI~Ia7^qW#c z$q#G3fp(LRsowdHhW)#|J?opo>6P+(&MhC{waU!4xYK2{ewkWp4x__SI>dkZ=)Zrs z;7yk-LNUNO;(h#wcTDxTV$Y%br`LWKz50(Jh7U1_sr&Jbx1Y4Vd~?>%-2Q9b$IJ7t z<^$ni_&=!3{|`%ONN`$Woh)HlW91flM?4!;$rC&X{yXyk3=0bIYNep#;7%0@+(x^B zaFyJcsWw|yX{`Mhk2?Pt_y%*@`b+V4Lj5!&-V+nDS&IsdFI)fg2ttjQT0hiwoxiGa z80PS)`c-n=syFFa;a>|r@F7bz;2v6W);HZ9wjj)C3GwYR#lLU;tLir7Rr6$TzCT#uw6B98I1F4i@u3D z=e!36Td0-@p<8)=yo=4lrQ}Xpu;^?2NgR9XY%AFCvM=Oh9@af${xL`l=~MhMftlp} z&oEkF?o0t2v1MgUmu?Y>p?U!#SG;zNstSpv`{{~XsbN^%sM z^HU+$OYyD`wr3o6#-8pGSyU!;+Ihs6#tJ2;JuCxe^IR+`D|mBRD~C?ovoiB29ves0 zzUAu)$BJ^A?3L?rU1+9r^*$d`q1xS=9&`q?evZ#XOc~R=5{*9k0=K=2q}2=IeP~n- zkSuFj$ilH}lhPFr_#k0UZP!{mZ*7}2A~<_qUFpZF<5Q~^g`1J3J`+Av2!KPn>rxdR z8{O-DRdgK@gvn;5p6lJo2B;ZZ*(xOD-!#hC+&^(Jh<=FZAN_10#+6EmKdN{EXZ@5= z;oa7jNJBxBO@iT0T*R$my{(+??>~~A-6O^zhw~fLu@Lku#q;@ceNL$b9klX7m`V~J zgMz-5bR!zvXh)`F6rHhq%BQ7tY{6o1eNtz357f9knGg}OQWs5AntrMMvO@WJ_ElL) z;CCtArZNMPPexR8x2yorRQx6QYqE!Y=F%;EACsxHJP0wBiE%`~g}fs^T<4?kQAx)2 zhYTN&_6cKef>y+MExeZP^$O75L%Ely=pH)ZXQk4ttQqiA3x%k3v!JNrm&j9?gt92I zo4R@`XPnU){C7SiBEp+Q6)YTm#3{^EDi)?lSk8GOBA$M+s>m)r5L=Gv?-2-Hl<;} zX+6i@A?B)Jp48HQ8}EW?M?@0FN_boEViaECVHdjf%bN&Wwi1(JMc%;cS;lqH4F~Erp+V-9@c0#Ftb=hFY`sGnhhr~!;WFER(2Zmx*>|hD| z6j?b-$=x)jGPjw`RkopKZ4PhvWd2FNiA-c7t` zES^x!X^D3oG$EpAd)?A-@yI@9rb0E6^Hp2cXABc|mYxycHn7#_=!o!Kx-m;*>9`AQ zJ>awf7^0tU>@5l)N|nT3?iJvpV&1V9J~!<+DVKo1iXS+vDJqS9QE_w>+`1z$aN3{Pqp?- zCR$DQFm4b2YY)b7u+&xovOMQyb)8+uM4h&O-894Q&}{grUk%zJX1HB|0x?v4^mqoT z=xbx_Joa_(Ts^Hw9F$DvX!He~F`{WYG}fGIPjt2+-LgHip}>k25u28ArsJPMk7-RWg%Y z@%xPF@Ce(J`I;;XO(cwj?zAlpwY(5TI6h4b9BZ{*QvxcGpdg2GB{(V_%$!^|+r(@u**&96DMWNjf!Q@Ae?i(f97=#;8 zy~T|Eu2MecZ`YkV?Gw?2T4;IR`F^fAmX1q=0P1XJhjVkBg(p1PHxBIeEq&`azIu;B8L@N+Y{q2RI@@wp!i z?po|{hYEm)4Hy&VGAgi1Q!Js5k!Z5nqTzGxNBVgRlHn~|jkziI5hBtGOc~R<0ZkQ? zr7VHR(=J@mD1%hUX?^E?Vp;z48j+}bR!h`H5w>v#a+N<;%j^QKB?#gd&Qev_Wab4es`&EOO2}smSJzjey~DK8n#G zOHjT-YQtKQsJD7~FCyr&H$ppb2Mm<;hzxZ$5U8YzLyd&|U zP|;GN5!&x;oGL&5w}g3x%W-k4)&j=o!S0Nyx9HIQdvQ6q+z|7fXuNWx#~iFQ5lcdHp%qj$;xr@B9J zDO)L2Y`jQGcst&MveI6bmhR%c+2*~OXH%zU+N6E6Jj@q<>_03L{;Y~Ce?-__T*QAg zw&=E|?W8(?sNUYW5cB4nb8Y%~U7etiu94UlMws$b_a5WVYEu#mXFk8y6~Q~()R&b- zw+tKKHe!pIY2uU3uzQuW8it;ncOG4Z`dtSu+`Tj~_3UAbm>UyFD2N1U#Cw@FZEADVw~C91XTzVuxdNRK zXr+g`Z6tLzxPwxz)$$D3ic3@+XJ!(zhRa)3)*wFNX5&moF_$c(aT98}d*n@3eBNI| zFM3Xn!(t0Qe`e9}P~;dj)m(ZL)duT^KAA$x#@Kt&#jP;Fcy+&$dvs;8(ToEi>zxrdbio_te~B zdO1&K)(|>*Ma!v|c;9a(1YHLE45 z<0@fC_nYI}eZgX4*xEkcVIH~SY^D-WU{!(I*IGJ*6+Td*9TfAK%wxv>vnD_JB@VZf zG_)-aKRgp6a+B-KYsgskg$u@talvc`>(uShPq`%R%lwkb`sSQE6JW(SbRV-LTaHvh z9NefmcS|)c9TPB16h6D?89P**yolrO{=1mCJ&95w4`k{0x)+Z8JCGi>f|D-84!83D z95fRo%VN)t1R2eO9OGp*kMjJn4J_^7W#gX)slL(ZT_00lf5za}IF?vOxJtZRYr0On z(&_jEc8p!(#7YrcJIE*v5+>g4FOUC02QHL?aJ=}qj+EJ>0G6*jb}{fwhKDthuy7{a z3YDR?$CG8U4#340ZI}nD%dz)Z%LEMq2EPO!b7rMnM!x9Toh`4T5;@BFRydug-oEY^ z4iMH(blENZ6DjMPoK;$jRcVht7|~7PG3~E>HU0Jh-cU4QsL0iqpHyKApOug;$$=8- zglOF7UIJwUCMIv#G0whyEo)wtKcJoK7}KFH)Qu*Sk{q3QvsAZyXt~NYExxE%lStf&Co`Pzp1?{n1me>;Q zQ*J6FWat21l!Karg{Lqti4|VZW>_RuxS^({%H8aKb-us$dmbX6_*)|rfhqTyu?a@i zBR2?PLu)JL6I6IXD^0*ZTiUz06>w~5DM6tK99mXJ?jxFsg1D4gfSbF1{6OSR9PvSu{s4T(>c zadq7Dr~6FTP&9-oP2a9F=xs89SX{ zNN_bd1lvu|CkkUh*beLKVj}h;*(v+wc8rDHOc+vV@6O@YCv+gA8H|m+q*<;ZZ`bag zs*82>-4ho#Ugom6RTlLtzqd~0VRzz5JX?JJ$lRnT1_xCelJ#oEI?bq*t%-bC3Kyc> z_-yX`{r)u@X*L!%EqWG;DGqywDk7+e=|AinV}6!Y9rmUF+ z6cC!%sFm4@s1dd)r8LArG{fBl&B&&O#c~O~Qf-p@N9t5)?YsP&x!5izN~hQwH2SS0 z-E*HgVe92{8Q;r~l6~YQgi6Hag$`R}bVM1a8;gm9p3)cY2i&C3CNC1IV}j91gfv&X zo`_U=$V7UIXKqO!yd?rX89FerjNepS9AhohU(!m*Ck~z`ih{f5x?v$&nswPdwr-pMa~76Phx zZ}wAYt*XOlq(c++PITs3=f9j24OZrmb4XQEW-`;5R4d*)48CS~@8{B8k)W_*d>*0< zpzEeQk4zNUji~DmILVKcyqxmS6t><7i@YB-mu`@?Br?kKEdEm>z7fI8tr|yuhN^ld zu`Jlv@B5JGlins`B^M7=cgZv*!gpB<<|oGNa^A+-J#aX6_e8s$JPYM`U4*CVD0nZc zT48Z~H?lkuYW}EM5@R-9axBm&N5@PqMB{OhJiL8G843}eXY!kq7+i1zm>ge-CDui`YRPR!)ufd+ zH;kjM$zxo7R6T*!x)$FDX=w>(;l3v|r31N&4mJjb5Yu5a53tF>c&61SE}HE2wZIXs zZeuY}`e7E{`sibEGBjcyqG8qNn{f_Yj8*P3$RT5vSfB9aD;W;trVf+Wv;9r4lCy

KdvwwS5^V`wAPYu$23p)TWvqq*F8}mT;mW&c7=R=1%l_V*StJXzwN5 z)Ws_*Hh|2@Gkf7~YrNx}IWR6b4{w7H-&88ob|K&9q}NutX%@mHU#;);x@gh@d^HGe z7@~hmj23C~Cl2}1uTIhu#aY#ns}eLO&NaR7pcH$2MBCDrt@2i$oPZQ9H}SIDn^6lE z%tYZlW|`Xma&71Iv#0IhUPbz6J^uLhG5jOyXTS&`m10s>aYb%=wqU(}`OfY~NwcB` zr9&bZ3-}IlyH498rf4pNpHd=;CdXLU=Uyy(zC8pb9@u_6>C=TD<6n7TcWl{#ebl$< zH-*8teCHg06n}!cOTSq8U}aPYKLsz0>%QV@ZdX*6C?vu=YMD-tSh@A}Xc+?u<^+829%hQu`maxR zSY?8In*>qT4~$({(qv>jTMX%H9xDBp^7z`BGkGT)^(gARhGmB%*Ti7rS+gPi!RDgl zS`b3aA6+kSqv3AA5S;!h_0q|hee)aEKmto%Bjn6}qGUjwX>Xxn?kAL^%xIzK$LlEh z_E=m^b4SCVnE$eBF^N|Br2)Pdi#e7pp2jVUn()Wp?KVKqPc62Hhj)L4oOrq^c71gI zEqL7Ltt3|+`uC^-1Ux3~jo*1AkL#zNE@=Y9LfR&ln<$%9t3Xz$o2yIN7 z3p=MzZm)u9&@ouheZv4-s-`d!(7Ah^P6# z3k%k`C%o@Ya^K(SW;v8}rwe7{t5KDC3$*ob5>R(>CdzgfB)pQCYmtFRn3ye&S)00He#*M6?;sM;#{^~irHM5NJmF+AK)f; zyt^0*Ux1*bvPOz*_J2IW;2Sn|K@j3gNd!>scWh*1g`6)_`SOd4h5vef@eq%Du(%2z z;b`koweM-FE3g#h6*k ZvwA9et_|<2)W|@bVqs>+A$%o$-!fxilY6B^)4jTcwB@ z_I?_*H*hvrMvNIxOs+ri-|n_vm>~5X-5O*@-`LDg7}uz`zlxZ?Sd)ii9$QVXHhDel z!ecruG1ZH_gvUfQ250(j(t-%}=+u%2Gv2SCj`LT)A2F@;I(t{2{`t`@H5C`c9 zN@S7KINmJwDed^<&No|l%a;2!+QSpidemz{P;ga8SsAB`*Elf0SDI8ipyL0kP;Cw( zSN}v&8U?%~o*4@L%S7S#OtBe6hY;th)P0%CLRO~aTJjv;+~+*2FUu0@$BZF0e#{aM z!~r_(Oa}k0<@vS4E3B`1nmicU>M{?wB`C=sS=OFEmHobQT9?P~jPv;4F?Z;eFToSF zGnANGD-vp>3e*qml{FX$b^iSrc<2z=voCmtub%x{_ibkU{iop{zfR~8z_De(r26-& z!TaAEDgP&bWvULFLs~qDIi+Ef^qiH>JsX?Pt=Z=4#W=D0k;R`jTfP9Ai~|U;jbC#wc>=Yw z-KRKl+&mYm1gp%_h~vM%tK3{UBbd^Y9v0HaIEhxHl@1*TXvBadKt=X(pjUaj9Z-T4 z%3Ci0;(%HLvZAZc1kRda*{Dd9&&byf&#p5Zzb>kjUwjs0C_Aj`q&7Pn^6cU6Qa0Ti zKLH)MRYa9^8#fejcPKY+lVen(XOo75Lb`{-QpeP+0 z&J~ZgZJPjI`L^%nvleky3Nc2KtdM>@evTDb%v1o=zn7)vLhpVdvufgFO3U1jh^p;4oz>eRy{W*XF zn9-gun<@^#3)c8<5?<}kCelCDxdm>1v*`XPCgz&TDh;G12_s6SPTH%X zXxHo1J34QMAZs72n<;F?fqc$~P*%)-elRPkE3))<(obP4svsaK0ZdLe*YCbO~)S@R>@+Yt>yE7pYR`Nr`!k}}5)JoK$ z>2^@IMHgCjm@hV*slPKZ^;0Is%WSsZx8{}JuLcS~_6rj1MoM>8m)@R>*Q5Sg7WmTb zJ@H*hFGLK`4o7u$r2u zVMsBuF0Km*)IIBN(;`>1sE!s#7A3ctCM_fde4_TqX>%19Zc4y1G|7?XtV9%^{c zS|_wdz0#o`C~Z}#JRSoie%~Wl8W8HUs(!h7AFYQN_>gW|Qi7o&HRWsy=-| z{KMw*xHcL=v+Ha}of=wmS^R3^;VMyh9pP98oyLUX74LUk7%*w1GN(<_RxGn4mBR6?Zr%%Ty&6Ts+FIjuq0wo z1i;&?uRcb5@K7!-lKBiW!Oz_8^-^!Ls15dzJ1}4zN+I~#R?WuoM8sWVrcay>f`e}Q}NBZi^ z-Y@2DVYxcCxY`}+uwoP1{_NMSbhksO#zn=dYer--Q9&5?WGSEuGi3&J4 zVW`PL zBmr6<(Dzp2+{)^#>F!w!Ywn(1vsT#)3%6$)cgKjwXE*b)Sj!|yKV#5hsyu!=ybf#J z+Xo*VQ<1Ry`Uz{Mx@sqlhy3nflG5TO!kbAPiW~YRvjXPMp3>C!_8XwC*|(ee!ji^o%Jp|w+tC2 z+>zA}h=^AaC0K)DCRHsEF)B&iF2sakJ}UE!MCTZO=;&q0ZWO34mMbu}Fu~xhIWtt? zHRV8-%*ZnTwgNNSr0I;^VvrQG&jucF#>6K-=It@eRsywnwG=|~Sc+}*q&i8z4C)Xv z7X@Rc^DXl#ydsbszPODSgq!zhj&+BDk0U}<`+#tlgBs-}+f@v&9x-RFtm}H;*J{u! zb27k)Q5Oro+L`&HHMo4KT|&eu4V$~58BfabKbIz@cP#^*V4zG6n{$^Y*52|`#wI`- z#^;MH2Z(=3w5sFJQ1GzKIP(R7yW7-7*|>MMb0*)_oXIyKzbC{b-;0tnA$TU_6K$Wg z*6rsiF&fUX65>_U5EsbKTQ&Q;LsNlsZoc}a8$s9GTr1~oE^ng?6!AT{6O6bX=B{Y< zuf!E6;021E4eC5BwNHk&(Yez_uG|x$JUBa#0w=p%q=KosP6oy?GrzzJk!fjknQE$8~nbT@~`a@}Ny~r5p8pQ-XsoOzJ$T zkKIFPsu?{P!>`Yr6jSEG>t?pI_e6&c|MYD}F!Yp#yFaFl}S{(?o1 z`82BAp&Wnn*@}Ns(}lnhKQ3myb67BZ#=W#BW_`34-)#ylw)1Gvc00cq8UHe4G$Ll# zy(P!e2&%+7KcGJzFbIl4kG=ZiHmJ3cVvPEIjEGgJ^!`QHYpH{Vp4BT=o7&b`W1S9CNYTc7eI?L=X&rz5W-Up%Z z97&cqB_9cv5>~#HzwJm=PVk^w3==Q+mmZ%k6q1Mhw(ek2%g!aD7BdS(yX}HiB&ol!_ZFi08ZYtH1sy5TSlMyvWHhYbOYf3KYpWfvTRMHdDBKfZZ_#>`9iM&+Gk6FGfOv3Qfipu36O4wV0i zsnOC(&epj4{&oJJ0iU_g7zL-!8yX5oU_bMJSU4K+*6Z3n(|J$}_xgbJ^E1-^+Qmqw zrRFSigBl?4))XMB@O6|Vnv3Jnl(=5QJl7%x5CoQi>HspZmqVohl!+w(`+5z4x;S}# z9lKH^Ek&sfTdIfySZ4y-++85T(4WR@HjE)om2cc8OLN|$8pA!P>`~ur!8lD5%yi4; zE18~%#nHAq|6mY=HAo#2koZVh_bEB}&L5hW)t!!%J*L%GjWR=@>0%#IHQ^c%DUe}^ zC=hYGIP`a(aLVkxc%r{Kov2-s-~U3w9_4nZ9qTC1{Cyy#01waXG9Hn&dz~J3ugGRA zsF>q9f-93{+kQlSTpK}w?;|<8D&Y6SQO58q)0&aQ2|r`_?!M1R(bek&E{jh$0dO{w zv#359E|9&QvK`3Y7j}+RIyVp8V(PFjoX#Nh*DM;juB2Pb5sZ_Fs?SraHfaFLPbo~j z+7<%Ca^}I9>a;1a!q*|}b75nPk+CS4jd(N0zGJK?wo>N(C?9|qa<=B5{MCj2OrU5^ zzV-o4cJ@S4LKk^BJ?CP6?k}Xcai7m$*_kOdJ=_-70wbf>@e9w;Q|nK)T&W?;FVRAX zc@~QjhV5o!L|7oOlq^2 z%a3^D=O0*Yq1sLgf=+P?U{yDDj%E!|vsHW)CZp_S(*#HD`iKf>iuQgYHV@Cw@w*pw zux26XX)D&u5Us2UX(AZK8{@%nI>@UIks`5TP;wq1jc7&vW(Woe?vt+7QD+);gmV)g zjvA*cl)KyAz+O}Ql}dk2(Ad+ZqWgM$8AUzBd50mPTFq(TBEB6IC#OdQ+0>?$CvrQr zqHAL27xCR&x(;sBCxAAyu?Czes$#@6gh}=A!Ip=xvC0-{GpgzP(LV(ouUjE!ZS5q# zQKBeUc`^Xmj6+kkiY0G_FhWx4mKP|uia;3DX2O<9+aE8wVv2w>Jia@jXAS?nk0yRm zGR%(!-54-R3urS-j-#YAY`~A>;Zg3-Nrjok;`Q$1v2E|qLx`MMZwHul6gD-r%p^pm z_-G);X#{=K&Bw!35tsMl4d3Ylvm591{A#{-i3WFdy3B)lT)JA(#BXH0HshdEYs zgK$ve&CeDAeX;)A-th+G{C7bRUEk8r52e;qnp{2tA{c2%266Gja!sKGj@zD$t|Tcb zKHRhnvQ9%9hu>A~H@iP5eYuZ!@`;l<{Ls>^jCI03mv=CmWwY2;h&k>x3#_)BJ1-d@pRp+mfAdDO-d<YKVwT zA!q4B*vB9~!WiG0Fe8_U2-54ZRR*lD)&d4ork^XvzK6W6wy5ww3QU$c-t>)~Ww#EN z^xxmlGZu{KA}Mbh@e8e(-HjjPJh~^ig?y0-))R92_L%)F8LZW!xdo0eLLg z@%CU6$3t}dY))vCn=s)Fw?-s3bHtg=uVd`s%T&q~C#8`b?~A@vRARQ)*m*g9EORK@ z**>}Nvwc@vOzKGAPnY&2IuHa@H`YbW%|pbo6xP%CZrg2fTBr(uR%SN@L|wP5*5q5> zAPltG!_HaVL(4gr>2)XAA}LQO`vvq6n!pLf8QQ+6lC7GlTG;eqdH~v-GW1U$|1yMw zUy)yV-fy&&>7}?a`xY^XYc%dO9Bk8mJsux-a_!BKz`^qlt9LM;=>>o{B2158NuMEK z#ef>Ps33RHU7yM%BA(-hh$PAgQUn*0%w)cl8Ykek=S3o)KCa0>69^xs)>QK7&H<4$ z*lDwM6mw04)tj}8>g>c@Kr;~{V`l>{cN;SoumAI& z-YO%JiO@7mT$Y=meaQVYg9D?&18_3;uQvi^V15;xnZ*ISJD+__b)zh8kipLnmEmHY zr~-Sh`zt52k%l~aNtg^0y_4m~9(9qQ@l_Y00kC2|tBbJ{O?F3L&dJl;FzFmq;veYj zGAeZ0RDG`q_ve*K?Mad}6(KZ7Ut~g|96$vb5ycPn&R}h`69>!|E1GWlp>Fi_?Xig? zeQ+r*qB746qvCEj?C$>@5>7p$30~5qtf9AnxFt8FY*k4~=0pw_>!QQDA=6a_^rwcr zD*3|p>lYFo!w3jVs8~&<9giG_h&RVP<0%W zNNQ+uJE67d&iU6tNZvgGk4GbL+Q45~{x1sXPz^$m%$@9_JLPJ_!wnCxT)fy@T6+DM z%4@G}Y7x`wUqcFlwE&R)n5EOLomnd)b4i+#^SQ|&l~{ZM$ZYsM?R+)5gdqQ%7yO-$ z^!Oid#L#b0^T-4UzZ(Y<(WF4yKuXu|&mveFu0_&cLHd*tEG;&nk8A38M$q6Z9f3we z$wkG*>wir^EJfK;3DrQnq+)>*5FCf)i-R=3T`cl%Bm*AtY4^W?@c%K9K}<>tMf;z0 zHsHL?|MXz|U!kCXS_=Se{}VX+|L|wCzkF9}vPPrx(e6ye#KZ*TPc+7_?1@T~vGcvT z8qocgN0vG`eNSW`@(T+7 zhGBi}{01o(LNh~n{vUpn|2LM&Qu0+tVk&ZgWW{k6KCn3=`E9(N`sWc5w)3$Vqr?+T zj>ddR?!3Gl_*%SCUMBQjqE7|lJQ~4`*fU{93*bWFk zEkWYR71b64k%$GEiC^EFUo#|cQYn=1G|?Ot@x$^J47IN9apnT$%3L~P+C|mK<=3zI z-FVxf?!iR3uC5tk`|#tj&i(}wwP1VMd_=&7mWLc5p^439h#-a*s%E6)Mz{Fmr`p$j zY4JiDjfX;&<(4t|hzzgaCTCsOIG3aMvmZ03pUsf#MzCI+^w7j`>#Nmgnd7U&ocMKN zH0b!-1vd}*(fsX*ubn?@aC))q*0+9c$;iAk?nHl| z(>u2bC=VBkt&~L^KpH$C@|4UZW=cu_p+daKN*%ZRE}Qy-#s_bBh9t?l1h^ApAUya) z*_@1;+$@7MHfa>pcXN~wG&~9)!?rB^q8feMMW37l5=%&tZ%41qw+N){S5qvO>B)8* z*;nOuA7sb#V6A3woU8{6VCh?4$@Ka~@|3^x3B55bnu5LrVyP9r&FCX1;LHeVq>ZC0 z>ECDT+s=A^+z94ONcj;#-l^nKu*+?cbv1Wj8~Z(ZA>zmB89ZM65u$SAHiEashqe3?I1^!DWI zz7Oqf`FL$oiC5o68G`XWLcWZwCyd%g&-)2`HF6M+$lE^JK_su4TQOXd?{#Uj2m{@9 zW2YG6#p?jGj$+MA{h70FEDHpS=S=uLoWcEWG0w_}IND=>87j!SnuKh%1A(F3vEnwnMy-=b>gDEH+J|8_D4NDpvh@@4D!d>mN zPMEDEnom?Z;I^~Mceo1CMh?;b9fG=5>G=-h1$*D_|Ga~~N);frNxC_%_8yhDi?Rd~IDuMaYCn<6*dedYH9XCJib`wHcCe;z2F zjhALR-WgKGSw^x$94qa;I@*x+r!|_qSf>onalaPx-JTqZ2rV)Q>twu~*Txf@H2T zGr=j+@nSZSH_`f%_{E+iJnsaz<3}i6&)h1!B}UUx+JYIiqZ~|!#x#u$izQw9J?G5c zq-8)w1{Wb$Xi1mo+p|K0>K_D&vPR9w~Cgcg~emogEHTbxh8b@YC``!1C@okaOz8?iu|=PE0F?_>kNjYukQbg>Wp2?eE* zXLhn3V1J$auHpygAOqwjpbS~E}IDOPo zmz_T!tl8?t4kg!C7mRR%Nt}PM^yh9TVnTif==Ctuo0M&~_*k zrvyH9O)XbztbboBsN2+Gj*=LTXetr2_4g^6z*pPd21DRZ{M(1IyLOPQ^Kzw!e$+G) z0%V|He+G|aW@r0?T2T~^7c-W7=r^oXxn?|;h>bb_;3?`XFnLNK8;{*BZ+oJ2aFvIX zUx~*py$iQI-s$*D>jIrO2jJWWjHY}QQYpe?dG_5bqc(jVpl>ZU3FYaT)9D$@ffMws-hUdbH(BI4@jFUcjUi-9B9%wv1fdn!VO8(f*63 zmc*@Jb$RaujxW2U-FUvTxT=p_Kuj<<(ZV6lUEQ(#{9W%6!q=U>zfchDT;Q9T(Y=v^ zI4Ys5UXLp5i^I3qh7g=b7}k1G*$zNbU@~EX4B>PdkON%cl)`O)-OH7vew@QK+F^L2 zYI|9u3OEJ<-H>iCz~u3>6R$kCCfkg>Oq5y+C&Ye_ld)-FGRXRR;4J_V4w@h&dH*kb zt!B#K)ZO{a*8+7m><;-%APneY|C|b&KA+*SU`J8_0zp5KN7vV4dXXZ|@iN7VFiUzK z+Cr7;yQvO6_LH223N_@aCg9APHFIWMrNgDGF2KuOXE=3Gz;?7tB-0Y`2xHwj=5171 z8+a1|x69nTJ17c#B{iM+ZsWa=MAocC*oAA ztil}p119t*RwnvJL?nR^NtWn`fii3fMG0TeZq;qQQ4wMy1!D&`S#cO0=1o*FZP%C%kFYIyX@(tp=&|qq%4ZAW(S`F# zqMNT#g#$*=2t9=Y*&1uuyblTfDvJQh2 zNzvZvVup=gG^x^LzqK`pkSNECGDQ1TWmqputjTlq1cUXP4JXO&mzo0=YEU)4F zILS2`E;so*`Yn|)@6p$5M*x3;DNrgGfFA6xPl)^Oop^g6EoU{Yjod5tg?51q3Ej8c z=T^HIcHvj!Yp`Ku>~ea>_!cy4DF{A zlRr|2LaxU{q{X=9S#px6z$uuI43#db+mc)AB@B97d_j*4+|HPmOh?gpTFe680XMu-Q#4ZoqPo9p5)A zIHzqAH`V>zow|i~$PXl(Q3tv_k2o9czj5 z=p#9aXg~}gUZB}61bNu_caorYq=WV122_idPP@UxweOMU)@9N}Wc^Led_@6k!zFM8 z81YhjdEO}Hi4A(TiaNoKjn5jy~XqD5|NvnN%Hs z>euwNQmzM*kL-@qY{UYO|3pbI^n-A~sCJl=UN5c)7ng!L#QPn&N@1oWUQq-0ix9w7 ze!j?*Ng*c;PR{W_kLo266-{8xVto-3s5|froMfiWqQ{gH+ip6Dxe}3itk>-YBQnV4-$i*838HhhfrR`Vjln zcz&_IpfVfs*`PS?QL^{t<=zor8Zb1HazMl{jgFIFzms&;?+%_BVbVf{N9YU z53)Z%kDZJ^VD!O%bLn~qjNKtrY^m-)uh9R<1f|6`eLr&i_x_y;@|!zlOnxbX#tGk0B}a8B_1pY-9|c|?H=R+oq_j8o*LZyQyg2yU-sc@fJs|?=2zB82 z`Q+98Gc8p{-)jHYB4#T#PXoJS*{7;3na#q5R|%A;)+i;g^(E=;iKk@K8NJlreO{9& z7TNIK$slGi;aSrd=})>2-pbVd5kHcV**M9_%d zDf)^~3!YltO=7Xj`uK8Y{_yg4r@V5GiIstoYjCU32oZ=6L2!r9eZE;dt)^pgnm?a! zDW7w7`QckqkdmlP1V(SXqmhx9UxTEAX<=)dMZtx>JYy}a2GPBbI0P4}NgEX;F&OuX zp>$BOWV5;jG@wU$1pugow@tS?OVh$t=NI7{ded2VdDfwWYUEY#yJpZGB*Q?be{=jH z?s9=kQ@}+D)O}$G6NK&mkJ{ckEROE$79=4F2@qU^CAbsZAy^3R?(Xi^@P^<4f;8^# z?w;W8?(Q`1G*cvbf8Y1a+_`g~nLG7YcRy9tRi{p!Eo<$yPsMooC)F!M-Iojmw-jVh zZt1u(YlFb;jWKn(*KF3@lnk%Bt=1L|JNn9OCfx0YMlrwE28j@4yqSWF!9skmN2Ui6xdEfdPr2teoBb1<@_jMcVZDHu1^u5sU(mtF{QNJZXM)}ta#W77)H{5=t#vTwrc^ipG z|5pDL?5Z^g=8BB_EySSy{P4#w6Y-ktL8%C#0O~9O-qVSuAuisLtG(ELkVm17MyFI5 zC-Bz(x-_6y$gbIQ>fWra(Zp(u|1r3GDg>K+gheZ@+87~2X3obsOnn`7Qh@d0lIiVK9`W{oVX0i@%kI0=IvQ@q zmh<(36PB@IZ=(6?ztHm!iLYbaZdleQFD?srVXqC)W+@+W&*c#$!%r&Mv?>e(sH&FP z*hxc-!4NYiqDw|{)`3vWPJ3=y1Yd83po9$LqOcv~ex|`o2Om~}McA9XCQt_4)pXprGy>Bx{XCV2EWR0}{02>ySvAEKjn*d>aW77Z*mgiDPPT4s5IBA0Y+W{rB&yr+-(pWw7m*Sdt6I5y| zSDPor`rAvATV%rU$&UuM@T5<3oaNQ;jvd4>6H&iur(1fbu$ZaX^o!1>Qb1xhrJjL~ zQkO#p^BWoGdU*0IHty+~&exoiti-oB6}&2{dsagTFnNtdll=aTfBY479Ga8gRqExBp*h^-oYKw@R`_ zKJD%1o?kyJ&%dg-Y2{BT-w@fJ1TE~A+Z*CpaTIf|TC2<3>q{&3A4V{?w)fX3K;N#D z-|Y{467l(#pMR|038*j|?kq|j(rHrnIx)w*xjK%gd7O0#;&*8WRB!jz20b^s0QRtO zj@k{p54%(%TeIg4lg{rHR$Y9AOwGm_ozAnm>YEAV%}=vnl@=a{jEvw*{tu6t53)Ot zaE>-78>w@V-fA^-A1QW>`~vS& z{-Vl|OG^2XD|5=oBe#ts?k}a1C1)A*QPWDMG@Uy z=gtH%ImNB6Kgyr~AisW4lisoz#W@MxIdwa+&O|!SAY?vk2W^ZZ;Uz${NB!CG{v;j0 z*g$$ENZ<`8Pf(YzY6fp+5*=}790lh{7cIc#&PRr=fC$RH$73fYm;R!Hv|c`~Fhsk3 z&)bFjH!Ilob_J-t`*ek6!k_}yX%UB7&1LQF3V^)00g6|-$oOS#^?~dBr1D^xCRPzx zaFpz){E^kM;E=I`Y+VbojzU>N@hbU~q#b3aZsb>jtrv^5dbm=w3oIIYFZ6@^@!I7b zXU+6GIuaNKhOkn&rFnm(1I5xN$wtT>wvHMWmTZeL2kLQTgC6?QIKZkUM$0VrMTQOo z-R!z6j%G5-M0umg3J&-0Os^9IQkZVWUpx$K_xH#rO{f{Xy}u4oOdQ#7raW?cdqQq} z`L!q)yrA2VT?5EtGXL%P%a%|$^7Drkr9wuR z<;x$+ulHsQx0*r43@VSe{ou-0ZB%+4v+3+$oArOduLu=;NF2A0XN`e6Vy;P7gxtxV zvnUKY_R~=o|7hYX)VDyJc-+y<@4M%t<{?OB#fyh?ECGjKiYR!otR`}4UNDYkM?GaP zo;DUVr+OhJpkqt8B7B4OAUU*LDSSTh<+4U|ZMV(KMNq%Z)%>Nzwkx?yR~RGKW`fpT z(1@9iMQ2zQ zv2oh|Oqg^YA-{rS+&%$O0(!$*H5d>|>0#UHeuD#?%%nkX zwhYmRN~X|V+SLB-PpE)&m7gtdzJHws+bsN|lY33wdw};TC@$ELScmkVc33RxK*hSF z>Eyx4F3s-a-F#1#Zz@#hrVBE(b?<3C9MlJ-G0yOh%=9bZW6k8d#7OkfzU|=9?Gyfz z9{@@rvH@wVoLOZyXJgHh_u&h6IWm!z5#29b7?Fa!K=^HCaX3q;rc&H`Y@h zrpF4Ce<#tqs0Kiu?eAty;Dq1*hYJE|wo3^73lRQ)LGAuqgQ@=;=&$j&b}%Z;UT-|J z3B7hxAT~BkTeay}mRO;3F_+^`+q4BTqzeXS`e<%B^w~Rf0B+n{J^?B{fmHe*a4+qW zUZ+Ju!``Cp;mZE%seu&K8gV2}mlnCr>7Vce;P5={r7tJeh%mOH$DiTTzWryd z{9kDvwhi=&arSn*I2Ea#J!;A|)0Jfgr1000-+y%C1TMC*t5%^24;E$up(*)!56~QP zEGx+N(lE3UZunowbi@^qaF1v#P*j?XCg66Nk$1kFM);4ZTfth<;KzXKr03+gKel*@ zhR-4qmYrnbJ?U=pd`N~=bMVSzV-$t-P#XV%bb%)}9c%L-d+qHPT)8=@F|FC)epD0V zlmycWKwI&~n>3QrO}rdyDdgmZ$K$4J=Hcf%_>Dr)F(_ylaCz)hYS- z*nb~C3vtU(z%R{aQpbmOq7-if+o(d&b|1s(#N0>#E?vE`QAY=$-u3xpB@j~8T;RtP+*VycX|4 zJwtQ!2{&MmdMe~ez>ug&DUE8TNYwX>Mob97q=ZapBP}vWL}$_=vC0|h7B-0k;z$d_ zeppA@D1Yy-E`B0|s4rV0*5<4*-^{uC+*BlLYjQ9FD5S#bS&vO1x>T{mWWE(FWyjds zI(h$UZ=RVkLjpgSCy(sNf zowH>3xJ1cI@h6ru&4y?D=fCR)TZvNjDJPX!l~gPW=-KWJTJNAN$Izd?{%@OYgiE>a zpkt2HDP?yqEaAO3WKgGmFTT(6=Rg#|m(*=OM91R4+dJKGuK0mI*pIvF_E>jc0L$=A z4BF(VPv9gqCfTEOt%a^o*v`%<}Vnm zxQVn@B20k@NJT)}XPqhk41sReaBKOY2_NZ`R?yrJpSNQAAyhwl8GVSuI zsGQtr@7?yr?u_DmIj-AzeY2VKE={ZEsh*Dvkyl+A53eXn@L;`to8S}e-203%2TNU5 zw}VDKnu9423$w%}USByoNxzUauhxPerI;;_0TZyaI;nt~zn?PLCg+qvkrYa98`L}9LW3pQ}N9eA?J`OK0EJ;@5^+-S!|8k6GtM&m?(B|dRO;XSgzX> zQs6#KX#r46vpBy&(@XS9xf#;fJpBH4hxho>+LyuE(j#4jnQz&$a6X|5Wk^HXMz4@? zG=)5ehnc_&y(AWt!8m6EB17)PCnq$^%wVZ^Q|`{-2+-q3<7yM#pW_xOQ%AVrseZ+l z70B-zi_UG)^}?4mm^YCicMRFjHn3?%;?*&jV_W*ZL90LK?JhP34<)U;)d!CZdq{z4 zyY9PR`|LAuO;JepxU~z!WxK9Bu2sQ{`)Gs&(sw`hzxqpx5AYAxC@5){v4KtlpA}X0 zkjx2~>7v|nM^FCA2 z!MJG#;$_>hMz_%jr&LbE>yB7F-)xXE1t~QQqNlb>+&UA&!KiVJjdSj(x;BHgVxN1% zPi=rrGa?nmh0nk#852rWB19l>67dq~bHAQPvu!6|DL?hu?+RTZEPgX#1kJPuY>gKy zg(Yd{DT?Gl+bf+!pSo-U)Ul3lU%CSTNQsk#$NP;yvu7Secr2bw9>b2HRU4(2u32v1 z+x>)QCt9^?*XM3g5zC%an+!oHI$P(1W%?2s90Rf^IR&RBYrCO}c~uEm;x=;zOS+H< zve|p9sHV_)2Ot;dW8--kAn&Ba;dCu{^7x>9&+COh^PnNN`8cK6@4}mtF!eeclTV6; z<}>@))|}`vAVjN>bWWGy{2$3%Eec%J?$Hja98g)d$Vj~S28@*RyVPS=3cfHYD{klS zj2wGT{@`E zFKV)s2EwQThvVujs1kBtALLzoM@%D2_rw-2GL~0(E6{o4aOXO+)5V zd$vsoLT-E!HcqyBL$t204>D_2qA^6`w}aZrwTsb=S`L=;Yq8^2U!CW;=eGkQEN^c# zYPN?RX7og)?>DZUas~BwRtFHUPh(|L^W!81HlOB2Q3a{@?45DC)^%XS!68}Y-fHy0 zVf@KeOi^gC7R_)JaqF=tmCib@LUoGHbWC{5vCMs#OwQ+xqCP~;I`_el+o_GgvmA-!;>=}T%9-*{~L-{JpPfPQ2=+qp9 z#HWUXwY()4o~mFy*8x3a8rDVkJGjUCsH5R$4e7~_La^?vcn%Fs3EL>(VA1I*yBh-nO>uTHiA zmJ%Coqgs#Uy%lp)$0kOfYK@tYU5E1q`ez9v*t=<+8L-L~nLa+!j_jc1h8G-{XSF5X z!-_dU+O!1Hw@D~^5P&mvZzeMhIG@~XW$dK1x4afT0~0TxmuO5bHvm26l zn|#-60Q$?tHMI8fwBgd5l)fZ&&Fj5k-$MR}27&S1M^;&mMR|Uce_C|PPG*BP9_lw@ z6Ov{Kp&+M0{Fr+@caCkrext8+Q;A|&@sQKC-m8*NYyNz5-c4l~PXr!v0!Vq~?oT1>^>8m?A3YqDKtrNa+%e^Fc1JryZ zpK(tJ<0R7ZCMKQdM-SDmDJdQ(BBgO)Jzr6ZZTnO+A_@J*%Va%!FoJ-W*^OA|A~``F z()T(Rpx~L^vlytV?!0$7yXXN{`lTF-~_UD$cK+87#^yp~J`cm+PqcGc1w4R&mn~z;1zMDBW+9zBd{a zV>olR>fyF(bUrv#&Wtk{d}s{b$ICC?>4yJsy>yqwZq;YJc=tHpNR*dX;xW38_c)3( zK`OXMq`oiN#FSZIzPej_4*{6ZN>Xapa4^j%radg|+h*TEU@A@{S)18r^b&sc(&hZFqn4l0LJ zyoLtwx9^Q1Uf*U~^@E|zGWYUMj>EMc^Q-`Cm0h4yHlw(iQ0$1EFZ*J>HSy8OvVBeB zi0Go_eEr+%Bh48RUo_r=WcTSAO*8uVbKV7?6Wp8mN5_>+GP{dL6}mo)MeOtv+f_#o zy@xC#$U}*%i5>UZ#TTc}%PbL*>TvquZqebzF}>lij!zzdPjz=WogVZwLR2-9g)Mk zrSxzVAPmf*Ih34|PdQsCQc4va)IMumEB028r*xP%30BsIoz{a`6!2y)znFxvCiIe? z<*+dHj@N^7Z=N%)g6TZ^#CgN7-r6*dH>d883{e-$%uz?V6`_RF+q=35;MtO@Jcsdl z{{mBpk$0iCxx4C3uLJ0G=<)h4$s6Z3i`MJRl$l$4nbF9oa0%$exv5#LtL3I7rPaEV z_a&aJYH9t**J#rSX&al>`U1NXwEDnMSG!?#P(~!~1keTenwHz#U4UjZF(Aqo%v+=v z!L`{U@Y{O>Npzb^0nXS1-o-onJypAh&d<&i2n5?PV#L^@@_KG2<-4K5r*smrMaUfQ zdyVhRvS#WXr}p>zkd$I60nRU z6wp914xnGrNR1wGDMR9TG<`7?-Mp1Km!tV~53-&#(P{}xQCQwpeEUE5q*~p{cX!X1 z6+?S(SJpd0Q5iKdh0Hzv`Gg6nsmbP?<#wwBsdNii;1m6o+#rv`^`vd@nKCPpuJNGC z$3qFbRFrm;4VzwR++#Iscl)t{Y3Flkt@`ZuQbdLr)Q@b2vr*Aa$9#JUb#8@YUD}JW zi7Dr2p|FuARpWl$F@TcksP|%A#I@>_v_#}^Z`b8PWZf#J2ttb5Z7N7hHNympLpckH zRwMI3dJb>CJ*tx6CG$P^E$sE>_deCfpPu{iQfe|X-$Nc}#}-#dNj4IY9QU^y7AwVd z_r&g!XV>337m3S=dD1@)>!;Z>f%G041{fz3x3fEBzIz;nE;eU!qZ_<}SwX^@S~zgA zA%M|x*_+7MYxnPcdH(t?hGJmpsMn>1U<$4FC~-fn!K% z*MbeKG@%IQRvvaY^3~|b&Hh8xKGFqpK=0G?K-lmO+LB=sp2n+N44J7z&PCF1PnUk{ zbGVasox&`JABDk;&;dMenA+#kxjxtre^XuGQU7+{`q-sPn07b1hzipnQX9U>dDSe( zA88XnUpZwY6DSTFCzjJj%$!_0-ZEd}0_YRH1rK4q6y4 z;2g*Le_Px8Fak)>@2!gqU1%1R&iHsx9o}kY8TmI!&8un37)>+XiQsK^4ZhpEo1BhG zX-cp^uvdZ|&;Na(PYOd7j`)y@3V-X&jOT;9gF@6PhuyAv&0U2i+)9jG6ZF`C414qI zwAqzGDIr4)Lf3O(?RotUcmy!+aU=Sa*(MCElRDN7o+4g(LH!;r1&uSVS|vxj1*eh4 zF*y4QH%d&fJM`GgLwxv`1D>8768qCX-yoJo=iZigO~VZNKCl{JUc zVZ?B>^@~^&>(+S3>v}X8+bCN$KvRj}4V^!enQm&%Esa#{Bq61F2DC4n*d2KXU7hTm z38;jMYIGG5rN0gwFPUiwU$Z;nbbk~@di(V&BK7TkizBl|`beWG1 z`&-??4eKQPc;PLXno_^I%>y5Q!>a;eE7kc(tHfNM&Np|Qgkqe5jpjtTnfoyzP824;v0ISrQNa%syAEV&OK)u&G_PGvC6xW;gxjA(&Y9 zEMv*bLikdbQH9Dfyv7s{w(T&e641Pn^+OTLw=mbX%Q;C*Z;v$ahdzvW}ZmHUKx*FV@Gp z%ZaIxa}c+L#`UHLoJgTu;OBrwpk}T%FRmh{{QZl%)ko6Y3;#@}U`+^V5b0)q$X1+? z)vFP;2OtSKGHG!Ycz~M%X(^YRT^pN%X*H>dU)DRmD?HR6Sx}|p zJx}R|)8PfFtNNd#v%W1ZdC>$W<)6{f*{9}gbv}RSQ~E}}ws{S;K&D>a60#lU{2Ms$* z@Io3a;GsxFT8>9Y55}mL8|2Ov3#GqORyLWhsxp)Ik2H-^P?H^rBmu-Oa6(^I7?y}n ze_ozJixf68I(GQ!T&LGF2-6_c8gW}|tJKlc)3u(v@f9_@OtPB8&GJbi!sWi+SjUKE4`2cC0uvUwO+tkC=8gu}r~BPguIkY#*oj5iRf7bXHE& zd#BY<9Zi(R?4t3`y*blWx3R$M$P~0USJGp9$UL^Y^{nmC?`b-@l%(lXQk1e_rC#UA zH6nzcUY~FHNld@H0x9KYA?w`!taNHc^}WjrXLKXpOWj~QEO0!^Lm@lcFeDzIt_v&b zjZNmDrq+NXMzp7B-VjXO=3YL0TJ?|6HA?Ht4-RA}_AHW1xUgJ=BreLHxA?0u0e`}o9mE3NmGx1Xy1;`z~o3ISBc_;_P)crGO@yZsKZ1|l5#_sN^ z)?BUN5CRUXOGeptK|DjyT?L$l2x}C@XDqXX4&g>2E-cElut2lcrveU)Xc8D>qT zp2Rbe6=RqLgkcw5tMw+mPI)*-ytHVXs!tVpOnHFGJ_LceA?zC4-2{k2(~9WlTM zqkXvVaGzEYudhMHcz}3Z(cjrEx4TF|1(Z)}>Holw3%UYbveXDE!R6}uk;<|Ch*DZ7JY?gy ziXia7>z}<3sTi1t#j;VXL({229*g-#aJ|itD?gFDs^UM#TQ`l|rYm}>s!oxP3)Ufo zB*PvNP{sVGDbT_cM+-`juH{PSq)ehLPqcgO_aHH@qt zGMwiA%6M2GAWwb9$~vSpOmRPgW+^yom>doi_synTio0WuF1h&5G0F)vAy75y!I(Mrvzlv2`0S$fZdPxHn_1XK8M?wa^wbmuAz8 zU{>2&UAZFr{ox&EV$61aduVjmy}sFOTh)CeZ=&~7*|f%=8Tu*r8%vCdthoK2PqLpM z#pHVtIlJPD8K%hGiTZqU_e%!s&Uj*y?jhAkK7j*=nB)i=tI7$_{(%WG!8#caA)12Y zp1gmW!QMyV_-LH(n<_T0JVfsAjrc1+BQbW*R*oGN-)vMaR_q*8jG>Vj%}wV`AZ9n2 z$`OJ)SA{vVf{f?calc7giufN&2sF!WBMAFv9W?EEKis;M%b)AC;JT zjC+himHbRq&ME5`x`&;LH(5r2aBp^6yg#x^J7f2G_T1bEdC?!zf+^huPH>>Kr@p6> z-e`**75|0f*+}R781dphs2TA1a<)dgvR`_TL@DID-bOi^j`#=&)?LOV=Ubutj*Q1x zL)cX&lJaT$hh`Nmq};|HgTA72>v=-@q*{lTU2?jrZ>p2z-)*&HQRuk%^LhRCc2Fvl(f0aA9igPc8sC0lz zlAAl~{RCmx4UYMcQig~4$?YZH-+us;UXKohb-y=9B^hA3{{3+z`TynmNLy52uSPy! z>-`9de{L;SUS7`h`}wqmqALDf+*XjfRevi&!oV2(Tj%^gSmypK^!uOeqBu@wSfc|8pa}62Q-W-a3yuB2JB`3_V7_fA&eq_Ry!Ce%A@6nQnEEiPQWeC%dC2 z7?zH|>@gXyrE=5#s-Cu^`W33PitE_gPnl*=>Oe#NQ-mh7snSdK=QKyy_K4YQnWxT10LKiEk%1DR$lADg7IdMdAxSvMV==7zaZ1rh{eflvMu~5;iS};;{N>T@&2K@fT09b({i-*VQsmU?C10u$s;!&>)noeAp2%rXADO1TK#CSs z8f}4rTT`rqxY+XBixA$62u)i_8W_jY(qsuVbZqOA*F^j#C&33`8m#QD&y&g)XEf7_ z%8E+LQ&otb``;>Dm>k4QJDRmMFB4}SYo5%CkBuDQgr7!Av_5PnICwV}xNzbUj`!c& zmc9*R~PP)t&NUXtN&af9q26>ID5r9Ax#;iU}Z11s>$Ki9Ze@nttm>a98#2f zT9{*`Vi|9PDh9+*A`S!U@xe)b`Qp!pGmH}#8$MAQMSF^F!OqpCyXjXehZh3A8|_O+ zqN|*jXTd|NmGF<1l-wj%?($>jv!#Zm!`|8+8ex5uT#i{gFH>txcix$UWv0GmrK*uY z-p2lBdHUE00oN|G{J1p`t5Pz_9u2+7IP^vDGuX+~4h@}7Oh~wM-s&5&OeD64KOZ6i z4-pX4G?RVH@KfCC`O#gKFDBZ8$gE+60g&4v^({rvnl(25U#w-TLag)3Mx+E>${YDK|RwKuI@)*=rx@9MwH=omr?E^& zN1WIo0lED z5yohD&eqfI$VRDN@-8;!eNnLcHM8Rfes5*AxWq$raJQFO7#zj{seQwg3usE`8}VN? zb&fJW9k$vw6RF{~Ch(HD)pVcrsN7&H=EJZmdLJ%qLn78V}>uv4+(1}ry3{D>R4 zKvY7z$8Yiwv)p{T1Fl#Y$euU%%j1)UCTFpB8fABetl!nMWid>$<mNYQee&loSTP;CQ?tI!7lots7CWkGD4; zy8juHiZ|=;De4<`z`{_hK9tk%r5$~>@{J2IH>1KSuOkT>A@BQ6Ol`;e?HfleAzz3l z#T;+$`Har~jZU|e_{R`0BlYR9MWcChIMSIlcNOc~HaYZ0%5J`1mX3tWxug>*j}Yu{d|jh<8=ljx673mo*xw4 zuecp8^{#~O2JdQo!cM=|L8F+G=5E8nLA{T3Q%c?KOW*@d&W>K}b@pAfeevgo>o=M$ zd#ZjY)glai$5LHe>Z4hniiHdGA7~A_b`yjDfxYXGrgzWFg$(!zz=B)NY4g&}`-A<4 zDWt{Xu7#Z7O%|U`Z;S6!e7C_Pqtc0OEOz$1Ww5&H`|W)0%mU%i0!k(m6Pk#;`{(_} z(C>Ye>Q;U6^rde$d0i%c(Nzk*FicQ5=qZx#qtqZfL@`bUJyTmFXq`3r$NFTwj)GW3 z?I>}m6zum;%ym}QuHBYTySo3pWqC%CWx!db%$~l20-=0`o*RP{nohs zBql*h2s9z;xbxzv&-nWMmzd1em-jLeqwssyRo;vwyUVEGLp}Sa!-~Fb__^T`XyETx zsDRMw5R@GEqN0R%bMA*Nx;y8qq~9AS4pKv}e~t~p6@atD5AFG%Od#j3q zLTTF6q5Rtwo+^Z%c4lQaKwsL^{%c;JPFzb@dFxoU)nEZ~v%tWe70ptAg`#x=d*Mpp zz;9DTNIL@vN;i6tb@bpJ4?K)|g@=d9qSe3!3|9BvMNkI8wG@WEfjOdO#1+w479(0N zyYgnxs_SVnKhtC6W3{lB-(OM^M2s`841!ky({1M3krr_tyhya+Sf-H%VF}+7CBG8j*oqvwUx*L&3jjM$*{P4N9SpUvw1Gd@6N1?H0$J^ zcfYhYxeNDLCy(hE9lSIRi8&%ootv{$(0+2w7ES=CTdP`E=tA@?;DNngOI-b?(cO3g zuXFoC>1UAZEMLw|G2>voFL?-5M0~B7F_rvt5BTZ+eKcShG13a9Cs_8LVI)UF$93?c zg-cDsslsjcO8J|vOT`6s@OYeFd|RR;tNRDDbKlF|`+)ywR-9lxZ4zCVC7>e66TX$` zhQZ^u^V)i?I5(SD96{r@KgpRtM>zw7TaTY&3ah4IywyQmqBaC((!F4e3U6;vR-DkQ zaidPY!is_b5?1xy>2xBkMBZYGZMl@ERCz4d$|}4vp>nC1;6--Coc}3@tHyrssEaV? zoO+8*yL!Qel~|%awb9uELZh%(u;!$@j7Gt!g_uMuW^3%ycF^<7SLXBIYeYYx=Al83 z?!cDwJgm88+DVPNlWZ#37pI4W^frTY>ZyI0#pY2wU{`nxxZ+KblZhN7S1Rrc)gTQo z`UjCWvSag+H4F{I+Hf~m7i?n+-fcoa4Cgcd`f0#`33M~yq(*NlyWH2^O%(|@H-kS!Q^OgjWRQ)2TrP$NTuKB57a+(EdXD24CJy-LP)n;#KsUs!- zOco$pTr#RnkREM0DJEJ^FLiRzvtEMUXH-LGS63lw0p33xKdKhJ!yXJCgJ+wQ=xn@o z5YaB%!!AE0*v^ct^8Lu9Mo;63WW2Sgu^AyZk&CaWF`2~q<$!bdEpe4%A%R~_s3j`* z*!;`hN((-Zf+|}X{$`iR$FrLComnm9JwG51+WZd;)hA}puuqjdvUFfY$%D!oMP#h1 zGyRw5DO|1;)vY)@U-D}PuM=tl`meO!l^2$2Gi+n#)x?OC6Y)Y?!=I23cOHe(!K=+E z=fiq7HMQ&(PA~DCU<_9BwRyCMvoXKg9q78ApCCUICi-0gP2=|O@wY*L8h_>C@9Jgg z>d2Xt-rmq974fhZ@sp9O_UUGz*Z`#{#3puXI5d_qa0BiRQeYi4`i)rMFv~XC3?fgr zr{y+S^opbEoB3(SD$^Vq9+cUSuLNA^DA5l|t^|!3|BOZiAo)>jZj#nL~69WLc5FOp%OE(P8(=LHCH-u~QD5xH3 zL=ei{4x7@BK>FUI^XlEiuTYKFW3P-)gE&(zr}Y-a$c?#Z7fR#PuR!I3Hrn&;n;yF0 zD?@W{-pTZu?uGr5h+>C(No8LbYL(ub>LnFUHvN)@L@Pc9E!Pk%B1=xDm=04`{TW^& zbKuqYOnh22SgnO!RpaKCv!*M%qg(j{_X;<53RCWS+eTn1Bf0QDLoRhx84S-q81`09 z9K8}Jd**$98Ae-nWEQOknvf8uV$y8ARCxQgwyJrLElcw#SVBVv!R|J(c=;yU!r|Ah3x=sbrgkVaAUlZ6x?qlL@oWZpuH()K6w+xVl;Pim;@=d-wuxmih&H zS%kn7s3A#3E9ZX_izTiXZ$6rXE0oDEg-K;DokmE{2Un1cT{u2yvAu}-E>%1$F!t~Y z;gI!W{{VetwDLCnwa3MQditx*=bqYJH(1TCOCGfW?Sz6<6;aZOnG$^2vav(RGuUh7T=I38$6;GZ@vYN$kSQ{Q(nwUfYt!vjowmfLZz}6fsz*tV?Op6qmSB1P5M`LzY=zw7`rrCEM#CouVQ3Qa_o& z5@r>ng0l&abCy=8R#WEad~k1y0N0!lQPcR=+1O33={%)|i&q{HHysy0nYtw%^Ag_b zt%)ZiFud`TKTt83M;5SOWG0s$CehXI3ai=+d*-_V6&5npOGH1F?8i!6aO6a}swCs&n;yOrz9>iBt(8Ess=L1ILTIe2 zCI|{Gt1FmpxE-8?6RlDxzO-naG7zz8=VTpi$?MJBS5O}w$*<`~<3C-zhNkTDV1xoH zvy4u~mzwGLCfU`Z^FcjTIV}038di2ek*{ZZbn{58r?A}J15L*pC6x`>T|y@U)Tl0r zWH<}R9G7kcCZ0f}fWg-sdEGR}A(Pr?g6We*(%P8?+IV#miWE4Ad*wWywJy*EHlEbj zp;nQHuhL4o_wW<#PV8S z@oPh`SD#3WGIY(5GrvP*n7|n+H}FnFsxyISAJk9iG$S}uND*!kwX#PpbI>R;FPu!H z2vsD!IMP`96)^od^oLUCXCs8>2nvz=v|jTV;wNO&>Zm_6BmrNom5u2avw#@)WN=vRc02|kyMj=x<6_{&oc)}*XkLmh z_%_#6JIYx;$&``VBDnWH2ecF+H5Y0>2h!$x#Jb>RQjV212ut^Vns>H^Z=Mh?F_;hU z>Q`KMEk@muqm`lZ4s@XUyX(COd)$PzivSninG?!5JmLB(K7OXk!@(e13p+5rml)#J zwD;K^{yjpKau$&ft-SKB}1atcF(5UBdFNjK`uWiD2}0rsmS1Dq!=$gPcN zui|@x(&l#4Oj3IW-lO_;hLu$UugoSPdR6&d8Xyzxqk;V&6lCGHyTjtJxJz(naR|0q+(HJ7{RkO!c`CwEm<9fQgKZEYmB1<5s}@Bi@CDiHWI)9*X=n;QhBjdqj-( zdcT&V`bZG4N4>TuKt)AWa3Da(#3<#2Z@yHMZ5suhsp>cjm2p%e!tB`(%u)3bI?Fl( z3L|2?mc|7g9yqLNnuYZl=b9k6zniyi&|pr2Qi!UFwe}YZ`;PX1YL%vRuX~sn@moAxj+9R ztr8c+E++(50Y(4ffStsMNa zYNEpx>l|rALm`9>|3+I%s2nT#XvOwdYaE)QqkT|EcP0@bW-Dsd3Z>WR^#E?RenoZ0SI-Mt z{UxOmdOo@59^jY|#8m|L{;%rY|-*M>z3Q5Gx*j&{nRl*g~$C=1MC@ z4EHOgS%U@(5(A1_mV*w8M~ah+`MurvzeU8sf2YDl`oW$??bJM*@h)>@!CjfQpP4|Y zhqG3?FJNx^n_qO}5Kehms*J7VC4F+Z$XZY*;e!{WxtP4X#9=X?i}#SSdvV zfLLA;p>B(Bmk7(`@D(IXeiRjrP{!vxq*K6CSZ48yNVvWO0r|y|gR1FB8 z&snq+Mxs0hUfx1hUz%X~4I0dJ@Nd3k9u}K6b^gI1h*N*am1j(vi?TE_ln>w<;ZgR8e6ZbEGrBP0aaR% zU*qh@rP3=aQSPKO?$JVIw@WYEWhVXvBpm1J_YYdO&#XnJ)+AQ$fqlfh(XV}K8Zku?6I*i116om`$YpNSSq(@;AwV0bR*lf zXqm6j$qc%~y*@kG(I6{aVWGcE~kK?!&?CSl? zX8^PK8V9A+BC;Nz{5Q1=xO(7DRb2b zEBXCP1UjktEk=@*q)?fE_aWSisxy+tCST;M(IfTCJp}W~ZBC7O)tNwr55w$KK{W5n z4?N`3Zduau^V^jx9z)K=JN_U0OsRj3==#H{0bPr_OOGe2O(v5Vgkfse8G}G*i7PPiO;F?T)shoW8d>U_$hT}l8{4b}q@3aX;Tg~4p#$_R$ zoOn0CK8!Fd$GXl%M|U~euOHoDIJ-_v!nX8r_=uziZAsr_F4V*Wh5VSYB9tS>@22`n zureFLL#^<3Y9(FPw2WO*Cm#*xk`uj`6q%C__ihP!`tO7JiAej}>7>$qwix(Y(h<0I zep$HnY7p>VvF@c+G|vqnF?fN5iCWOeYxJ+{)G7NUiu%VgxGP=86De0|4x^5)Vr*1> zZpSUs&xImcK$-;=C3so@ZVzJ&vdZ2@a!u3l<@0|o=xHC)&b{K*Ei`y6?(H%GJhfd; zz2#^H4hi$W5FDj8_iv2n9b7*6dZ}BSvV^X+>fXl7h!=WQ$?SX4gA8hva+Fw^ef?>q ziCfIPh{Gljm3U2cTG@B=fBRZde5K&L)Y<--td8TPAN*I&w?$(m`dhkQ*^bO0=ibC- zo{p0FX?pjSM8M;8bKcQDp==yC1{z-QRuUxrI@s9LhLjh1&V*Gp)E}RUMJ=p;V?2@H z$0fa^aNscTh2k`!wude^>Js~q&pN$Z8X2y6gkm*NNs_kOu_9e#>fK1Nms0vh(s{@U;kKS z$^18fr6-`%80m<;+Ni8OiIZ!Q$isjB`+J*0j2htv8N|!7UymKdQv+%B>C~Tj$yJhh zXfntc1!L8(MXBfLzA>p{1I+_zDn-io9rkwVL>VJ0LHta>>dBf+i}dY_1v{4?i6#b7 z-9GsUgK7Y^Yt>YP9>Inv9*2?n$GKrv@fqZa&)ws3{N9^SVG+R&r>|6p=WtCtUR`I# zKlrE1YqALtUA4QT|9ahqDdlLS>0XhFeDF!ApkS2vjrlKpqK~POG;-;@2`iTyg1M)t z9bD`F8;Sklw49<}#`DI|q3*OKLA2LkDnx)%3fxvnA&jfas8kb&E!|= zPO5>U*y`Qqr|a6+(8`*2`Akb(ndVUslR!vVbM^gtpIBfZ;rEFR#ru1oRm(Cb;sQ6h zfsnCr^5;lfJ#G#qUc*gfe3L&gue8SCV-TJwcthXtUGN<%3*Z{;7r#BJ(sk{QEaz7g zPg1NSb_0Y@Yl-e69M?I*P4$LgfaS=Mti?7WgyXa5Nb2rsDR_AT^H^8A&YZ87th)*j zEqdN@10A_|Msy5>u$ul+;fRD?`LO-AD4_n!mc-33Z@L-Oktml+0w z@lG1xr|krfq;+{D9IhVeO6MbA1%NSHWOQtFkMazXz=3b^@CSX>v#=KUt~Tx@7KjRt zyfhG7J1zOn4Ubh1wNPF!nDk@)WU-?j5Ed)~S)fTV^pNlbt2CPwd_N1%WwS7Dn2nldtFw2e!V^0N3 z;b;s=?emhR8Yl6y4D~#K#K7Rr{HM+gF>SWJ4PoG8&`&@e)o49qL&e9@MDs*28%U-b zRFWW~Uj665N;WBlq)my2KuoEdXm)lMFscgTkvvSUgHIu6vPfOH}PF@wN?x5y4@!2an3S}Kb`DAKOKz6g} zxXg@G?Snf9CX75k&UeGjW$CZ#K z0`7`u#Z++QF@9=ZgArWJ3|nACac06+ro;kO(a3RR#(?j=?;|(4SqL1h%-Yb-(nrV zh22P}DPD8Tw+XNMS9)N3oSV-(5%JLt8j`wARDuN|O5@ZN`8ou;3rT7t4E;n62_TVX9RVqpB%dyeQb%m;f(#9?rgIwB?U~s5Ng&=A81} zG_KB^1WJLqdtkEbvqRE^J;QJQ)}^`pMI-09{OFP>OuOU)#VX-OU0=DI1MZ7kI!2F> zleI|O;vvRzqKKak$aq>|$2pV>-wCFK%t~4@zl^0st+3<9M&2_7rd{3l0!1B_PrYKh_H`XW*rP z)O?;8Gh)7RGnYG8ECO*O!D=+rb$*Z#Sl!^j{T(phcg&w|oVP@S1@1EO&}yrF{z8Q3Fvo+{Yld0!b-(vokDqbDOQQ`)pnxnogFoQqwV|T5 zB})>aXu*CyRLbr-p~$?lx9F7pG7*;b84`Hxi^t`Pbq>_dP0P3HiIcWjiEaD&)fTMN zy%aaerr7g**<{u=$wjl_rJOq{bNuha2ph9@i(AYtkQ2M`wE!j$scKhUGtoepwEP=Y z)7WKVXao~R{(2+f)H-vK$jV3$0YWh4U>=%t+}_rL??{ClG};9~=v|p3v-Ucxj?;&$ zp>6~IEa)N0%zSed_PbEXlLF!n_ig;t-GM3YgUKS1(OPZ<;JmQ4!A)Vk<4$ld{y28i z-1woj3hTN3q{U&RV(jd7`NWIl(k`fe12ou;lXdU(JTlu2$wJ%EpJ?YmQ)oI*gR`tL z4E|i0DJd`tT1*;CjgC1cH|k#V2`#(a>`0}&eEEAV3jH-_K;Y%$JhgPESFpE}6aLBz+Q{$3uMfMi9)s)jAscfRPhjL# zw(d|G2hy(PX?k%xav~-q8;)1 z?b2Fm^C$SA>>ie`so{*X;eT{Xfh<*;nu|L#&K`%;_g%l1FQbxw4PH z*!m}Y9!#R+frmb=$PFBhvL?V=ThckwW?~siw@t%XZjqq0U|CZBkIk$lf?rq1+*~8i zkheG^aLVVtSa$zIPZbgwdKF{`UmAXqO%jL#Z(ZBR;^l&tWnOUq&X*$B(d?Gy3tN}W znJSvJZTcy1T12@e=X#BiN{>pZuCb2I28C}r6hbKj0}~n%c36eZ4dWzyT{(Uu%Xi<7 z?wMUlC6H(SVyjD8Ezf~$7C!b1Kd(_f525RJJ=0H#LSSp!Tj7nFzlHrB&4wIUM?k!{ zZ&y9jJozwQ1CP|#?{|zb?TL8N_aDYrx7tjM3f@Sjs$krd5#;g$*R6Dyhy;IaWM{Dx zJl}*kT}R45N0x#ouEb6$J;&SYVC*9s0(6s(c=Mmckdo>(hBq zlE}U014Ef1s8A_;OlF<7y6({w_Y?YYBwhGW-i|KXj+8;2yqtx}qsgLl7Za3e%4QNL zDpY?ub9vfnYw!gx`cU1QyMvv{$n|NVG2um2(`X-P^_h^0pfkNbB8 z17in6s@DktEyAP(DJat^m2r2_a(9?IB7AajZ{jh?R@454 z<&D`w43)PGqb-wtWqig22J9M;An$5euC+J@r=7Rs@EW;vzwvDicnDA#8mK1inS2R! z8pgEW@IyTT3aqB*(_MEPZxjP~_;=RwB{CCpFH|HYaX3&JlW-URbN6PdQOv1KZ)9J? z)OqySk^*G;r_`pXs@L_hH9O=Jz&U*Ndeve?3gN}y8e?I{DPT&%dz%a3EXVnEq8s+w zY31F0*ZzCL$(6LoBa;4TdCP17F0PMQ(9x){tj__VP+>`6N1Az>evt23-|V*pv%gEW z9L$Rry%HGtc_*mg!+=ku%Xi)SO3;%)5Kssm^X=R|j(*Jf9Vu2JMdW_CVnDfkt^fXJ z+4@dLpS1(lD{C8<2Ffh8WM>6NiFSu18)=)QSGv~ydutGs$9nUUpov10=k>aMuGGM27u@+Eg~&l7_iAC6L;IFE8EC`+kdFLMx70OQY$awJXAj zz5Ddd;iu=3X$yaH4-rJn8GczKWd`x7v6@`6jrIb6mAV=Fj=IB+N|)U7)!E%C9K+|8 zVcptPi&Mf1-#@UhHF3Q;8{HO0!i#0@sNz78{Xd&um&kqv>HPSOA^am^@9If=t3!Av zdvSMnx<-0zlo4I*7XL8X($f2u{KwiEhwWw+V!Lqzq8|~_B~_*3D#Xf4D*N`4+`=yR z*Fz zA{5$r91Rugo)?b8NAuL<6JFV5%@Zm2O^i4sNFTdJd@pM@{65YB$~Sl#h)3LW%mwDa zMNr!IL_jcf%*u>phd;^0RxE-1a$=eI#OUZJILG2bpSJHi)Dz>WKX_NYz4F zu`0Yn_?>~+KUPB>;0JCagf$2~BWGU*y!199yxv}*Wn7ad`T>w!%5FQK5$Ak!3wK&b z{%sIGmeE500S$3Z8jn2x?RvsMFSCFh`JFVB6t@=nKTJ{o7bX55Of~PyqKfEXJD}2K zZv+#{sK+fdI~dTQlZ8~)wn+m%&itmAS8c?34~1VK%Y@i*ncz&ZozB~P0Iz8>W|JGD zKrTv+xA!8&XdA?jACgjV!f^@?l3qb(+{uw;W+a8;lBxAWZUnojXG4kB-RdkoEGj|8 zfKd-g_j5B_hVNe*4)uua#V-Up7AMpBPbu6UYIC_{&|NFIVQe>Y(IQl)f z|0Gw(2G}zagdg&oW^weKyzRO38f4cyh-CjtDXKSU+4{yt z&wAXvOd?*M73VglqqS{O@4-!&+8F{OvM3JE=RH&T_V^x53_rNJU`4dHyQj!)=mm2UZ}KEv4OqwoTe06%rr2t=Gy zmuFB*=Y7ztj4*D=+4RneICoIS=lz*?{;@rOJ>(e~N!Nbd@uXe#e;=RkWIvh`{39_5 zds5$H;NXL*0MwrBdmz!k{kp2|)S7gb(ABI7nqG4hnUc``*S%Qg7ZeQUt2#&=B%s`H z-tOBVKgzF^q0G&$7b;!pFQUq3Vb zF1p{$!BIg>eG%Q(=LpYe`z0{fiCBqe2|1hRo+m6LX8~{|CfPRPj=rLTxPDI}0tq zJ|yt&PR>Gc)Ym`uQ4{woLh>MotI6ep*_e^vAC;O+7KsE@hJ#(2{#$~MYVYmBz|EWV zY2>HAk28PWKSkh33}2pT8>oCOy=$SK@4dS)=Y?OXm~DV*=@y(NMh~g|X-0|SJy!N- zJ=%-xzNI-q#|&?iuwW5*LwxEzu=HGS0YGdaTF5R94DOSOMXBtR&5UQdY5aC30)7dk zdD+y+nq$JKNc}Ssk<9x|{gL}jInMxMI)pA{hwiJ-y^r6zP`gzcR4d4-T?W3!j(nv( zF)LcCZoRGu+9h>zUJLdbO!GYXsE3aYTFVBfcWao+Q+NFQ^i^3}P0cLSOseMR+K9v7 zt0-^PBp~JnRdTE1{?`lg-=kB)t9&Wp*FB_-xtK}2VePnax1f&@YQh#!QL0s0nP3Z& z!vEd#l6Uyu0(F;Gj0oN!K^oO)4TZ&NG)+s&hFE~xdd0q_JmgjoHb^4~aryuT0~A!* z{lRzVP&A=GzIKncCfK9K`k&Vm0>=ERaD7L&d2`@&Q@PSX3)GD31 zrKTx&vfOeZ+5(qqxNh_6{f~zN$w1A_h#euM(pG{&)&KItPo_a=+TI+qR;J~?x`oJcNZ-YNQ z^nsvor)&8UF4%@HJ<)+6SWVTQ=A{N^QZResF-Lk9I@`l$31rN z2`!#NQ9qdoyB6~hQvRpleVIMcUT5qEdRcKxc@qDwP}2F`9&_~<*CebM6Q&HAbgZay)5@5_+7=%z?j z$=Mf;N++$W*XRpa{A#6dC20tU7_%g`nzypm(lh39DQT00KPgrCMDF#+eW#Bua6DHX z%%wu4Tk65`gf{IvtT2KsR-U1QoO`{IeDWY%LV&OBvyGd!kuxNv>3LhGr^nG+!9LFW z-Lr!){8kw5F}IG{0`8=nKr^lZZ>T+Fe zb(?V4{0c$$MD180cE55g1|fFAx7SaYg;5UrQekNxqcBW*&Yc}Suoc?LD6UqI1r3p| z8hr_6hd?Y(eKwnnJy6ibIx&olxU~FOZwzO@NbNTW{g85FlLY(S7Yjvbb2+c?!bvKIp%>FzhF~4YtuJZLSsRRkqLHLN zJ;PJWi)|t(Q`)g(f*if*|NTqQym>G~H*&tqmE7$mLROkc?b z@JFMg{6BZ2vQ}<9P+!yXFKZ)UuWV4~8WQ`aVW@daeXvcXqM*XXU8$W&6qi(@gdI7# zz4;>^?e89JnEJD-Y{bBPUjXU?x~U9+p@kT>%=akqr?!c(V6=-~$A&oI)5q*g0?q#j zM*nLNM`m=jyxJ6wyE_?{)Qos~MF+D|P}%CrdOh1eUujesbYukSC6^Ie%F2-l!ReT| z#o1C8aAATUqN)-@pk*I3ZShdwlTR92dK1YU1N9aE=OOf46ur5;y!<@L%nB1FWpL;> z>d3bj>ESw0=o$*TLANZ>0+Mg6(QT5Gm}(XrWs-QqWza&SBrA^p%^~c0w8?}VuK6^s zFKu6~wJLz6CiZ>J*;oV!EBnKprG7!l?$2-3OjTn0&qh6>JPRzd>+^+px3|{1lnnw1 zxCJE^s!>&S9?z$OFna+=B(*hSx5_MkzzwN)Cz0{3Z8}W;cW8A5x(?pqtM`4O1fS1o zPc_G(!32&ErH-cMm;0qOz+IW*)VPF{*&e_Fa=BRz*>4%<*sDNs1}i)|2fDN135X+Q z=cGBm225`$0FVr$AZ$W0CTsIlm|?NFZwruuI`kD~{$2#>Phi_lHTAfLXd+GRrMx-# zo~~Dq_lp5ONCASRJ&%I%=1+0>wkO#p^R|zlSB~j8j=BM@`(YlsuQ?gU1hL$=v^%2< zw#3k|PT=GRj^>4EMc<1Bck5jU9)XLJL8mWBsu=Oymzx~Vx9G-0EaSjTC;RllraBoZv?}mxm zq~Nt}a6t3}i-=-)bjqne_Z@T7A9E9go}BCux}qev)DG%T?-Tfsr_k#kqP!ObVMDf3 zB@JuB(*O4SJdlrN5HiJGG!1V)hkO`<%rjy-FV@KSZBg3JD8P}sg&oS7W}wnHORiJJ z+n)m6@SUw{jh4$(mud{c_68&af}uLD%m`g-{|u4l;(VUcI6XxL-U9bRYn}&=C%Hgy z9~;K*jTFeHc3-BV>CDnJY3`U*35jtQH!Y?|EqB~SijCXr($w%irK(z1u--Fngn>7v zOB?vT6!P($t1lcCyX4PKg(3+APTh68< zGWB}|x=-a}6Uv=;JFKxlURij{1$Pf2ekB>qtAEtDuj*v$jp%kYt?)p+_ws&RZLvA6 z;%Cax3qgkuT?cq`Mn7!ex!*-G$d6pzWHpZ8uKQM7nX%GN>9Tv@uKn}2L)V6&?TX?F z9w+Nd!=p^C@%&$Nxr}|{AC)D;p;|n9kJb9rn<@w~6h_K@DHz>2&WhaOL(4&j=!TTj zy`KCvs^h*oIByE1Ei1O4rUMuN2QCt^6kfk;ID6b(t*pv`^CO)vgePmO2MCB;(Cl<0 z2A2*7`5^YnyP8&zSPJeMg9lAKUri@bbnVW~XF~d~KCP3|bOdReohkH&hTVuvPhE+U zv#pQfAtTzEe;EaFN*w-|@lOg9&3q!zk?Xg9C^jNmD%GRYl^r>I>H&+wrU zY7jRhP4!yojL|bhxJM@pL3Y%7=v=tDMp>61UX$g!xni$LzpLc)b8P%8GPF#)V ze-|vJ7LaXopemgasZtWhto`4t!+*CG|4&bS7d`ywP(91~@!)@pH^bF$>JvqZ>u+zngj&!h#hq^CE7v*Y(^ znGzQbSP;#oS*2W>jZEk##QP$Jysv2A5Hn01ov}gRwX*`DT7TYj`wzNqI`gM9K-Y~x zlQomWGo->6Ami4S*wTX_6OCOXz5v~>q&47AsJuh9Hg|bVP47Nw!HFWbZC6#rkD`AL zd>Y~A%E_=(TG#WMmiyEq%1U}v6OsGdmufI{oKgn1HEXqfR2^PTJZ$(S2vu{8d_S|l z{PpJ>;3&asPZAaHKK8SLspRRkStC5ezuTytsI)(Wv!K;IF{AwTY0Ip{gG_XkWa!laKGIdI zy4Lu?r9~tAC$nl|vL1If_JmBTLeuXDltMH}ET-yomw#eEg(O>RVX|}dI|17z|9#A7 z@XQGe9HfPpWtE2@kP$|5)~i-Cg#|3YVb($wie3me<(TMHR3B~nWw+$-4=>}I+6r{D z*s*4zJzPFh@=y4ub)`6kHYv4K`C;ikE1Pwue&oJehSlpDk} zM1R)eEpd8jnFQ7h%~=U=exgpL>{vM1Do34JAq(*=6S@3{VkvpI2ijhJDcIPcrURU2 z&%0iZR7i2CviAyxOA!013y}M4)>93BTzdNSb3?SDBHsfR41?QkcDFbQ5f=G zT*lRW>SAJ|19=VA`12#BL(fILwrsxQuvjzq3BbR%oOI_~f%h@BocYguK_+ZjNh>$vLE!UaRpWBO= zfj&ak0x@xsN?LfSQFsr>@=s988k%OQN(>!qlfuB{Fa9uM=yM?h;Z3cYvcxNcXRyi# zW4=K1Mc<%!3B}F-qJWWo*xxchYDMh-n{MX+d&CVR(L^UH?;W}K`?Is@P^a{QJPq`c zt$r(&MphaTvl{4ha&}12F7qkp-OOG@3o?WVFa9FYvU@AQ&tQW>XY&<(4uMZSPmq+N zLTp!?@M0>-%v)|QQXDgtgR$XpnBq{dDNb9#y}hkrCo$thTj33fQlS#Tre^Ki(zEhD z1-PzfcIXfna`M!7>7!H=+gwh`18|5`&Shx^tb2=7rvn}L5+eKO#Q_BGIY($LN1Zgg zmt^;x=GFoX(}_$>mS@(k15WB$Fv`ulJkMAC1BRh;x7F2UWc0((-VXDK`1g_~f z0$J$B*8lRC-zS3StJV4(Xy-79@v^e>b2f?(ioJ6Y-*)s?*kcwIjAV`7C2|v`kcn4A`AH*IGjPr45@S3JNIDXyp17FFx--YybzbVuW3#1|Er`uH*PTIIupc1lVdGfr$cjJ%eEq6G`}1=pU#3? zFVlp0$P=1LrlM9F#hI^%G$6AQrUL6@YnQf<>RE4xx@L-)(x!YQh~xQoX-c9K2)>iv z7b9bW=P&;5)?h=PR0Ic?cmZB)Hr7|BM`EnX!=<+%D0XC8J=9hUZaaul98$Ux+6>Ei+IAii z+R(dbFuB-I!q;@k=)K04c(ga&A0_03D}z9RID7KJt-k()GuTv}lB!?`g`td~g%-aPsQmzHC!BO>!k1*i>Iyu?M774cI>{*37kQ#GWUQ zD&tBHNWEN#eb+y%mPZ{A=W0VjZ>yf!!0Ku2553cUB?`$`_OoXjKtvJgve2R}fn>P* z_w#s#n#p32ltjlM8UGawwjKok@yAyQnF&S1bSBYYs(7kdn#6~S1n|Q0%nL8 zAmKa@Z0>9lI<+c~1n-vzyHV8Z%k*P@j;TvU&RwT<-BfW5IS zT$L47H;7%Iex&ExlhJ3=9T3~{4h4TM`nK`KcWDF;_`d1hyj!^g$yk5sCy5g_LOv-7 zR;4S{V1c7^*EseYB}wr$TE#-gbkveEvK+|!;TV{HyedZrqixkwgx8brCdepRSnFee|!@`2~zlf5NH#_6}bRj94f1lH-i zIptHdRnSTXNrbt#j;=7+|JKU&-y6IBe|^$^>-_0IzVwKww|;a1z^%JmBW49rxd7&)40$noI>vxJge$$- zxc(OEE*fIbH;>-E9ZE@Qk638JNXRR;=+mt0#vNxcYLbZtkBu=l3Dwd@gVti=YQfSG zG1EE*;j##6cYHKu-)!@3ms;5uI#^L^`k0}i$*~?UG*Z#zf(lMg8EW&pzJ0eZtyyTj zs@Ubz_7PV+SlVs9+d*G-H(vV(r!rk}CTpx0y@SOu>DI%q2Z!YlM|@BH>D}dgdvd2~06*d=!JKNG8E`+uu+*RWa}7QRT*Pp7P=sXe1z$q%8cj7!K`z zVZK(s>hAuz%B6Y0n)QL*_EUx~rtG{ug`em9}6{Ct%|FURo($2HJF{%|A0#Y*R~B7P(a9=S#J19S5YnFKTYv4oBlDJSqL>U?L^u z37aw{lf(PHHL)d6cQUh{_-&qJ=sZQaSFIl{$hwHsX1;f>$I(DP?ZIDYguS;n|a(%c(5x`Q6#Vk!Vq-zS{#d+%!i%;QaLwQ*9Z-4~@r@MCDu8+>k{5z2I~(P7Cyv zsn5h*q-2dp4U(WP%oBko6%&=%{#7!p!!sDhb%JS-1bj9IRkQ7WX#8vamX)Ux@OXR6 z9!i`-x6&8)pR8)7^3wEen#%yg%wK27(i6&WNoy)-eGDEGBlO3XdZ_=K!(<>dE-sLp z=X-j^nOTYZpE&?3BF#i~CGYN=St`rK_t)cf5!vJ@4Sl#G#=tukgo z9a8d$@-SOS)+b;LGX!MT0KKx?LdNO;!~1>D9C!}BxvrQW7zMq~C38grn(iUH!@GqE zBI4@mSgS2g30YYrO%7|?21|Tzey>Cb64k+|=&xmt(jpwU@N%iQ@So|2aM`ca)SXFQ zkfghNQ}cR@lS!3cBLcM8nHG;lzevkqXLlFi5tsITBBhuf&rC8G59X(o>F5sl?Le&? z>kx1W)%OT~`JJ~RYLqH#Rr~7RKZ0J*je@{kw-wxzv`q9U+w>z+-HX+19fHyoK4MJw zh?U((84Dxt$S z=@pK>Ai*R43f2OD@Z-^mKlmg_5qMdC+X1B$oIe<-a)^(FVu(b7UT#_{aPQ`FUy3%~ zyDu4enQiq1n{}QHqx;EoL~AdQ=5FZ$NJpjNzvjSBjSlg_`_yN@o8V&PlGx5TonQ3E zRs7B*X9CVb+Ee6a9eC(IkAk-asqdMFw5KDGdBM*%L4LkJWBRG~S!g6Zs;@<9O$i21 zk;8~2Cg~@}#6mm^>?$01(8%~RSG{VN6T@lcCyFg>2DDs@=iG5-yqi5ZKAroi&Bh8O z+2;PmU(*b~yDjeZHhxZueeu`6Rdv|7h}DI3S@zcVgp+tUUXylMim|fGROiw)SKoH2 zc*ZN^nAJ2ZKek~c^y6GMK!C75B2uHyV-_O}Yc*%knz#la8AYlVDmt6)|7M zd(_j?Qg^#|v<`f*1+`u5lrPUo=Fz)Gq3AN(7p!zqZ|#uX1$Ldu#$WbWJe;lD={7sX z#x-YWEYVQ7DYqlRC8OF5`9W!>cO#0IM$Bg`R3l|RLH{X(+?#;bjm@otWPVz?@TgDz z%A;4Lg_QHN}^y?%c1+)rK~FwQdu2P z@C`p~THGt?z|F-ZHm2GDG+K>Kgq9x?6qS}%YMYMzVsLIV)Q8`%A13QRnkjVoTbxz_ z*xvTUr*19mGmkN_$9_MQHB0qUYMtp==_HU&C+5 zURyiW_B~m^m0IWP%OfTRLwWxp_2N3M=^xhl5=M#bweINXQv@ua)}c=ayycQyeTL`< z02oJuwl780ByNVC%cFiIKyg(?bzip5QC*u&3r z?Dp4^7b)6x+ci_%yil}shZK$l=PPC7W)DNT3&$phw7Bqlt#~z#ML*Y43dGSmMD5=h zzVUIrjucb{k{Ac_@Li>v%AABtnRvaT1+hCf{rDNp zFg_(I^veQ|MhkUwl1c9A)Tq14KQd4Xj(w~=>>JBNO zppp1LI4CX6m;33U9Vig~d0}kmEId?1VQ3&W8-wvUe6wv(N6zbcgfaRFHZ%sGO$1gv z`reU3uRU$oF!nI&Erq!txmQbvorLi!D&_8Jv7}-dW~lbY`b6XWXW3!ZSFh)fYTorH z5l0gPHMt|^Qva(A>i;sW`oH?Ja_Z-s&rk-rvt0fEI@kX)nL8dLHW*e8agm+$sI;nd zp$?KH!D=x459g7JmRYQLc6Xo(QJp<6q4j%AVv@52a!C!dj-3iVF8z)MyVp-!b)hzD zDZkW6$X3kQcoeH^JESZIhtS*D4jJnYclSoaj+ zy)Mc^?3Ob&bmao+=?=AxnVXE0N)Qd3T(F&i5mHDq%Ld*5GFw5$U-hu9O`Udll;`QO zNO`^gh&l5OS6>y{XwI*~DxtT7+L~%beddTr(oaf|O$jp&TW=mJq06iCGn-+xx!?N?PgUJQUWaXsdxsXxZpXfeZ2Szl74l_g*g2m#FTy zh3v0tDrE{tZ=Pe=FP#P}^2zpDCjux&{mA0KTWDA1L}{LJjocc9m;)1M1}+IX38EgM z^)jr7_Ily_nGaNpUmqNa9?qdCrPXA`svCQizhryza}KX?fUnkJoPFWW7~sZPT?uW~ zk65toGGlgam>b}sP68@bG5B*L1T$^NhAzB;JQ@68vA z6fYXIP^37t&_Z!26fMQwAy{#z6nFO`#S6tXKyY_yOH&9A!KGMnhkeuUZ)WG-ncdml znZ0xW$_xof-jj14`N;F`g@Gqu3XixHGZt$=KS$Q^+4iAx3Yp6)1^UrK^!s^Oo`rct zF1AyUuy77^puVW_ITapiz7+N`Gnfcv&Q;bY%1T193Uti;&dnksUyv{>&1X$@u}?bX zZ9$QJO^~Wg9TU7`$zTxe6=J+`dz8-HBtRWTYh+#d)**-vgM2-+xUst zjsOj!#J`&A)R5GDn6&#nZWf7f0V@Z-p#H?iFJJ$Fr*kgS&T^&&=t`wrVIO-quEt8; zcs4|;J#DjZyq!%K7GXmiI)U4f44=OL=yrkdI?sMoBu6~@7~h)@-%0e(#cKnK&?+3Z zk`E$BjY}W;&f#f0QK8@)iW4YQwp9tuS>GiHi}hju!R!k8c~HMo>Z5^^Vymu27EB)B zfhWff2A^(7CzuU=Fu6E1_OsEqS=1Pg4k%$3CJJVr^>LIDu%q5nHwOtUA)>52R*1|jRA8a@L->(e@-6rcU6f-ksvB07c9 zO55Qb--U7s0M84~o)%Yc?Sh$VNbov?$q@g2T<#JgyIV|4eDlIv=5-(Dr#)48JnBj- zO=>{8(jLrr&B=b@3l8N2L#KAFD&IzRVlWYyI))9rH_J`6*DBYQ9=TH2V2_{aVeo3w z{zQ|{&ePna{=$p$Ad>!(^ZW^zEVA?Z_UfjQ14(TIbd4cdBJ0xhnW*4FKl_rcCf(p@rr zV0JL0^~$cluP@?WECeSpc3!yuqjL`S;`sYm{>9&_FUG8fSYsOO!(0og$sDb z386nYE=j<WV>#ActYif-|-GyY7lF2UVt-iLMBpwY^60{wT-NY&{_X6f@0J*7I=1<62TVR1q9i zS&aACm&YRIvhEWAI;*!DOI`>9S@ClSNTVgDTf-TZi@Z~?c%F|WT1#k|bUbOEQ_=TF ztnd1j|Bt41`VxXZcAnm*ekG9h^H?O#$%y#l2%-Q%zAIfW4Yld@oh*|&f#GnFl2Is%K;Y{aV)FWcKQY%fkRW?wz*1`=#? zzaZ3i!l#Mxv3T`zlbQYtC;2v8@Y2u+-1Y2!=}RWN)m)h$3wt$Z@r;QA=7ef2?Xj!k z+ZB^Jir!z9G6PXJxWl))(>nyHOJR=m>RGZYhJvirNwH6rXTO}D;iU)q2s*jBgVd7u z2lBV(6u}yj0=e9c-SiJ*nPYocXM#a_-3L{#89s;#Q9Pb}M?TnzD+q@)DOCnW7!=eU z^R(#mxYV!u1-&_@Nb&Ia=5s~Fw0j$V_Cj8fDmrVSvYuU0J@m*`q3zfY&$<;<*C!YQ z3QPkaN<$M4|A|n&3Yr0Dc%aUvtF8b;u zW;rw$nM~6ZOApjNoDpOxt}#9$w|#gj?Rbpbh^Yik||hciZg55PwA;aTnvoiE<-`H84LWxmv_rY)6 zgin5PF}3lbA#O{?2$C^P_234K|Fvl%+B=v)DVqNRU>_{jt->L<;j4NQr3t9(O|)t; z>!-$#yDti_|2XRw&K7*Gmw1kvt_{GEe3iQxX=G&t&e%@MmaM@4M};H=jj$kSdb>wR z1XOej+l`!6@n!np42M?)AD$P!plz$f^~*jYv8xn)R3+7wfwOc=7x*q5j!Fd-lF6b& z2D(v#y&B0A!jD~f&7it7n#66tR*WML%l%5CBKR#npYtBPK;ovZzGg3;d*%y>ciy65 zXaqlKgtz2Rv=Dh=#TfhLjLiEB9l>%mE?rqbM?&p{(%6e~3-twL1Im0xx!aX;Bq z27X(=HG#t=loigO{X+_V37dAOangQJI2e#5#rGR4R^@^}%XzrwTx-<5Y1xIPx0Ibr zkWES5Isvs?BT`oo`(u4#pGSGv$GKHp7tJR??Hl5iYfg&qD1biAyTLFn`Xz_^iM)7@ zw^^W{h*w;?2~{w|4`+a%lO`OW978<F^Y32KB4MIfU;%^C zgt`)cg7{SV1XR3e==Mb80DLL$_E5p@cFff0cm{CJxS;oE609D_pKQN?-9fEwlcsg1 zC+rL%a-&M;RgEly6IoBBltv_tpB4e_f14)dLzh~3VSD4_Vds9Q(H(!&Dl9YrmROLj zI_?@*(Ui{V&5}R$L@izYt_i0b&f&*qb?Ii@5N&Q=p?Q&DiO%C3=gPudf6+kGhYmVJtCY=t|TQY%R4iG z6YFLPG^-QE_Hzx>nrz%1X)@pmzRiL`X_#D76=v?~1#0HAThyJ|`+(CyKMnm?JvCpP zK7qQ)D)Q;26#Sk!PRSjLs7p)#EPwRwQ>}`7@db0|A7qaG9k(l;RVDOU3jS-?sYx2Z+kSmgYj{RZq+7rhX-bg=B9FIuG zz#!@5VNR;}$oXbBi1gs_$PBk;o}!Ln40bcKw#mEqOx#4m2qszX29&Ei(nalSxXVdfbmrEn58{hAhKU(MaN_Re!N|r zd)t5somtr#myCMdmqc|~skG<)F1K^U0@;-#lgrD6;#|M0y4eyCT}l5(X}HWxb@N7X z`9C^mB{m|peYLvRa2a?^QuW_&=%xUFAO*LRs<;1}akeyU`)ZO|?WzBE`9e^e!-fo7 z3H!tw$AA7%m~W%sR%RJo{vM*y@mGEVV{_kwVp9`_A|@v%Y1Q9Z!X@_BY^!g#gby*)vO_9QB9vDboOw{!1a6a74P2>d~!(I;46}i(-iPKS!*>u z8wYLCl2;-*uphKYvEVNXvdaR&3&TBm7666F-v9uqbXy)c9LkEgW%Nk>w7PUItAX@k zs~(4Hsj5~d-B3#cV|_3>7Wca2_GsZYTsiZJaukUV4`%E~rI1NwMV7%o(}odvw^6Lh z{CuOrsNnFQwf0f+v_RKv^Tz(@>M zZe4)JDuY1Qu5IZD(`%R1%9RT95P+r;ru$@#hdrzeEHRaPgWl=;8}p4ObRa%Fu8i*s zghfzAZLN$%4ylv)dMPRE+J6?K=^9(CX~~Qx__UB=t>isz!te+l5*`e-h*5CYBojmE z1wD)E?5PcXdeO4W!E+zl!K(pawyJvQX@V$rqf$mlox)Xq1v^CwzOj3EXeqD2+V7M{ zGgTNdoVw>uNU(z!7iH5Nf`|}b9y9Z@`O;A=vjZwCR$!Pd=B$ZKNWyQm`2`39T=TJ> zU0%@+cz+)IesD2+NxAb4wRqp_+R?WDQcP+%h!nOjti9LXK9{>Y4P<~xvec*%2zb!h zXh&~CM%#33iVPT(6ugznrJ~PBxA4G6|C*GB|}+z0Ze;~}%< zML1FS&0^r+aPwh~nnL9{Y88{FGmzx=hh?l2=)n)3AoTUqV)B++I>moix+l!w+QUf8I0WwcS~s zwC%F{%$YGZFfT-$>s#jind7`^Uc0iy0C{IL33#{q1JW6?-bAKnqugs;D7@n_(}cLK zSTy^OWlH3qSK6k7c;_9)y-|kcPmPCG!NG0*ljorBOT7yjo0a3tFHiOUSGSS&E%d>_#16E$+ zHH%P_rfU5@NFK%0{USVwX8pN}q2jDJQ!lM~fc?)^N7vrRQ={S)>3svtC4yf7pk;CY zGwIqVkks1OCnpZHh=#IeBkUF5i3$e96!{|ZY|?zeAk%#(XcQdXnjLR6WgN12ds?d9 z8SS)`vGQ-K;iGxRVbfdbFix| zbgiCuAPbR%1P*q%W>-hHY|WmyxXGOCRlV={Bi8a8@rlU^Uv_(3SbcH+Hk$ouKteQ| zpCPZyO%%!JS(KUQ6#S$R>EIy$2`27T<}v$nAgP zm-pc@MQ{#G3UaR!JNv8nMuN;?JGCk`LxMU}H6|&5n-ZWIco#@C8Y8m4c{aaH!4iWg z34nL#IBjdJ(s~48j6G3@InGX`PkSjpu&5~TKG(E=p=;OqOUDs_tDPzx@0Z3xh~|Ef zpbl*!Pl;6-6I-Y4FWMQ>a z*G*r+xEiCa{%6_+TpvwWPT#^olZ=imsh+VM1n)rWR8uE`OWMwZ{b6Qn5n!7UJNq_K| zuyPhz8_N8h35%t#BB+I?2#j-i7hbN3>+~6m<9@sV->&lV1z`8DBS9)cDtA~m=TJ*{1G+0IjCF2VP zdLZJJ)r98^k7(h5k>8CQczG#r&+u|VNm6nad9n}w)Dw!^o@|UXy$0G>N3wmUHed8A zdP7TN#r(;SKq#L%-m2bw6tXKr)*lAM4SBpxw_XhCLpD)H^01BmlRDf2*nXQ+TWp)t z+>)Gg57|qsEPK0}Q>{ASsBGo|bIK|JOcrXdzXd0)%y&UI)Yn*rg#5U|ESxD>xM~tZ z(1bene&!{0O`>tCDl2AIO)vCJwoWd!A^N&7SDF9rFM>;`kFF(ZpxeP7nWg;Q{e23_ zJ$U3+EkPYefF=4&#%&5+bh1I@>wt2A`VEVEeep&MbT2p;P>{f8*Z{CSzXhbcSJ@L- zm1bscplvV?B?&wG9i*gv);CJV<+O5)-32)(bYBkbnpA{pkN+jAYSEAhFJZ?&G1b(Z zH$h!3%8W;l(D>(4`oKYJurF8FYue_83XzhXPiLa~LoAjY1?^%EpNBQg=0M5~w z8rskJ7!MbIJo*;YLx0CO=IkY7H?#?Kux`vaf+a%F{9;;a#?VR=q-PN+zzp zZ=)bvw||!j-p*M(mvfX%Q@iPFmQy$6J!5*f`D-*kFp~Ht-fnVnZ)p2 zZ;6;*WCnQfPcB`Yq*%tfG2$^S^{tJW^VfI!5DT*W{PKX~vcNdslWgi?fH{83Ce=>< z-g}lQZ>W%aYo%u&P=;4Dm=ISOmd(*pXQG@F7+<`vpEionuA{g8qhl&!g)H~q0A2Gr zguP>h<%OgYyt1J~^?6tJB%Ewi&@;xJzf zSmEWyC;hq{I@ThIvY^kWjdk>FjV79_Thss(S*;+iC6pN`;%t;dwfK0-*amit#jXjw zA6=Dk=4u-R-qY;Fk7N)?43a`U8Ob&n9wsln9Iz}I7UX%2UltoGs{2j(EOzS8+D7E% zK;yM1*9;-G)o(SnZ<3aQ8RGUz9zT$gz8GjZryicNN3}g}R#?d3OcP&dML6nqOlqN2 z65K@;iD^j3y@*t9n4(O#d8;7PMx|jpszVk5n-BhgOkq?@dBO*ceciZ|#x-^Rqr*!jwdek1A6|*XV?v(+%nH8|Ci5 z#C-+5q1n8@0q0pfgaJA?w~bW<(p7lRx_s~JDgli4WDn#PF^DP`ZbTEh(|`hWTK45% zU5r1n;NLRnL;6J!Il$I?L(2AF=o9{bdWn^W3LA$H&I^~Rd`YhGD!i)Q?IB}dIWFMG zPfQ7+(3l^hBMJ|>5D?g~*RmHQ<6ySlA(mO|E|`^sc#rGrboih}K?_})XghHu<6G+s zH`sayUZt5{%G^c(t6|P%T3+%YmAkja2Aap#TT8}WzcXRP74Fbgf68ifiiK(Y_TlnO z3+1|OeW)c>#P&f-{uV6o9|ahb$ZLxs6Q+G*%;M%Ihy`V;>EaOqS%REB~@}(1I1Hzl;+x)-!TD``Uxf1+94UqM7t zvz72z5Mu|j4_EAS$c}eTChsL@d1LaS8n3_=(S7tj*x6}8ajgQ2Mv6EZGA0u5+}>~Z z3$H@Io%Tf-ip8^H`qN?jEitc9YYvGY&*H&elZNR~CB$3x7S!;t&Zw0nGP&gIhwQ%8 znf7%mHN12M-lX8+T?6ZEy`y=$j7axASw`ioYmRemv*61nhdBR4F)9 zN6*s1F;(u0R`v0zFVdbAy~Ue_dK4^u$L~szPj~kWvW}KE(_)tKWFOSGo%}5mCHcwNU=^akCrCtpXwFyKx_MmV<8wR+*iDfVbi2-0ar~*^ zrmjEzb0;bfqb&W5Hs<@U1hoPTE@PM#bKY1f5z-^i9zH1F1YdFVvm$l|T6SqT1wRE$ z7*D!#zk~Zf!FhYb|a`$jM@RJ_J8bO>gYZ$kpE^J3zH;$EMxTvEJR(=vCUigE6pK;DrdDgrsvUOoAfDNIy8-Fp$Q!rLz< z0y)l$JL)f_{s9;>&quyd^gVp1&gIhqSD5Xh8|N(gbU0!F@QA-5rLQP?Icv%J(S+)V zzeQD*%Q1c*_qsP8ys?0d>WPhXaEAZ`;>?h`LmX6~E(5d(z=i$?UT!3a@_#?a@pZGr zZnj?jI}vRAXQ#hEpDf_u$pt2}`7BWb?Kc(>v!e~gk#Xt2FH$V#ETOskf|*N3)7xmQ zRSH5DhGE&Yd9|0{8860;aN06GRgjs1h;R23Mhb~$7X-{_J)Wpc1@xu)1K74IGmvEg zgBda>f0a@_H;j3v)BOw z`gd{Bz0iHq(BB}KfJW85>P7(>bh;Tz<@}0|MG9jbdyy_!stavA=Lu->;}&qVO3 zab&kWAnwnx-Q!H10N*3evpMPzJIZY{F%W;E)x0nj4|5o>c_oQmRGLjELbs;5sI(U+ zWb}=ox3W$C0&)E04P6I_7Me%mu54Gg`PmKJ8Vxac0yv9WhJwvQk$f1$bwSug`x)3y zJ!s0wtyc4Ynn(z#Rm>B2XOIR+SRA6{H9+^jncxJRYYWbmu>C-#i!$(n)b|fNBsXKS zx!srYpKY*H9&eL~4vo6giz7(tiHXG_67HiRv!d#Fp6!B6p!e0ItG@#+Y(#^7ki3x_ z@K){NWx%}S_|m8T9It$1cZ0^@Y9FSPk^(VE5`xXAcd+TMuGmZ|me^Y}h?lZYEx^#~=;-KxWBar~y90&zPURvo*m840~zX4a58a)62 literal 0 HcmV?d00001 diff --git a/windows/deployment/do/mcc-enterprise-prerequisites.md b/windows/deployment/do/mcc-enterprise-prerequisites.md index f1a81788a0..435d884a51 100644 --- a/windows/deployment/do/mcc-enterprise-prerequisites.md +++ b/windows/deployment/do/mcc-enterprise-prerequisites.md @@ -18,6 +18,8 @@ ms.collection: tier3 - Windows 10 - Windows 11 +> [!NOTE] +> We are still accepting Enterprise/Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup) ## Enterprise requirements for MCC 1. **Azure subscription**: MCC management portal is hosted within Azure and is used to create the Connected Cache [Azure resource](/azure/cloud-adoption-framework/govern/resource-consistency/resource-access-management) and IoT Hub resource. Both are free services. diff --git a/windows/deployment/do/mcc-isp-signup.md b/windows/deployment/do/mcc-isp-signup.md index ca3e78f917..b073f994f7 100644 --- a/windows/deployment/do/mcc-isp-signup.md +++ b/windows/deployment/do/mcc-isp-signup.md @@ -20,6 +20,9 @@ ms.collection: tier3 This article details the process of signing up for Microsoft Connected Cache for Internet Service Providers (public preview). + > [!NOTE] + > Microsoft Connected Cache is now in Public Preview! Instead of submitting a survey, you can directly onboard onto our product by following the instructions below. + ## Prerequisites Before you begin sign up, ensure you have the following components: diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md index 5fb2e95dbe..cebdb5a480 100644 --- a/windows/deployment/do/mcc-isp-support.md +++ b/windows/deployment/do/mcc-isp-support.md @@ -19,27 +19,41 @@ ms.collection: tier3 - Windows 11 This article provides information on how to troubleshoot common issues with Microsoft Connected Cache for ISPs. -## Sign up errors -### Cannot verify account +## Common issues +This section details a few common issues that customers face during the sign up process. +### Sign up errors + +#### Cannot verify account During sign-up, we verify the information you provide against what is present in [Peering DB](https://www.peeringdb.com/). Make sure the information for your ISP entry on [Peering DB](https://www.peeringdb.com/) is up to date and matches what you provide during sign-up. -### Invalid verification code +#### Invalid verification code During sign-up, a verification code is sent to your NOC email address present in [Peering DB](https://www.peeringdb.com/). This code expires in 24 hours. If it's expired, you'll need to request a new verification code to complete the sign-up. -## Cache Node Errors +### Cache Node Errors -### Cannot find my cache node +#### Cannot find my cache node Did you previously had access to your cache nodes but it's now no longer accessible? If so, it may be because you had a trial subscription, and its trial period ended. To resolve this issue, complete the following two steps: 1. Create a new Azure Pay-As-You-Go subscription 1. Recreate the cache nodes using the new subscription -## Steps to obtain an Azure subscription ID +## Diagnose and Solve Problems +If this page is not resolving the issue you're facing with your cache node, you can use the **Diagnose and solve problems** functionality within your MCC resource to continue troubleshooting. **Diagnose and solve problems** contains solutions to most common problems that users may face as they onboard. +  +You can find **Diagnose and solve problems** on the left pane within your MCC resource as seen below: +:::image type="content" source="./images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal." lightbox="./images/mcc-isp-diagnose-solve.png"::: + +Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you are facing and follow the prompts that narrow down the solution to the issue. + +:::image type="content" source="./images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select "Troubleshoot" to continue troubleshooting common issues related to the installation of Microsoft Connected Cache." lightbox="./images/mcc-isp-diagnose-solve-troubleshoot.png"::: + +## Steps to obtain an Azure subscription ID +To onboard onto Microsoft Connected Cache, you will need an Azure subscription ID. Follow the steps below to obtain your subscription ID. [!INCLUDE [Get Azure subscription](includes/get-azure-subscription.md)] diff --git a/windows/deployment/do/waas-microsoft-connected-cache.md b/windows/deployment/do/waas-microsoft-connected-cache.md index 3f99fd1880..b8df6ad349 100644 --- a/windows/deployment/do/waas-microsoft-connected-cache.md +++ b/windows/deployment/do/waas-microsoft-connected-cache.md @@ -20,14 +20,22 @@ ms.collection: tier3 - Windows 11 > [!IMPORTANT] -> Microsoft Connected Cache is currently a preview feature. To view our Microsoft Connected Cache for ISPs early preview documentation, visit [Microsoft Connected Cache for Internet Service Providers (ISPs)](mcc-isp.md). For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). +> Microsoft Connected Cache is currently a preview feature. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. Microsoft Connected Cache has two main offerings: 1) Microsoft Connected Cache for Internet Service Providers and 2) Microsoft Connected Cache for Enterprise and Education (early preview). Both products are created and managed in the cloud portal. ## Microsoft Connected Cache for ISPs (preview) + +> [!NOTE] +> Microsoft Connected Cache for Internet Service Providers is now in Public Preview! Instead of submitting a survey, you can directly onboard onto our product by following the instructions on [Operator sign up and service onboarding for Microsoft Connected Cache](mcc-isp-signup.md). + Microsoft Connected Cache (MCC) for Internet Service Providers is currently in preview. MCC can be deployed to as many bare-metal servers or VMs as needed and is managed from a cloud portal. When deployed, MCC can help to reduce your network bandwidth usage for Microsoft software content and updates. Cache nodes are created in the cloud portal and are configured to deliver traffic to customers by manual CIDR or BGP routing. ## Microsoft Connected Cache for Enterprise and Education (early preview) + +> [!NOTE] +> We are still accepting Enterprise/Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup) + Microsoft Connected Cache (MCC) for Enterprise and Education (early preview) is a software-only caching solution that delivers Microsoft content within Enterprise and Education networks. MCC can be deployed to as many Windows servers, bare-metal servers, or VMs as needed, and is managed from a cloud portal. Cache nodes are created in the cloud portal and are configured by applying the client policy using management tools such as Intune. MCC is a hybrid (mix of on-premises and cloud resources) SaaS solution built as an Azure IoT Edge module and Docker compatible Linux container deployed to your Windows devices. The Delivery Optimization team chose IoT Edge for Linux on Windows (EFLOW) as a secure, reliable container management infrastructure. EFLOW is a Linux virtual machine, based on Microsoft's first party CBL-Mariner operating system. It’s built with the IoT Edge runtime and validated as a tier 1 supported environment for IoT Edge workloads. MCC will be a Linux IoT Edge module running on the Windows Host OS. From 9de2d2b59e4d8b91c75c3e4a43583b20ab40796e Mon Sep 17 00:00:00 2001 From: Amy Zhou Date: Thu, 30 Mar 2023 14:17:31 -0700 Subject: [PATCH 16/26] fixed broken image --- windows/deployment/do/mcc-isp-support.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md index cebdb5a480..2c19b5a82f 100644 --- a/windows/deployment/do/mcc-isp-support.md +++ b/windows/deployment/do/mcc-isp-support.md @@ -50,7 +50,7 @@ You can find **Diagnose and solve problems** on the left pane within your MCC re Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you are facing and follow the prompts that narrow down the solution to the issue. -:::image type="content" source="./images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select "Troubleshoot" to continue troubleshooting common issues related to the installation of Microsoft Connected Cache." lightbox="./images/mcc-isp-diagnose-solve-troubleshoot.png"::: +:::image type="content" source="images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select "Troubleshoot" to continue troubleshooting common issues related to the installation of Microsoft Connected Cache." lightbox="images/mcc-isp-diagnose-solve-troubleshoot.png"::: ## Steps to obtain an Azure subscription ID To onboard onto Microsoft Connected Cache, you will need an Azure subscription ID. Follow the steps below to obtain your subscription ID. From c606c04e501818db1bb7bebb63803ce7acb5904a Mon Sep 17 00:00:00 2001 From: Amy Zhou Date: Thu, 30 Mar 2023 14:26:35 -0700 Subject: [PATCH 17/26] photo address --- windows/deployment/do/mcc-isp-support.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md index 2c19b5a82f..9821249267 100644 --- a/windows/deployment/do/mcc-isp-support.md +++ b/windows/deployment/do/mcc-isp-support.md @@ -46,7 +46,7 @@ Did you previously had access to your cache nodes but it's now no longer accessi If this page is not resolving the issue you're facing with your cache node, you can use the **Diagnose and solve problems** functionality within your MCC resource to continue troubleshooting. **Diagnose and solve problems** contains solutions to most common problems that users may face as they onboard.   You can find **Diagnose and solve problems** on the left pane within your MCC resource as seen below: -:::image type="content" source="./images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal." lightbox="./images/mcc-isp-diagnose-solve.png"::: +:::image type="content" source="images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal." lightbox="images/mcc-isp-diagnose-solve.png"::: Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you are facing and follow the prompts that narrow down the solution to the issue. From 6ae0e1db3ba080c375ee34904ec48d05f4b0c141 Mon Sep 17 00:00:00 2001 From: Amy Zhou Date: Thu, 30 Mar 2023 20:25:11 -0700 Subject: [PATCH 18/26] removed lightbox --- windows/deployment/do/mcc-isp-support.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md index 9821249267..7e13c62584 100644 --- a/windows/deployment/do/mcc-isp-support.md +++ b/windows/deployment/do/mcc-isp-support.md @@ -46,11 +46,11 @@ Did you previously had access to your cache nodes but it's now no longer accessi If this page is not resolving the issue you're facing with your cache node, you can use the **Diagnose and solve problems** functionality within your MCC resource to continue troubleshooting. **Diagnose and solve problems** contains solutions to most common problems that users may face as they onboard.   You can find **Diagnose and solve problems** on the left pane within your MCC resource as seen below: -:::image type="content" source="images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal." lightbox="images/mcc-isp-diagnose-solve.png"::: +:::image type="content" source="images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal."::: Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you are facing and follow the prompts that narrow down the solution to the issue. -:::image type="content" source="images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select "Troubleshoot" to continue troubleshooting common issues related to the installation of Microsoft Connected Cache." lightbox="images/mcc-isp-diagnose-solve-troubleshoot.png"::: +:::image type="content" source="images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select "Troubleshoot" to continue troubleshooting common issues related to the installation of Microsoft Connected Cache."::: ## Steps to obtain an Azure subscription ID To onboard onto Microsoft Connected Cache, you will need an Azure subscription ID. Follow the steps below to obtain your subscription ID. From f90c3972d016988bebaf9548ae19d5c5d57d2fa0 Mon Sep 17 00:00:00 2001 From: Amy Zhou Date: Thu, 30 Mar 2023 20:40:52 -0700 Subject: [PATCH 19/26] removed double quotes! --- windows/deployment/do/mcc-isp-support.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md index 7e13c62584..8a532f9d32 100644 --- a/windows/deployment/do/mcc-isp-support.md +++ b/windows/deployment/do/mcc-isp-support.md @@ -46,11 +46,11 @@ Did you previously had access to your cache nodes but it's now no longer accessi If this page is not resolving the issue you're facing with your cache node, you can use the **Diagnose and solve problems** functionality within your MCC resource to continue troubleshooting. **Diagnose and solve problems** contains solutions to most common problems that users may face as they onboard.   You can find **Diagnose and solve problems** on the left pane within your MCC resource as seen below: -:::image type="content" source="images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal."::: +:::image type="content" source="images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal." lightbox="images/mcc-isp-diagnose-solve.png"::: Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you are facing and follow the prompts that narrow down the solution to the issue. -:::image type="content" source="images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select "Troubleshoot" to continue troubleshooting common issues related to the installation of Microsoft Connected Cache."::: +:::image type="content" source="images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select Troubleshoot to continue troubleshooting common issues related to the installation of Microsoft Connected Cache." lightbox="images/mcc-isp-diagnose-solve-troubleshoot.png"::: ## Steps to obtain an Azure subscription ID To onboard onto Microsoft Connected Cache, you will need an Azure subscription ID. Follow the steps below to obtain your subscription ID. From 09f6a363b38222b051c7f038590b147a1d4919d2 Mon Sep 17 00:00:00 2001 From: Amy Zhou Date: Thu, 30 Mar 2023 21:08:39 -0700 Subject: [PATCH 20/26] fixed spacing --- windows/deployment/do/mcc-isp-support.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md index 8a532f9d32..f8a3a71e1c 100644 --- a/windows/deployment/do/mcc-isp-support.md +++ b/windows/deployment/do/mcc-isp-support.md @@ -46,6 +46,7 @@ Did you previously had access to your cache nodes but it's now no longer accessi If this page is not resolving the issue you're facing with your cache node, you can use the **Diagnose and solve problems** functionality within your MCC resource to continue troubleshooting. **Diagnose and solve problems** contains solutions to most common problems that users may face as they onboard.   You can find **Diagnose and solve problems** on the left pane within your MCC resource as seen below: + :::image type="content" source="images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal." lightbox="images/mcc-isp-diagnose-solve.png"::: Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you are facing and follow the prompts that narrow down the solution to the issue. From 9a08a319e9009304a0706712a7714c5a0a8019f2 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 31 Mar 2023 10:59:03 -0700 Subject: [PATCH 21/26] Update windows/deployment/do/mcc-isp-support.md --- windows/deployment/do/mcc-isp-support.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md index f8a3a71e1c..16ce235fe6 100644 --- a/windows/deployment/do/mcc-isp-support.md +++ b/windows/deployment/do/mcc-isp-support.md @@ -54,7 +54,7 @@ Within **Diagnose and solve problems**, select **Troubleshoot** under the type o :::image type="content" source="images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select Troubleshoot to continue troubleshooting common issues related to the installation of Microsoft Connected Cache." lightbox="images/mcc-isp-diagnose-solve-troubleshoot.png"::: ## Steps to obtain an Azure subscription ID -To onboard onto Microsoft Connected Cache, you will need an Azure subscription ID. Follow the steps below to obtain your subscription ID. +To onboard onto Microsoft Connected Cache, you will need an Azure subscription ID. Follow the steps below to obtain your subscription ID: [!INCLUDE [Get Azure subscription](includes/get-azure-subscription.md)] From bed0a7fab210eb2df5e1328c7392e62fe6b91b4a Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 31 Mar 2023 11:01:23 -0700 Subject: [PATCH 22/26] Update windows/deployment/do/waas-microsoft-connected-cache.md --- windows/deployment/do/waas-microsoft-connected-cache.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/waas-microsoft-connected-cache.md b/windows/deployment/do/waas-microsoft-connected-cache.md index b8df6ad349..d3371a6134 100644 --- a/windows/deployment/do/waas-microsoft-connected-cache.md +++ b/windows/deployment/do/waas-microsoft-connected-cache.md @@ -34,7 +34,7 @@ Microsoft Connected Cache (MCC) for Internet Service Providers is currently in p ## Microsoft Connected Cache for Enterprise and Education (early preview) > [!NOTE] -> We are still accepting Enterprise/Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup) +> We are still accepting Enterprise and Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup) Microsoft Connected Cache (MCC) for Enterprise and Education (early preview) is a software-only caching solution that delivers Microsoft content within Enterprise and Education networks. MCC can be deployed to as many Windows servers, bare-metal servers, or VMs as needed, and is managed from a cloud portal. Cache nodes are created in the cloud portal and are configured by applying the client policy using management tools such as Intune. From d1d1873b70dea0803ddda0f6bd36eb0965f97c92 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 31 Mar 2023 11:02:15 -0700 Subject: [PATCH 23/26] Update windows/deployment/do/waas-microsoft-connected-cache.md --- windows/deployment/do/waas-microsoft-connected-cache.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/waas-microsoft-connected-cache.md b/windows/deployment/do/waas-microsoft-connected-cache.md index d3371a6134..4624dfd2bc 100644 --- a/windows/deployment/do/waas-microsoft-connected-cache.md +++ b/windows/deployment/do/waas-microsoft-connected-cache.md @@ -34,7 +34,7 @@ Microsoft Connected Cache (MCC) for Internet Service Providers is currently in p ## Microsoft Connected Cache for Enterprise and Education (early preview) > [!NOTE] -> We are still accepting Enterprise and Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup) +> We are still accepting Enterprise and Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup). Microsoft Connected Cache (MCC) for Enterprise and Education (early preview) is a software-only caching solution that delivers Microsoft content within Enterprise and Education networks. MCC can be deployed to as many Windows servers, bare-metal servers, or VMs as needed, and is managed from a cloud portal. Cache nodes are created in the cloud portal and are configured by applying the client policy using management tools such as Intune. From 7fef2a17832a3de8726fd08c94a8897b1e05bdad Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 31 Mar 2023 11:26:11 -0700 Subject: [PATCH 24/26] edits --- .../do/images/mcc-isp-diagnose-solve.png | Bin 26735 -> 24845 bytes .../do/mcc-enterprise-prerequisites.md | 2 +- windows/deployment/do/mcc-isp-signup.md | 2 +- windows/deployment/do/mcc-isp-support.md | 11 +++++++---- .../do/waas-microsoft-connected-cache.md | 4 ++-- 5 files changed, 11 insertions(+), 8 deletions(-) diff --git a/windows/deployment/do/images/mcc-isp-diagnose-solve.png b/windows/deployment/do/images/mcc-isp-diagnose-solve.png index 7691dfe8ac212df5ba71319498c991528bdad2de..6fa1dcc336ee09d090ffa49538f1677ace13897f 100644 GIT binary patch literal 24845 zcmb@tcTkg2v^^?FkuK7^fPjKD>0Kazf(S^JDov0gy_bL}y^08e5CQ4Egd!#ME=76` zRZ4(_nm|JGi+A3=0wbx!dPXDDA6*(*Uty{OKo<9S; zx^;^Hh<~tmNbukImQu6gKL~tYX{p_+9%tXjzYsa8>Z;zlRhL46u_ea8lX*US?Q`oE zNA$mkz^Z^Q^46_41D(zCG>GnpS ze)?fNN$&UDj*AFORq9yBP|I-2No1|d19oO;tS^;)XHPP^dD<1PHv52F;tq*w9AVt! z$j3OJW2Jz<;|}}}#)t@!$S}}yD{{s0_(dM1VfCYlA7O0l&@1x_Qy!lByU{ANX~g1~ zxY)-JHxYVaCpu#fuQlDThM%;i#KxL)>NH^z)*koeDYeZq(xzRQJ;9{Mq;x5GKz@@) z#6E^4e!}H%Nww_16E#=5ENk+`T9HW~%NJZ;$HZ;(AZ<OWpujPCOHJ#By+!ZKGZx? z{6^s&+T+lV`+5v#DU`V^iY;KmUT<(iPoAKlOIJ$N%A6%fxScK$lx}ypyN!Jv;eDQp zcx@EU-%Q4)lr7=0gc~$~J;NA`f`2(KCwdmwW@bdfw7$BkWlSdaHzrps{Harzl@Vcw zd~CzxpG!X9nEwe%U^Vp7uf~+A%h9b%lkaY?U^aHdPXQ*rn$ck+ z)TV`ncaBAvuAwiZn-0n7frdregck>)1e?FWRI-DfduCO4u3e^l9-duDI*8^2EOkt% zb^Xrw3=S7NwA^WFb8+L(P^0%Vg@G(f-S>y=Dl3{PsFzFse{cAqiOl@Psp;=WJ{ zgX@INyN!ru46kSAt9VY{H&z2UaD2s7j~JWXq)G3F7fXvF)AJ2ci2rluJdCdE)dcyCbU z^M{<{VfDBxbHI!-enL#)q=+!M3*x1!UMNQ*Q z=%6j=>|@Zv;9D4RO*3Vz7mrhjG`ryAD0hpj4_;3cNueLREu`%e9#e8&mMzA%HW%4y zw017O*OxzK)a_n33v1)f$z%R-o;ef8L2}=H7{_z=SM$3w=OvjqrSWSqvgfbg8;vA| z@0)e_lW&5Re3gUtx=APN?6rIkXPz4oLQIQ(d-TWeEWuj5w!rge3>Mhk{Eyx0QwG&D zE$hKbo`C}%Y%9dU6+ureQF|**ft{kLDImFtBD7_F@KPhog9!M7@JS|QrDfgYWAdXy zF{3JbEf#>3*6z2F5$(g}W*Xd$3I+FaiBml(VqgjE*>MuRBoEB3L*O=-UEEd-J{fay z(2W{kZl<>$t^r>i6_x(-dN8nfZj8*H&F}TP5v*JivbJY`=I5(9B&gPSZCWE4ZA|iJ zslc}{W?zG7xiOfy-6gDRrvF)jA={LG&;k&06RfIBhc*sc&z2z=x2RE93;k|Zt-e`G zmen@5#TNdg;`CP<$dBos$Ctr_(RJHLStu=;#Nde<^0gktv0p00aZ!m|7qE$7e~A&; zZ`BrYD=P_G-#oa&2}LtB3Nux%sI0?o94XxT?%CYhnf#b}4YlD&v*@5@kRAbOL*#{x zA<(Q6)8UvEK7W_;xF)&7>&}3qaPQY^uFJ~QZqVgqRN!8|q&pf30d6K5-|}wJ>I7FN$=fbp9i3TXaQBO-d;+o|%J zO1ljgx-E`Fq@`U4QWfX6>9mEZOV5QW;j6k2Wj6mNVmqKU$Y?i-IZn_!&m(>cx_8VoTPS-e(8aJRWTNP$K4q zvKkUKc65rP#RNc=sCl)LUKIrs>pvoFZ54{3Vw>A)vh8ius0K}BOJQ(VS6*Yj90Qj% z<@#0@F$cevf@@+@<~Jwc#&%z2kB7)!ssMCq6b8%du~ljDJAX9x^X;iWPpX4Za`N6n_w(jY2}J8(P>monT@wN-*hb%`bjxm~&E?srT}ABM z&S}fMRg%^6=pI=6IEL{HIB9pS*pVU9bL@@(6zxR``ocujp(BY*O=T82^lU9%d z<=~+dYLCtfxXHPjGKn10=JrVnZeAc@mO(qVG?JYXRt5@k#1*GW!zJiav7guIYLkWs z4ysPgHyi%y&4l=BHFNLQ>35|6<%@Z(DQ_s|yneCd>WLV=@dmlYL8Z^7jalV_R%04D zqk%#EDqOr;$$!2wjAqU+i%!VdNLrwPr?bx=FX_jbPg&8))pX32nzr5~L~?lU_ltKP z0fByma+`tipOc55u@~0_n|5xvKGJa{_Sj2rYw~(#JoxdI!M+Ew$#wdpz=31)>nfh& zFo%iFnjBu`!MpBWYZ7D>CX9uG#dMqSq3DV?BJ9QSj>{m81k2I43j89$FDV?3Iustf zSt$s5Hkp50@jMhTj>Bdh4EiE`UqGXd|p z&cts4G!eRMh5-sBiP<08wTyQ}gyakVuuC(E{`TRq4(ZVjo$J#|l`u9gD5?My{iw+! zdotP3z~oH#%R&Wn$D@V(fEe;UVzt(b&N}$Y!#qLJd>ftUo80GARMc|Rvhp9J$Ql|GnNl>EBD%~G5`!Dd_Y)FlL_lsu0+g6S9n02Se5W*y*g1XW9zlGzlU zSs{{WvmYk`I?e1d|6$GhmUq`nz>NSLPinDdsJbvguzNpjR^aVJ5*ia&PLpjzC^*hK z&V>8UCq3@4d^SE?EOesHG2MkW0e-Qe@55Dqp}q)9Ab)!%JuSMTF-9HJfYloj67(w6 z+s%?^quy%xSntTTQeNQmlNq@`5Br*9q+uHU+X6O0Cz&}a3Spmkd?UdL43$=?DSvakZ^1-7RyQV7jwHq>X zgV(Bz14{Q~{Y4Az=IPCphZ-5_24`pPe{umPW!v9l=s91szksrpKI$!Y;^+3$XD5M* z(+M?Im~?Jlt=#cBS?tlZjpY~+f#(I&3De%qFp4Gf!71_G-&pdblaYs010A==%WzEPEHV&^R z_kpt#?$WVE2{OC9KV1wjB)!jd;dZ<(GlWcINOn6K<&2o3NOg2N;2dwnCm}Cs=eDrd zR3`5g;%fw50EkhOcJsdQt6+4BNKcB0M^r$7@kX0^3<42hzkoa9Zr@U(UM^x<&tnr| ztisJLohZ;4xy~02U9gHcM1ssF((^ zZCAu6D9 z0~uTod&lZMvk+FZrYTxR>A3OM2g!lZJs+@fA7gCP5U`ikJeNICa&ZZF1IPXHleuQ0 zT1mG%?w4bVzJ7@rJxGiW`8dVjYu$A12vZSq%{CzzGC|Io+EgVwho3gbfdxYQDnfy+ zS)=1xv@tlX0x4Vt11Vs%gJc$5e<1?eF2h~JxH-JM+U6Ea4U#H;&A9CPyNhB&XqW3l z48ys@o%k*D^#B?3pI%d}y1?k=<;BA4uNi8x ze`hJ^T{xshz(`B;Q~t=j^!W4Y;0CwmJL3T@X4tJJI(3B03fQZ-;>61HF;LVPMJ>SVYjcPUtf4 zDbkgpUpQ=Ot3Smafy}K!oJ7toU1CRAe~O?PE$_h7na(P^?2SLqjZ{=;qj6yrHDZ&rGJQgNSkh=#qlCvC zVU6_M#NZfV$IMDWqZ1=Gt*ABF=v~<(1 zO)POma?D6AkdkBjvT#Ms2jR!!!9@tC(xz7Rczz>yniNhUQ+nU>|~92vm>n6 zo>Yd{=~ebV&B`oONJHsk5DOPda#Hn#<3Sw!eqTD^Bz=0ywXQT`JDR;ZSjtMtj~Cc0 zLoBx>Y9*IOr)cCT`!Ku-84Gf6xe7c(29(N!^{P8?8SF<-^UcJRY30NA#hc zY(IGnRa_A_qb3+x4ybOh5i0?m#1MLeQDC2h&ATf9UZp5`o}0hpW{@*x5ydNx>efan ztoa{CiS)LO3%%qw{u|9pUYP-%w{U?7@0F|hn}T}hl@=_OY2#o6q~!&k1u}TR<8s9% z|6XyC7qmkv;xcc}RYkj8WdXjY^QMD`3;AU*ENJh+wdg|BW=#d*xXdNn^51z;nzIu< zo&x8%hZuB!Q}^(adELyr8aWTHzU&mpU~M=@ZEO4OyqiX)SERlJXdBMK^AER|JWjGx zXu{o{amP`3cIH1Od+e=tT2m+;*EcPMw6Lbf_;zpg+8YG5GoBPYwoK@(tBI<1u35{7 zjpbpO$^xFu3m_VtM%9#y&H_)1_GYgL6R>k2l7Ew8~MyQqIdPgJ&0yGWX? z0F4c<%7p0TBlE(&ZXr*NObR11T3QVrL0mL^dmb_XZIXe)DV324oTx=9rZQn3o_Hgp z9-HfseI%-8zEe|!9>~_5?tB9AoZo5LDW@?0H(PzC$L2He+u4zo*2xKWD{wc#K8a<7 z<|^17>A$p@2#*~<;>A+X0|4|7%JEDTV3$O?;vZXud4C0Ly_ce7u#M)mnSW^(KipiJ z#J24N1 z0y{$|^ykxe2EuaVuR3%=-7nTs_QS@YDHz28qygOL?v&hCJNxDSY6IyA@)O%CG%5@l z%UE4zI*A^qw?q%e6eLw8_&JoCy!W8&6k$YPUf1{?5fy4E6WvBf`ovg-Go0$ETu49%T=d$l|~OvrW=z?usp}&O=!aT}q@0VT0s6=Q~Z5K`24) zMYbuEMnt_>c0!|DTNTfAY)^3xESBTRl>Ol1Qy4)v1^D~CS=#}t( z(}gy?`Izm6*U>+6eq%($y>@Ta1H6N0(i`i^gpe-F^c?>&>V1RNPhmO|zwUyxRSiea zrxx449;c(L50*?gbkpSRHz4j%uf%ZMl(|n5zr13S=Sw>P4#xHU5U+V!%9eH|>GJ$s zkt2K0y%SmYG}z~{yNeX5y()5t1c1ZDk2u%6s9c{(Sb-VUL>9~i#98yO^123kvs|+6caDRVf2V%cY8x#%QwWxaHOuGW<{{ihR zsya3gZuU?T^vAMnkzg5dMmbZynmsloIG=#?85j572+pIEwx92_HkV4YS$}*&LSms{_Z*V+MzCnJ&wKlzAfPG#ONJ$&S zitImme2<~4?5L+9z$QiYw(jUEkg;gya6{D9U(UqIcXiC+D&HRLB1Fl8(F=`@Y{<0R ze-+kRGpKxM&=&WMCcMmkFxed8T_Wv7SL z6TC|uBmqs=$|_<;v=*-O&8>rPh0SmZDewy8M2>hvb4E$*5DYF>%-*{kdsTCh0ksSB zLV=V*5TpJc1-at2p2Un!a`mq&mm}IYiZ-oR@-%iQZRYvMtNmD5?YydRA}t0_1)dTE zP39!4c%1hgbgY#ZeP#_6jN;bVQq$Y(yB{*ix!~;rK4a}XXgy!3WZgCoA}oP{AQ#9x z1Hx2?G#{Zz#87f2FMyj*MD`RAIv7uDrG(!9%)?cwRySehKR;$ zeAP@s+K4mXHuxyVtsX#QG9GAsPHJ59=JIJM>Z7^nEI<&M2O#6Bv8Ai0~g?0=^@YtIl4F+v`M+^PqQ zTHMrMc)Y+g`JQs8uFI*)v$>erU9$Vaa!#_N(Q*@$YcyO&lyrqAl&pQloMRC` z;UA>eQKJXq|IKo~PggSc;B4|GBe`)|rCIep-O8K{=CatvR3F7BG=7-ml$-p$>Ko*S8Wf5xRtsJ2R zwtHmpdx_6Xt0ln@V+W?nYVm%%wIsEpy1{2#TtBa=YXU9C8>FboiAFbfPUYQ;ADgJ{ zD!qGPOi6XP3>I2{$KBCxj0%et>L}@gMJ$DHlA6KjsDf zX2kwo&rI>t)=YADlNo7CxGi7}@*Cd$^=QKa+W}O( zTlW_h+Imk&-7>wj=!xJh7L+D&t?f;4RVClFIii48)~H=%n%}=yrSlO|n4Y0~qW@%c zfJ9k-%~z#gPYZK9fk8!B^bP$y{o5;npn!PSEP+rCJv-w8krxS@61d;@u=yWwjjP@Yc+|!` zN1JfDu*>Bcb9p{-_eEZAV%WsD%L?v%?r+Han2=<_iT=(}R_7}lFH-EA&g4Lv=`B3C zC3;Q3OxJNbTYA@AUQY17(57MyF_i+P9uxNIIC9pn9s=_7|yNU(>8Flxts-P=N> zen%Ae+UVFGp{3WLa-w{74k}uMhwMpUjWCOwp$^m>$OY zZv)i5_`3CPzB)|FLFEVg|79VY{sM})ITfo70}6#&uaTSj zmiNxqb@?fwbov0hgxKgBKY$blx_TSq=z25WC)@!;RH#V!%JH=Rw_d$2CRS0tfjM^qgL2hDFp zJ!usYoh7%ghDCtRU1KI7%8|D7mLEfGWFsi-4{G}swN>_g18ur$j`8kcmfur~GZ;I8 zD$;eoXVABB+MFC~j)k%l6k`iXYBFYiRMs;Z7tBI0c-Gf&Eq8L1Yq}z;V-UyH_JMnU z6Tmms69)Y~(qGkdi3kn3hfl5tQi82x7e7JYDG>&(c%7JsHMosl$688x+h#zGf8_TFESl;`)?)W zc6b$0+WJ&jkYJ6AJ=a?4x5CsVk(=Lgiz8^BNQytdxDQC#s0l$#cG#L9z}}X_h8_9i zf0#Zz#Z2t@DC;7kXZ2aIjWVEOG*YAS81_nwxA<2;-7^K2OCp~>i>r?BT$I7~Vg znQqJRw&i)tbtKb=>axEN67h%9V|>c#RuE9obYc6Dr=UT!0D-%ba!2HFHLK?^E6oIi zhNy*PRG~d<)PtJ`cx9RmO`Q_~E67`jL=+bkQ1w7SZwG*=3<--Aj0vyZ2y&C8sd2Vd zY#`Gk9?l2(Euhp;wR3B`6F!9SK`m;HqwceUdCv_0`u4oeDk^naTJS9cG!;}-$h8jX zS+zudRBX*u3ZDM)=|&#R&1bu|+z>UewX=QP5%^bd>JM;b=9C7@5!p#&clE^Jo%2qc zrwzg{F~0x&V_N8v6NU+LZX<&VcYv!MO((C483Act|KLcti`1E^N5}zTvDeT`?gAgC zUZ^||>m@fn#iRS53wrb`l#@murmqHaKJv!gHC2gYW^%67AU7J-1j{43~8SDXF=ii3Jt9 zre*6N)x~&!QyeFM0+a&#l`r|7U@K;KBBHysxl(oXUnqG9{>?NqQ+Q8|% zh|DSD^7;#}ZmZIG{BLgraAN)Z%we6HjmI^I?1mm?#%O%ehUb$k;gjRXFB&kVMDliT&N9LF6GL=hcK~l-JlM~vrJ$0aWpFfK4-^^YyWzS671RLI^DKY7k@2#eulLPR*dbNE?vs*f% zL3Qcu#^S2qK1tT68>wSykG-S7K1@cCkrH4ZI5UeE1d53=tJU^FV^YP!e<@3d}2 z@D?#^z%as2Rd!}sM-*=?G_N1^n5AYs+keSydSWb6@~4JY<3Dsdy?yB{d_#iTqF4#!5su^@GAY?-$P& zHW*!pJ-^!#zK(BRp2@a@yOsmoYNa+=0f4D{xwas4rEPFY@OD8{Si+LBQoWxQCH;%j zq&QdmtD=O|UA7R>=%Fe8baj>biz=$s2MPcpnP@lga$}yB;keKVk&@{4V%$9g`~BVE z4JjJ?BLpfK?{R-~3kn0P`fI?)v#wc3)334;*!S#@2eMi$Ez^_g0;H%_W>r)Ve*bn| zaVV1pB8r_aK*4+b5wa83UlQ7R*#1QQy{9%69S_*q0X@9DuL5O$`zNN(`}8K@a6FT4 z7Qep0=~rNGa319EOihV;a{pkAvlT3|Tn{r6_j=x;=F%wTkVRG_$}(X)eE*rAxYChf zit_o^sic^%1kdenVtJPaj;D%kvJ;%Ls_b7eHy^-;>)%`yr_u@avcEr_3s9)1NZmg{ zx~)9_$GrSyH~|Hqt{V6j{A-hzTo&}?!>Vp2Ds)q3^-O86e@OrQ!iQB6RRzpY{)bwT{^X-5UZolG|4q91 zpD6Xe&|mSg7#fbM{wxjjXwI;{Bk&)-}8%4bsHrw*^5(&X>23|Y8E zN%Rv3NJQrs#p;iry@(WA&L=-O`}?;ieUm7D1yTM4Lev-HtsebL0Z6MoBY$0Ff1$?a zeOhJcP6zhI!=8d3b@K{r1F`8w1rFTZR!ft|96}cU4Jmaz3QaLBu}r>@2;L|R>Npv- zPw;%c<%8BVEkQ71Jy=$s8f+Po0 zH27X&6wMwLRkAwv`_eKaUm%VbP>t4S6jzy$|q^pG*Z z)f;N~RUzT?#;YBWZ3ydTeZEo&oY-D@#$a% zZ1{tVucq~me_{L2Tf-WUBGu)H)7M}ALALQHpmRmkS0k@B7sh0}9!-Qvtup=LO9<%U zt|`ip+PvnDBQLp6F#J4UIibE+m`8;rIow|sFcjm`y8PtH8=LP!)qk0Oz4Gcxdqt_Y zb->5t@)mzKM^Pf=cfzB5*862&7fKhXHa(#D?wOd%795*pkz?Lpt54%H{57q*Dnat}54W(sw1Qe}ZA{#p#On`NOG@N7f71Bpc50tLZ7sd` z=g)^=(c+t?pALPQ$MgX#)|hQdsFTagMQ?rgoL*J*8)~nkPVzO%J3+aapqA8KnEQ}+ zf86<9hM%i>weiH9Sb5MB8NEswqxXpwGC$v`KfSIU`Wf+j zEws+M#?t8RQf>NoNbHB9YWOFaZKBFw(H@-LW?#Erv$|}Wa>@JX=Kj)u{gdgf*C5<9tFFl*HzfRTb^sn_;)8a@AiC4E-?S`4 ziF8Wkjh<6AG`yeKqInA>DvWb~%oVCBFGCLVk6VP5&rzMB$2M3J1ib<6NPSYMP2dTLeG_NeOFjNB&YM5$D{OLBqLixA7DGds#KF_R-cd}hSwvcbiU;b?0d z_yKCv$dRtn_bXr}b?wy1X{wrPhVL-T*5}9{%$#Zsa+esnXZ7icbRAH(E%D%kdaO2z zloZ#WYq7D!UFFqHY*)yDxJk2*?I>1~9~gKu-=>8~fcC>krTdc=enJe?!1O+OJItRa$o)~gPG9{b*}M_$=@KW+sg@ogV|f@~??&FipUW9&Gs(M~84-L( z1RkkyT^s71?=3Utic}0ZHf=4TI^B+9LOM==y*wBjT6j`_)2)P$7%mK-T8Fynf2Qa! zd%o!`W%u=8I4mGv*fCfJ0OshuP@}t-T9|7)-y^Fy`}zzZ2Cy*CRbrhSF5_$Lq&cD( zDnX{XY;DiPU1Jg@hX+`eUkY+Fvq!ZfVk;jBPF&giDHL|Gn2-B<^PHW=c^};zv*yRQ zNumW4*JHu7*0S{~^XXuOfx}yord8T&R)2*R{#a-1?qxh(w$IMqkc#20sj2JFxaD!``@D zDTo1&=mU#c)zv(DHrUQG={hxo*q_vWga|zae5JpD9G%TFWdy#RV`Nt`Pg20b%qdyt z43FeO+FR|#s3@4v0RZg=jBRtr8hI%4w}EAdVSuqW<2wku$;WMQXk~ir(B$I{p#Sjj zdRGbXJB5xo6uBpWx2BkXB7%~8U@{vX9{B*Vf9+DGYqb;2rk*BW_S{;|b+8$#@;(cv z{~eo%&prQNnqYoRW2tPg(mV!R2*@Lsxc@R;$`u8f;WXImX zfrSC^wHA0MTL1OyI4RdT=WfvuB7BYXl@?ttRCYs0*r1^iuUwx1x>SX-U}#h@VwcCO z6~sUn7eRBdOHpz>{}udlz&1F4sZsLE${`Mybnl90UF$5^;O}_6`ag(C{B8sJ(pMTU zkA<&wu-%}M^K)Fmd)%RjZqjGk+G-^)b5qmPqo_ILozbj=_)Z0{XLmQ=TN6gDMPBh? zw3gyxS%nTZY|PE$=WT!-;^N{ROz|b|Vr*gCmgm)mzl}dD)&NI7S zrzV8DXBkoZB^tm!%&pSQ>rBSPo`=2mWO{ogNQ;NR?pD-%duZMHnXCy0ou@nYYfj3d zmO-^$uIQL24z02^ljq+)2rA)j@?7>R#E}obre>6{-KJ>i#N=u1c2~Gd9{bGUl7G(| zfuu|^F95A49L~Fvf$lYB0nFHr-nBwj&JkosO6LTwGjg7?1(XV9n38+?5|y2SJXkK} zGkgC0`RaOi6zr>rRk^nB+27w4A*aIvu<(-vn;F03mDXdtT+=v&)z!&r?WhoTs%)CW zuK{T-em^#?uw%a3D2o%%D*~GNEqh%kM;?mdfYHYYX4ozw^f7b{b^nR5Y+CfB%WC{F!5;UW9eXI_pZqf3?eQp=P z?c&XmQynPM?K{y8=WA9E$C4;JAp+P>8?x7U5xW9JRu;JSVjND4i_6pPHnOw|t`yUrW9$#f7U01DswNnPW8*tVL)P5fOsKZ+~Zh0=v$;zzQ{!)V#dJ-$QQv z-4$35FNwg6LtoR9B)13>XnQw|Djtq$P#51{m65q0e3v3D#P5+#s1ND?1p(cyRdd_! z_f{XJv%fQp;AwUaShA(-&$CjcOX-HsPeg9ZiniyQ7xUKN_~7-}E>`IgV^{mN?_kuj zuM&~oydL7I-~LWsK1+6+;(Y~+WbGWB1PP^Hh6O5?uiOrxP5u60+;wF4%L}OZbrG-9 zKf)mqeGfE?3<7xYLWy^K+)m0Ejsi3H>dM@?!%qpPClqdf^NK`Em9%RK{Fx2-5jMW= zzJ;SX47-5=c57pMp?9z+TZ6nxN>&+!)5W?`%SUs0FyLX`pxFBrSD9ctG;z-`Me?WdIghVmy)vr4*p&dW(mo%EK zG%qoADb@+681{1$nFLEOup%GWqC(u(eTY*d<9J#e-;9WXolxq{Q=o=U&x{rk)ivu| zL7^SmV_G%aYVqrwVSt^6;QUfguq)y@-pgswV>J;e914u-{JO7-x;(JGj`s~JRtS$9ZZugM@&Vap z{fFZ=L=O}`1m7#(UrTc92@R^r<7Ul3VT`7jt>Kz){{!o z2R{4Tckje|Z(L>xu4w{a_RAQE(!b@FaNrXe9^ogbE-PmAkJW}a)U|MdkALSzvrnmb z5h0_qgHw{ax$n!z;P;o9n0P5QdE;b|Yn~I97>-DYU~}}H?|WdGJG|uUJC*7rHc$oJ?foX~1fUtm9E#f$mWAVdXa#gl#uWm;!k#R}MOCP~U1%%(K zlXC>aOhKMx+_Wl3ycX!wlty8jP7M2<@H4}w z^~)l=RC6eh88=V;9ehtH;CCWU*FcBfYxG|!@1H7%heH0ymWwA|gc?2ht?%pq-P!zK zxR?I|hX0?8&McbhUv$US{m)tI|9)ZfH>fsoC1vWeR!;EhpTJZVd1|uP|52Aaj?+e& z23ci=0Le*^O!*H#C~OSSzp$~WzRVLA{JCXV`=&zh6&|Vpg1(l%9e=PDzPWDMqMLDL zT>b4QFre^k-Pq9te6&dB`EnikbmluAmX7p%W0n)7sKB=g*SvMG#~LnX$%%8ydYW-~ zH3ikWT^cT!6iQp%f{z$4(0i&lnt=zBlC2cV++7v)>si*mp5l}NyJbT?khi>lRqDtc z;~LhjGm;wHay^s1?JT29iH@5SZVT4F%XjWybw0l{@aFiM{KoQK3Pr;)>j&6QCsu|h ztf;IRvHEuVMT>y~{CY!TL%DRs;L~TP=~TsM)@Sk$RKCXucZP94kYAT=q4dETRg$Yc z46yIMdESZkB(ZAnzG46A0#faSlGBqC1<=8r7W5x*S`ufrF4u)In0Rp9YWsb@DtW$& z=jqEIj#{>}@AuYBUka26YsGolD45v(I_YphIxLwQCNj`eOayNcZ9A02*$>|; zCbS0ZLEAznUK2aI#IPpkG>ann^Ft;GM+|LX8 zZV6t}obBo;o)-fNoa({cb=++(XV zWLu{ceNMTtbQb4uv{}`Hzc3?Cca4o3alEZIwnOf`4iLUEg@6| zl9kDi&cwpZ#80^_wmk^g0K`oNmPT(kXRp9 zo}p|On#p_b?lPDzIEkg`sG{@>Lj~Kh=?EC^Z(hJr*OZ?n-JPFXFx8nrln8pP>>A@= z`)>Z?%`_trw(PG(G7tyKJjrABhxiLy*a_b2M{cf$Jf)ZZ8{!p9?*Gtjl}_xvQNe99ea^L(XTH5Z+Uz|ZlVgg%a- zg8E0)cl6=O*9>NEZj~q~xl#P}K!e306Y|@7Tduz|9JcfQ?+qnef>)EfXVt}z(+gv> zq%==TLv&~lFd*7rwL=)r`8wy$PEMWM0Fi9^=TuqedzQgvvR#E#ulsXU+!9}y=VGns zd7ZvsUvEz)`d63rxXlj$+vz=;%fQ9qqDLQ&p;7;*wX+V2x()liB8Y?_jf4nDH#~HS zETx1u$~}fIDB18q^k3u=(jr@2SvDS`S{M? ze{4KZ6YutwMuKc7)fP-HZEWZ)h3|?WXkoGob9e%{{E7TPtV^Sj%n7Gy5KCPOkIQ%o%{?g(a;klm8Q%R|Zm(1r6wXqOqFEK0%Hi~t z*-d(H*}=+k+>>zh{9)tC4!dz}8trr&@i|3U`(cI#l+hC0a{2=4Hms@e%!q$XC#*f~ z@b34fh#YCWpNhkeH}_#P=u0701~J?soyG15CU+fQt*;cX>;^h5kDL_;UJjUM#Z07% z$8qhm9+oqFy8oj$l7nGH+2`)?v)0Uc)9lcRFHKdvZ@xGT$Om2imLu1ctV;Wb+InNl zDDG}s)7^;gyQ8^V%?|ku7_+{jsx==3KAes|<#ViyY*c)n*%|ATbmWz^l;CEXN?avY zU~c${kOPkEY2Bm`kp@-&FxTOb#cSvAm{gwq*O~U92inJoVu}eVqnEQaADAVZWZ#rS zNY-$&!~i^O)XfKxs&BxihGjnU=gj}&O!lT0?p!SzyK{T}tyDBCha>8`A6(TpP3PpBw@F)fAe#$=eWD*yZ zF@EYr^Ty#!xaFnOWuLFpw)`2qpoF^}z5_DJy3Ou%MTo|pZ`Z9hZ( zuR{_V#(kPN)XDG$5TD~^=K{Gg(uDw}ZaYHp_eO!;Dp`{-^&k%~E=Ek3@E7%LHAp>K z9C=9k#l7neYtvc^mwY?YgQnf=_S-_-#p_2iJ|MFkZ4i%7F-@A|3n54dcLIQ}0>aEp zlDeL(_~Hi2hJDm;1b=gUk$ld3BzeQssKTv=+k^U7F*rk{)Dw;ba{BaPuP&80nH!!H zq5Xcj4Q^HyD1bBoW??a1!$%S|70^RKhFL{;l+ew~7c!Rr9=luCRHw8vM3dt`P4v?L zHSuZYEgATomp%-fMTL3>_930(E0Hh4^0Md3k$37j9`aAJ_Nlp~1sR5w7a=P>36Hm* zkt56K_jzIk`t+C&6fpKjlKq@?lg^cM!qkt)MYy_Av0p5PMZP_4%W76p7moQI<;$QK zVx#@d;d1kicU07*oPzGlA(rvYqtEp2=4xUL7Y~7?j8YpdFW4ZGNx=B>XR&@QMr%3v znq#EV!_i$zJ2V#SfotLKirZAjq*P_U4Y>$x^<(+oMro^IRo|7bzf;4?C%sU=6u++P z7*s0pDjDrd46l#-wIeGLpIEk9oqea@r3clg&No1HTN>|otJ}JqK=XYBWQIfmg{Ley?NFC;2_mmYT!S4t`uhtmaai_52#dHiH2(1hYeQa?dB}S_tT(- z5df0|Jp0Oj5csWG-lDL<7$ofX^l~SWKsTyHpdAuf8nrV=NNTo3!l*g1`m;i76;;m> zNWn2$%CX&NN851-95S$0yUaCkuseGD^9(XK|C+ zrywnNWBEY`FRbF6{rTj6Uo+O3VHm|cE=Ud-u;z>l_gKTajEr$VG$hv(W3F0TU&pV8 z<|nu1)F))99#bFZQew#kmmVn3tYj~Lcl>)TZ)GlA_C5Ae?~+p;`6Z3Bzp0nUvE1%g zrml}ukeczBML5C-{bK3SUGnV3;P9oHSPfs8)y5@NB_lZM$7%2KdYfa_!4e#Q#Gd4f z)?HU+ywIO88TDbRTyEpDU&#pH&uts;0r|o&kSn@J^1J}d{NsDCpJpO$mwe)K6A{n~ z5#o@~kvM-I_0cBWbNE7*?&y9{1F{(h!C$_qN}cWRW8Njp1cbxdHw*V4z6sv7V33Ju z#$J*rx_wxggy>mLUWRLH5&W7$r(TTa#k5<43R?rQ48a{Y3 zq(r}c<^8tix0^~Pa&2_RC9$Ze2j|kItY^xnHB`Nd9vAQfg5nWZlO?(a22sQEm&6wP zCsxy%72Hlnz{N98P>Qs*>F3QjmUz+~tAHWVQwG`G{?BjlZoqMpnpp8VIcv!AKkhwS zFmh2HJSpT$>@016{2te&myWV6og`zBz|s{QvBFk2Ef)VIouR+~q) zR!OaVeR2cxmFdX|N7HFG#;JdTP9Ef@yjkq!YgppLxsjyeXu_K13GM=A z^9(327aUblRzy)2P{k0{5qq)p5libO@{Yls=w0KA{_(d}I==-UB00^*hX-~2Pgkam z(2D){3-kyi#z4#GVF5DEG*n$_Px6LhntPtUNhj+8tO2O6=R+!`AP0-C+T~N|VqhKH z(j8SzLPpr(sbH|i_3kQ(`m1Ei*6q(Z7E)s|&r1bqBvXUjm*nsh)|ycl##;(!d_Gi| zoj&VHA6fXT{tpp^gA+WXi_>`Z70=#YeRu}ithm=@!8_R=a3J)l`I7PZ;*r4DuV2x> zem&fpMu_g3S=WADVk^_GJaF;zZ;nuWCXA}Q=Plgs*`RGhqB)zuxWPp3!q2Z9QNT6c z9(no*?4{-#Ya`LAjuYO30qz7Y{&#q8Q8dXalo5Q5T0Xu%coVtO!uJUjnN|;(N+K1X zKRC$Kr#f%N5XM6}$51I{7z#u~?PlnfZx`E^xT?hkNi%NBk{7X=fLvsq5XNYQNWea{ zP9i8Fct=mo`Zu4CByZk*q}p2n^4wa|iziS(3~gi1b$ zo|>lUg2~9b1X(<#_YbTMBmcoqG6MPiFf1 z5)BlaGK)^gS)o;_vnTLnFJdP9mYV&}fm=Im#>{zEQEQ8iVfL%D#%UyByVtOU1Yo}q z2H?2;(5s(%s}ug&7DU|8LbDa)%<1Jtl1ZmhQTCTQT^hjx+=9Y ze@4~MLo~OTQ+vmKaI&Ju8G--{%bYBdp9kQBJyL03}?8_|%7& znehNEe;_`Ei7hc2qLpYbcWSy>{1Ru~9^46OpoHRg9U#iZY-Po zI4S3#@&dBvw`B;= zF5wQX5W`T=eEV|ZZF#CbE-s}iL({~|tm=6#A2Ma{!#Nwu7((K!uur^0c)xZwe?hZU z-z3Y71H=@sFZxa+ubVz}G%K_?8!Ww>@%TdLVZo=85xLPGA5(bwM{T*C2yWZ-^z(u$oGsH}Im9|- z-WhPZqTwDsj)r60VWG2Du|xk&*^;j`4Ri9L2uob$5O|tS2XldD-IK{0&x&)JN3gWn zv9Q!YyC4{vBu+^$Tv254OW!LA%*ldKp9LfOQd|YGmtZUnt2=lMD^)H@1uqBD<-CAg zuPgs4=Xs{~9Z=FG$MSC}y`xHC;guz*jOumCao%`!?b;-JJIf41_;qyGpR7Wkb!r&_ z_ZkM-cmuxK;@YHP&1KvvD7LB@aV7}MEbaYO!GqY-iZu=O<-y{Z`UJLK3DRtxig<+f zqT0=LZ(Q5h53$A}31doqM+l!N+hEC%-W1;(>PBFsQ~O|ZRh9xUF}2YZKMjfy`!V`$ zhZjh#)(%V;X0g2>$za6-iJx0sS7U!tP*_7>bn~AICq-zgjCy(m(N9 z>vq)bv-aaoc+%TSWLlUGVNIM-&eU+a&VmS;_BeLcn;^(fyCM9hL(~3geUNwYk=iQEyanwd(G|#a;c1#b_(15{CWR56mugCO@TQZD;;m zaF;H^E#jel-0-PCXXU1$8lqrDoiIJe`K=j5;v8&#`Qbs1*8(eTsS{(^*_sole6dqz zeum)D-YZI3pTs$Kmg=yr5Nu_xs!RhRzZ3mcgC^eGt0UKVa+7n zeEmZK@gC4lHQBM4N}~x&TKET}tY$mZ;yMf1uo-nm>h3 z(4Q>!ozyRe0zktxTv=Y8$Zb5K8za=Ww9@PDVhS!t)7Z`l z1;HgUO3-E7byN%G)@Byw^6mZWljvNDW(N}2DcsoppF*#HyQR)(m9h_Z=ARr`P6>`q zdkNhy(t4|0QRE0Ry6qYefKyVl-#M>wVU#{LSV(&!9Qk7Eu|^hC>9NM!nn9(GIlt%~ zvuLU#*WCN|{k{-q5-|_Da2b~af$L(zjKOI(7O8NM!%Tt5D`d11(xapjTroqb@XZ*v zju#Mlj1GDu|Cpzuw^&tcdv1`x!1E@8nbqF>>uuT&A%!I-$gm+X)lb{Y0lnaIv$x{z zk?}k!%yquJQguf;%O`_y8eu%Q1I-7vo=@J`TA5C}HdnpQ3rLu7d(!*0yEx{-MT}CT z%#s-8S^~w#7F*6l+1MQ4dN#SB2$E|`VEsj7qW4PZEpP8^T?b++__<_6WV|zUsv+$| zc&1^@4a+czj7d^34SYV%Dzj%(nBjHSN4KHdjPk>oStTFQPP)}HvWNfFwub=0=f2Be z$cz`|5bFuntEcg8S>0Z|ID6!m4J>v>ZiULC9Y&rVfYbDhb>WoKtd|iPRN>n2)8FO;}by>1K*hs=R;jMf; zrIAqf3?PWk;tXrMH~T4`b~hV~ATzywnfn z=E4_Z*5epL-458N>?Pb%i;y${syx3o{ETY1N;u2yB6(650S(bDc4F9}We?L)r7cAA zxp{hE<_VaIY*doHcqMk9bw!=LLd{x8U+hzG4{^`H#;j_L_nkB@#W*hmlJ8-*);$y? z<1aO=d#u*YtVbQOu3t!-$lRtQzHesr7>b>Tqj(vDyI*tlxqndnRWlr#HRDvgzgFed z?{&;=9umvmY7EEF=#i0)eq(Lq!ycv6 z6OB;=6jJj08BJGKEAMNqm&N4FeZu^?| ze59bj5VZc=XdLc;lb-@&*nib?oCD1|T59wtF=mC=ydKF>0LK(MpkJ8ZWUc_I{y%tO z|4Wau9q(1FpFxxsA#81Dxa6h*=QAJhwfdF-O02P21mqW^J{zzZRhLPcIk*rvNQp19?z4NsH)2?h3u*68lpi031b%%anIb@Y|2q(z5D ztI?>Njh~z28!&pe{3sE?{pXTm)pf72?wQ68t?s8C2=B3>Eu$yIG`PV;lLLL90E%Q; zrz+Nj*y6#N+o1vtPfSnUkrgghCST2YC357SRmD&U=QCG?ripckS9n!1Q`6{3VH^2B3!Sq?9Tc%U?SK z^F*n81v@pSIMa3{q4}t+^Fns1>u~p-)9=v=(c%(EZ5^F(vAu~7vZ}6l-XMu3`y}6G ze)5hiYT9d`(6|-Sb-#BWWP|e;|GB2k;KVPimJ4N^7fmPYZa?`B5p1o;ebg1~g zvz^p_{D5K&`^dzQZjQ?>_|k}%$F=lzqCy=dGHyTjtJxJz(naR|0q+(HJ7{RkO!c`CwEm<9fQgKZEYmB1<5s}@Bi@CDiHWI)9*X=n;QhBjdqj-( zdcT&V`bZG4N4>TuKt)AWa3Da(#3<#2Z@yHMZ5suhsp>cjm2p%e!tB`(%u)3bI?Fl( z3L|2?mc|7g9yqLNnuYZl=b9k6zniyi&|pr2Qi!UFwe}YZ`;PX1YL%vRuX~sn@moAxj+9R ztr8c+E++(50Y(4ffStsMNa zYNEpx>l|rALm`9>|3+I%s2nT#XvOwdYaE)QqkT|EcP0@bW-Dsd3Z>WR^#E?RenoZ0SI-Mt z{UxOmdOo@59^jY|#8m|L{;%rY|-*M>z3Q5Gx*j&{nRl*g~$C=1MC@ z4EHOgS%U@(5(A1_mV*w8M~ah+`MurvzeU8sf2YDl`oW$??bJM*@h)>@!CjfQpP4|Y zhqG3?FJNx^n_qO}5Kehms*J7VC4F+Z$XZY*;e!{WxtP4X#9=X?i}#SSdvV zfLLA;p>B(Bmk7(`@D(IXeiRjrP{!vxq*K6CSZ48yNVvWO0r|y|gR1FB8 z&snq+Mxs0hUfx1hUz%X~4I0dJ@Nd3k9u}K6b^gI1h*N*am1j(vi?TE_ln>w<;ZgR8e6ZbEGrBP0aaR% zU*qh@rP3=aQSPKO?$JVIw@WYEWhVXvBpm1J_YYdO&#XnJ)+AQ$fqlfh(XV}K8Zku?6I*i116om`$YpNSSq(@;AwV0bR*lf zXqm6j$qc%~y*@kG(I6{aVWGcE~kK?!&?CSl? zX8^PK8V9A+BC;Nz{5Q1=xO(7DRb2b zEBXCP1UjktEk=@*q)?fE_aWSisxy+tCST;M(IfTCJp}W~ZBC7O)tNwr55w$KK{W5n z4?N`3Zduau^V^jx9z)K=JN_U0OsRj3==#H{0bPr_OOGe2O(v5Vgkfse8G}G*i7PPiO;F?T)shoW8d>U_$hT}l8{4b}q@3aX;Tg~4p#$_R$ zoOn0CK8!Fd$GXl%M|U~euOHoDIJ-_v!nX8r_=uziZAsr_F4V*Wh5VSYB9tS>@22`n zureFLL#^<3Y9(FPw2WO*Cm#*xk`uj`6q%C__ihP!`tO7JiAej}>7>$qwix(Y(h<0I zep$HnY7p>VvF@c+G|vqnF?fN5iCWOeYxJ+{)G7NUiu%VgxGP=86De0|4x^5)Vr*1> zZpSUs&xImcK$-;=C3so@ZVzJ&vdZ2@a!u3l<@0|o=xHC)&b{K*Ei`y6?(H%GJhfd; zz2#^H4hi$W5FDj8_iv2n9b7*6dZ}BSvV^X+>fXl7h!=WQ$?SX4gA8hva+Fw^ef?>q ziCfIPh{Gljm3U2cTG@B=fBRZde5K&L)Y<--td8TPAN*I&w?$(m`dhkQ*^bO0=ibC- zo{p0FX?pjSM8M;8bKcQDp==yC1{z-QRuUxrI@s9LhLjh1&V*Gp)E}RUMJ=p;V?2@H z$0fa^aNscTh2k`!wude^>Js~q&pN$Z8X2y6gkm*NNs_kOu_9e#>fK1Nms0vh(s{@U;kKS z$^18fr6-`%80m<;+Ni8OiIZ!Q$isjB`+J*0j2htv8N|!7UymKdQv+%B>C~Tj$yJhh zXfntc1!L8(MXBfLzA>p{1I+_zDn-io9rkwVL>VJ0LHta>>dBf+i}dY_1v{4?i6#b7 z-9GsUgK7Y^Yt>YP9>Inv9*2?n$GKrv@fqZa&)ws3{N9^SVG+R&r>|6p=WtCtUR`I# zKlrE1YqALtUA4QT|9ahqDdlLS>0XhFeDF!ApkS2vjrlKpqK~POG;-;@2`iTyg1M)t z9bD`F8;Sklw49<}#`DI|q3*OKLA2LkDnx)%3fxvnA&jfas8kb&E!|= zPO5>U*y`Qqr|a6+(8`*2`Akb(ndVUslR!vVbM^gtpIBfZ;rEFR#ru1oRm(Cb;sQ6h zfsnCr^5;lfJ#G#qUc*gfe3L&gue8SCV-TJwcthXtUGN<%3*Z{;7r#BJ(sk{QEaz7g zPg1NSb_0Y@Yl-e69M?I*P4$LgfaS=Mti?7WgyXa5Nb2rsDR_AT^H^8A&YZ87th)*j zEqdN@10A_|Msy5>u$ul+;fRD?`LO-AD4_n!mc-33Z@L-Oktml+0w z@lG1xr|krfq;+{D9IhVeO6MbA1%NSHWOQtFkMazXz=3b^@CSX>v#=KUt~Tx@7KjRt zyfhG7J1zOn4Ubh1wNPF!nDk@)WU-?j5Ed)~S)fTV^pNlbt2CPwd_N1%WwS7Dn2nldtFw2e!V^0N3 z;b;s=?emhR8Yl6y4D~#K#K7Rr{HM+gF>SWJ4PoG8&`&@e)o49qL&e9@MDs*28%U-b zRFWW~Uj665N;WBlq)my2KuoEdXm)lMFscgTkvvSUgHIu6vPfOH}PF@wN?x5y4@!2an3S}Kb`DAKOKz6g} zxXg@G?Snf9CX75k&UeGjW$CZ#K z0`7`u#Z++QF@9=ZgArWJ3|nACac06+ro;kO(a3RR#(?j=?;|(4SqL1h%-Yb-(nrV zh22P}DPD8Tw+XNMS9)N3oSV-(5%JLt8j`wARDuN|O5@ZN`8ou;3rT7t4E;n62_TVX9RVqpB%dyeQb%m;f(#9?rgIwB?U~s5Ng&=A81} zG_KB^1WJLqdtkEbvqRE^J;QJQ)}^`pMI-09{OFP>OuOU)#VX-OU0=DI1MZ7kI!2F> zleI|O;vvRzqKKak$aq>|$2pV>-wCFK%t~4@zl^0st+3<9M&2_7rd{3l0!1B_PrYKh_H`XW*rP z)O?;8Gh)7RGnYG8ECO*O!D=+rb$*Z#Sl!^j{T(phcg&w|oVP@S1@1EO&}yrF{z8Q3Fvo+{Yld0!b-(vokDqbDOQQ`)pnxnogFoQqwV|T5 zB})>aXu*CyRLbr-p~$?lx9F7pG7*;b84`Hxi^t`Pbq>_dP0P3HiIcWjiEaD&)fTMN zy%aaerr7g**<{u=$wjl_rJOq{bNuha2ph9@i(AYtkQ2M`wE!j$scKhUGtoepwEP=Y z)7WKVXao~R{(2+f)H-vK$jV3$0YWh4U>=%t+}_rL??{ClG};9~=v|p3v-Ucxj?;&$ zp>6~IEa)N0%zSed_PbEXlLF!n_ig;t-GM3YgUKS1(OPZ<;JmQ4!A)Vk<4$ld{y28i z-1woj3hTN3q{U&RV(jd7`NWIl(k`fe12ou;lXdU(JTlu2$wJ%EpJ?YmQ)oI*gR`tL z4E|i0DJd`tT1*;CjgC1cH|k#V2`#(a>`0}&eEEAV3jH-_K;Y%$JhgPESFpE}6aLBz+Q{$3uMfMi9)s)jAscfRPhjL# zw(d|G2hy(PX?k%xav~-q8;)1 z?b2Fm^C$SA>>ie`so{*X;eT{Xfh<*;nu|L#&K`%;_g%l1FQbxw4PH z*!m}Y9!#R+frmb=$PFBhvL?V=ThckwW?~siw@t%XZjqq0U|CZBkIk$lf?rq1+*~8i zkheG^aLVVtSa$zIPZbgwdKF{`UmAXqO%jL#Z(ZBR;^l&tWnOUq&X*$B(d?Gy3tN}W znJSvJZTcy1T12@e=X#BiN{>pZuCb2I28C}r6hbKj0}~n%c36eZ4dWzyT{(Uu%Xi<7 z?wMUlC6H(SVyjD8Ezf~$7C!b1Kd(_f525RJJ=0H#LSSp!Tj7nFzlHrB&4wIUM?k!{ zZ&y9jJozwQ1CP|#?{|zb?TL8N_aDYrx7tjM3f@Sjs$krd5#;g$*R6Dyhy;IaWM{Dx zJl}*kT}R45N0x#ouEb6$J;&SYVC*9s0(6s(c=Mmckdo>(hBq zlE}U014Ef1s8A_;OlF<7y6({w_Y?YYBwhGW-i|KXj+8;2yqtx}qsgLl7Za3e%4QNL zDpY?ub9vfnYw!gx`cU1QyMvv{$n|NVG2um2(`X-P^_h^0pfkNbB8 z17in6s@DktEyAP(DJat^m2r2_a(9?IB7AajZ{jh?R@454 z<&D`w43)PGqb-wtWqig22J9M;An$5euC+J@r=7Rs@EW;vzwvDicnDA#8mK1inS2R! z8pgEW@IyTT3aqB*(_MEPZxjP~_;=RwB{CCpFH|HYaX3&JlW-URbN6PdQOv1KZ)9J? z)OqySk^*G;r_`pXs@L_hH9O=Jz&U*Ndeve?3gN}y8e?I{DPT&%dz%a3EXVnEq8s+w zY31F0*ZzCL$(6LoBa;4TdCP17F0PMQ(9x){tj__VP+>`6N1Az>evt23-|V*pv%gEW z9L$Rry%HGtc_*mg!+=ku%Xi)SO3;%)5Kssm^X=R|j(*Jf9Vu2JMdW_CVnDfkt^fXJ z+4@dLpS1(lD{C8<2Ffh8WM>6NiFSu18)=)QSGv~ydutGs$9nUUpov10=k>aMuGGM27u@+Eg~&l7_iAC6L;IFE8EC`+kdFLMx70OQY$awJXAj zz5Ddd;iu=3X$yaH4-rJn8GczKWd`x7v6@`6jrIb6mAV=Fj=IB+N|)U7)!E%C9K+|8 zVcptPi&Mf1-#@UhHF3Q;8{HO0!i#0@sNz78{Xd&um&kqv>HPSOA^am^@9If=t3!Av zdvSMnx<-0zlo4I*7XL8X($f2u{KwiEhwWw+V!Lqzq8|~_B~_*3D#Xf4D*N`4+`=yR z*Fz zA{5$r91Rugo)?b8NAuL<6JFV5%@Zm2O^i4sNFTdJd@pM@{65YB$~Sl#h)3LW%mwDa zMNr!IL_jcf%*u>phd;^0RxE-1a$=eI#OUZJILG2bpSJHi)Dz>WKX_NYz4F zu`0Yn_?>~+KUPB>;0JCagf$2~BWGU*y!199yxv}*Wn7ad`T>w!%5FQK5$Ak!3wK&b z{%sIGmeE500S$3Z8jn2x?RvsMFSCFh`JFVB6t@=nKTJ{o7bX55Of~PyqKfEXJD}2K zZv+#{sK+fdI~dTQlZ8~)wn+m%&itmAS8c?34~1VK%Y@i*ncz&ZozB~P0Iz8>W|JGD zKrTv+xA!8&XdA?jACgjV!f^@?l3qb(+{uw;W+a8;lBxAWZUnojXG4kB-RdkoEGj|8 zfKd-g_j5B_hVNe*4)uua#V-Up7AMpBPbu6UYIC_{&|NFIVQe>Y(IQl)f z|0Gw(2G}zagdg&oW^weKyzRO38f4cyh-CjtDXKSU+4{yt z&wAXvOd?*M73VglqqS{O@4-!&+8F{OvM3JE=RH&T_V^x53_rNJU`4dHyQj!)=mm2UZ}KEv4OqwoTe06%rr2t=Gy zmuFB*=Y7ztj4*D=+4RneICoIS=lz*?{;@rOJ>(e~N!Nbd@uXe#e;=RkWIvh`{39_5 zds5$H;NXL*0MwrBdmz!k{kp2|)S7gb(ABI7nqG4hnUc``*S%Qg7ZeQUt2#&=B%s`H z-tOBVKgzF^q0G&$7b;!pFQUq3Vb zF1p{$!BIg>eG%Q(=LpYe`z0{fiCBqe2|1hRo+m6LX8~{|CfPRPj=rLTxPDI}0tq zJ|yt&PR>Gc)Ym`uQ4{woLh>MotI6ep*_e^vAC;O+7KsE@hJ#(2{#$~MYVYmBz|EWV zY2>HAk28PWKSkh33}2pT8>oCOy=$SK@4dS)=Y?OXm~DV*=@y(NMh~g|X-0|SJy!N- zJ=%-xzNI-q#|&?iuwW5*LwxEzu=HGS0YGdaTF5R94DOSOMXBtR&5UQdY5aC30)7dk zdD+y+nq$JKNc}Ssk<9x|{gL}jInMxMI)pA{hwiJ-y^r6zP`gzcR4d4-T?W3!j(nv( zF)LcCZoRGu+9h>zUJLdbO!GYXsE3aYTFVBfcWao+Q+NFQ^i^3}P0cLSOseMR+K9v7 zt0-^PBp~JnRdTE1{?`lg-=kB)t9&Wp*FB_-xtK}2VePnax1f&@YQh#!QL0s0nP3Z& z!vEd#l6Uyu0(F;Gj0oN!K^oO)4TZ&NG)+s&hFE~xdd0q_JmgjoHb^4~aryuT0~A!* z{lRzVP&A=GzIKncCfK9K`k&Vm0>=ERaD7L&d2`@&Q@PSX3)GD31 zrKTx&vfOeZ+5(qqxNh_6{f~zN$w1A_h#euM(pG{&)&KItPo_a=+TI+qR;J~?x`oJcNZ-YNQ z^nsvor)&8UF4%@HJ<)+6SWVTQ=A{N^QZResF-Lk9I@`l$31rN z2`!#NQ9qdoyB6~hQvRpleVIMcUT5qEdRcKxc@qDwP}2F`9&_~<*CebM6Q&HAbgZay)5@5_+7=%z?j z$=Mf;N++$W*XRpa{A#6dC20tU7_%g`nzypm(lh39DQT00KPgrCMDF#+eW#Bua6DHX z%%wu4Tk65`gf{IvtT2KsR-U1QoO`{IeDWY%LV&OBvyGd!kuxNv>3LhGr^nG+!9LFW z-Lr!){8kw5F}IG{0`8=nKr^lZZ>T+Fe zb(?V4{0c$$MD180cE55g1|fFAx7SaYg;5UrQekNxqcBW*&Yc}Suoc?LD6UqI1r3p| z8hr_6hd?Y(eKwnnJy6ibIx&olxU~FOZwzO@NbNTW{g85FlLY(S7Yjvbb2+c?!bvKIp%>FzhF~4YtuJZLSsRRkqLHLN zJ;PJWi)|t(Q`)g(f*if*|NTqQym>G~H*&tqmE7$mLROkc?b z@JFMg{6BZ2vQ}<9P+!yXFKZ)UuWV4~8WQ`aVW@daeXvcXqM*XXU8$W&6qi(@gdI7# zz4;>^?e89JnEJD-Y{bBPUjXU?x~U9+p@kT>%=akqr?!c(V6=-~$A&oI)5q*g0?q#j zM*nLNM`m=jyxJ6wyE_?{)Qos~MF+D|P}%CrdOh1eUujesbYukSC6^Ie%F2-l!ReT| z#o1C8aAATUqN)-@pk*I3ZShdwlTR92dK1YU1N9aE=OOf46ur5;y!<@L%nB1FWpL;> z>d3bj>ESw0=o$*TLANZ>0+Mg6(QT5Gm}(XrWs-QqWza&SBrA^p%^~c0w8?}VuK6^s zFKu6~wJLz6CiZ>J*;oV!EBnKprG7!l?$2-3OjTn0&qh6>JPRzd>+^+px3|{1lnnw1 zxCJE^s!>&S9?z$OFna+=B(*hSx5_MkzzwN)Cz0{3Z8}W;cW8A5x(?pqtM`4O1fS1o zPc_G(!32&ErH-cMm;0qOz+IW*)VPF{*&e_Fa=BRz*>4%<*sDNs1}i)|2fDN135X+Q z=cGBm225`$0FVr$AZ$W0CTsIlm|?NFZwruuI`kD~{$2#>Phi_lHTAfLXd+GRrMx-# zo~~Dq_lp5ONCASRJ&%I%=1+0>wkO#p^R|zlSB~j8j=BM@`(YlsuQ?gU1hL$=v^%2< zw#3k|PT=GRj^>4EMc<1Bck5jU9)XLJL8mWBsu=Oymzx~Vx9G-0EaSjTC;RllraBoZv?}mxm zq~Nt}a6t3}i-=-)bjqne_Z@T7A9E9go}BCux}qev)DG%T?-Tfsr_k#kqP!ObVMDf3 zB@JuB(*O4SJdlrN5HiJGG!1V)hkO`<%rjy-FV@KSZBg3JD8P}sg&oS7W}wnHORiJJ z+n)m6@SUw{jh4$(mud{c_68&af}uLD%m`g-{|u4l;(VUcI6XxL-U9bRYn}&=C%Hgy z9~;K*jTFeHc3-BV>CDnJY3`U*35jtQH!Y?|EqB~SijCXr($w%irK(z1u--Fngn>7v zOB?vT6!P($t1lcCyX4PKg(3+APTh68< zGWB}|x=-a}6Uv=;JFKxlURij{1$Pf2ekB>qtAEtDuj*v$jp%kYt?)p+_ws&RZLvA6 z;%Cax3qgkuT?cq`Mn7!ex!*-G$d6pzWHpZ8uKQM7nX%GN>9Tv@uKn}2L)V6&?TX?F z9w+Nd!=p^C@%&$Nxr}|{AC)D;p;|n9kJb9rn<@w~6h_K@DHz>2&WhaOL(4&j=!TTj zy`KCvs^h*oIByE1Ei1O4rUMuN2QCt^6kfk;ID6b(t*pv`^CO)vgePmO2MCB;(Cl<0 z2A2*7`5^YnyP8&zSPJeMg9lAKUri@bbnVW~XF~d~KCP3|bOdReohkH&hTVuvPhE+U zv#pQfAtTzEe;EaFN*w-|@lOg9&3q!zk?Xg9C^jNmD%GRYl^r>I>H&+wrU zY7jRhP4!yojL|bhxJM@pL3Y%7=v=tDMp>61UX$g!xni$LzpLc)b8P%8GPF#)V ze-|vJ7LaXopemgasZtWhto`4t!+*CG|4&bS7d`ywP(91~@!)@pH^bF$>JvqZ>u+zngj&!h#hq^CE7v*Y(^ znGzQbSP;#oS*2W>jZEk##QP$Jysv2A5Hn01ov}gRwX*`DT7TYj`wzNqI`gM9K-Y~x zlQomWGo->6Ami4S*wTX_6OCOXz5v~>q&47AsJuh9Hg|bVP47Nw!HFWbZC6#rkD`AL zd>Y~A%E_=(TG#WMmiyEq%1U}v6OsGdmufI{oKgn1HEXqfR2^PTJZ$(S2vu{8d_S|l z{PpJ>;3&asPZAaHKK8SLspRRkStC5ezuTytsI)(Wv!K;IF{AwTY0Ip{gG_XkWa!laKGIdI zy4Lu?r9~tAC$nl|vL1If_JmBTLeuXDltMH}ET-yomw#eEg(O>RVX|}dI|17z|9#A7 z@XQGe9HfPpWtE2@kP$|5)~i-Cg#|3YVb($wie3me<(TMHR3B~nWw+$-4=>}I+6r{D z*s*4zJzPFh@=y4ub)`6kHYv4K`C;ikE1Pwue&oJehSlpDk} zM1R)eEpd8jnFQ7h%~=U=exgpL>{vM1Do34JAq(*=6S@3{VkvpI2ijhJDcIPcrURU2 z&%0iZR7i2CviAyxOA!013y}M4)>93BTzdNSb3?SDBHsfR41?QkcDFbQ5f=G zT*lRW>SAJ|19=VA`12#BL(fILwrsxQuvjzq3BbR%oOI_~f%h@BocYguK_+ZjNh>$vLE!UaRpWBO= zfj&ak0x@xsN?LfSQFsr>@=s988k%OQN(>!qlfuB{Fa9uM=yM?h;Z3cYvcxNcXRyi# zW4=K1Mc<%!3B}F-qJWWo*xxchYDMh-n{MX+d&CVR(L^UH?;W}K`?Is@P^a{QJPq`c zt$r(&MphaTvl{4ha&}12F7qkp-OOG@3o?WVFa9FYvU@AQ&tQW>XY&<(4uMZSPmq+N zLTp!?@M0>-%v)|QQXDgtgR$XpnBq{dDNb9#y}hkrCo$thTj33fQlS#Tre^Ki(zEhD z1-PzfcIXfna`M!7>7!H=+gwh`18|5`&Shx^tb2=7rvn}L5+eKO#Q_BGIY($LN1Zgg zmt^;x=GFoX(}_$>mS@(k15WB$Fv`ulJkMAC1BRh;x7F2UWc0((-VXDK`1g_~f z0$J$B*8lRC-zS3StJV4(Xy-79@v^e>b2f?(ioJ6Y-*)s?*kcwIjAV`7C2|v`kcn4A`AH*IGjPr45@S3JNIDXyp17FFx--YybzbVuW3#1|Er`uH*PTIIupc1lVdGfr$cjJ%eEq6G`}1=pU#3? zFVlp0$P=1LrlM9F#hI^%G$6AQrUL6@YnQf<>RE4xx@L-)(x!YQh~xQoX-c9K2)>iv z7b9bW=P&;5)?h=PR0Ic?cmZB)Hr7|BM`EnX!=<+%D0XC8J=9hUZaaul98$Ux+6>Ei+IAii z+R(dbFuB-I!q;@k=)K04c(ga&A0_03D}z9RID7KJt-k()GuTv}lB!?`g`td~g%-aPsQmzHC!BO>!k1*i>Iyu?M774cI>{*37kQ#GWUQ zD&tBHNWEN#eb+y%mPZ{A=W0VjZ>yf!!0Ku2553cUB?`$`_OoXjKtvJgve2R}fn>P* z_w#s#n#p32ltjlM8UGawwjKok@yAyQnF&S1bSBYYs(7kdn#6~S1n|Q0%nL8 zAmKa@Z0>9lI<+c~1n-vzyHV8Z%k*P@j;TvU&RwT<-BfW5IS zT$L47H;7%Iex&ExlhJ3=9T3~{4h4TM`nK`KcWDF;_`d1hyj!^g$yk5sCy5g_LOv-7 zR;4S{V1c7^*EseYB}wr$TE#-gbkveEvK+|!;TV{HyedZrqixkwgx8brCdepRSnFee|!@`2~zlf5NH#_6}bRj94f1lH-i zIptHdRnSTXNrbt#j;=7+|JKU&-y6IBe|^$^>-_0IzVwKww|;a1z^%JmBW49rxd7&)40$noI>vxJge$$- zxc(OEE*fIbH;>-E9ZE@Qk638JNXRR;=+mt0#vNxcYLbZtkBu=l3Dwd@gVti=YQfSG zG1EE*;j##6cYHKu-)!@3ms;5uI#^L^`k0}i$*~?UG*Z#zf(lMg8EW&pzJ0eZtyyTj zs@Ubz_7PV+SlVs9+d*G-H(vV(r!rk}CTpx0y@SOu>DI%q2Z!YlM|@BH>D}dgdvd2~06*d=!JKNG8E`+uu+*RWa}7QRT*Pp7P=sXe1z$q%8cj7!K`z zVZK(s>hAuz%B6Y0n)QL*_EUx~rtG{ug`em9}6{Ct%|FURo($2HJF{%|A0#Y*R~B7P(a9=S#J19S5YnFKTYv4oBlDJSqL>U?L^u z37aw{lf(PHHL)d6cQUh{_-&qJ=sZQaSFIl{$hwHsX1;f>$I(DP?ZIDYguS;n|a(%c(5x`Q6#Vk!Vq-zS{#d+%!i%;QaLwQ*9Z-4~@r@MCDu8+>k{5z2I~(P7Cyv zsn5h*q-2dp4U(WP%oBko6%&=%{#7!p!!sDhb%JS-1bj9IRkQ7WX#8vamX)Ux@OXR6 z9!i`-x6&8)pR8)7^3wEen#%yg%wK27(i6&WNoy)-eGDEGBlO3XdZ_=K!(<>dE-sLp z=X-j^nOTYZpE&?3BF#i~CGYN=St`rK_t)cf5!vJ@4Sl#G#=tukgo z9a8d$@-SOS)+b;LGX!MT0KKx?LdNO;!~1>D9C!}BxvrQW7zMq~C38grn(iUH!@GqE zBI4@mSgS2g30YYrO%7|?21|Tzey>Cb64k+|=&xmt(jpwU@N%iQ@So|2aM`ca)SXFQ zkfghNQ}cR@lS!3cBLcM8nHG;lzevkqXLlFi5tsITBBhuf&rC8G59X(o>F5sl?Le&? z>kx1W)%OT~`JJ~RYLqH#Rr~7RKZ0J*je@{kw-wxzv`q9U+w>z+-HX+19fHyoK4MJw zh?U((84Dxt$S z=@pK>Ai*R43f2OD@Z-^mKlmg_5qMdC+X1B$oIe<-a)^(FVu(b7UT#_{aPQ`FUy3%~ zyDu4enQiq1n{}QHqx;EoL~AdQ=5FZ$NJpjNzvjSBjSlg_`_yN@o8V&PlGx5TonQ3E zRs7B*X9CVb+Ee6a9eC(IkAk-asqdMFw5KDGdBM*%L4LkJWBRG~S!g6Zs;@<9O$i21 zk;8~2Cg~@}#6mm^>?$01(8%~RSG{VN6T@lcCyFg>2DDs@=iG5-yqi5ZKAroi&Bh8O z+2;PmU(*b~yDjeZHhxZueeu`6Rdv|7h}DI3S@zcVgp+tUUXylMim|fGROiw)SKoH2 zc*ZN^nAJ2ZKek~c^y6GMK!C75B2uHyV-_O}Yc*%knz#la8AYlVDmt6)|7M zd(_j?Qg^#|v<`f*1+`u5lrPUo=Fz)Gq3AN(7p!zqZ|#uX1$Ldu#$WbWJe;lD={7sX z#x-YWEYVQ7DYqlRC8OF5`9W!>cO#0IM$Bg`R3l|RLH{X(+?#;bjm@otWPVz?@TgDz z%A;4Lg_QHN}^y?%c1+)rK~FwQdu2P z@C`p~THGt?z|F-ZHm2GDG+K>Kgq9x?6qS}%YMYMzVsLIV)Q8`%A13QRnkjVoTbxz_ z*xvTUr*19mGmkN_$9_MQHB0qUYMtp==_HU&C+5 zURyiW_B~m^m0IWP%OfTRLwWxp_2N3M=^xhl5=M#bweINXQv@ua)}c=ayycQyeTL`< z02oJuwl780ByNVC%cFiIKyg(?bzip5QC*u&3r z?Dp4^7b)6x+ci_%yil}shZK$l=PPC7W)DNT3&$phw7Bqlt#~z#ML*Y43dGSmMD5=h zzVUIrjucb{k{Ac_@Li>v%AABtnRvaT1+hCf{rDNp zFg_(I^veQ|MhkUwl1c9A)Tq14KQd4Xj(w~=>>JBNO zppp1LI4CX6m;33U9Vig~d0}kmEId?1VQ3&W8-wvUe6wv(N6zbcgfaRFHZ%sGO$1gv z`reU3uRU$oF!nI&Erq!txmQbvorLi!D&_8Jv7}-dW~lbY`b6XWXW3!ZSFh)fYTorH z5l0gPHMt|^Qva(A>i;sW`oH?Ja_Z-s&rk-rvt0fEI@kX)nL8dLHW*e8agm+$sI;nd zp$?KH!D=x459g7JmRYQLc6Xo(QJp<6q4j%AVv@52a!C!dj-3iVF8z)MyVp-!b)hzD zDZkW6$X3kQcoeH^JESZIhtS*D4jJnYclSoaj+ zy)Mc^?3Ob&bmao+=?=AxnVXE0N)Qd3T(F&i5mHDq%Ld*5GFw5$U-hu9O`Udll;`QO zNO`^gh&l5OS6>y{XwI*~DxtT7+L~%beddTr(oaf|O$jp&TW=mJq06iCGn-+xx!?N?PgUJQUWaXsdxsXxZpXfeZ2Szl74l_g*g2m#FTy zh3v0tDrE{tZ=Pe=FP#P}^2zpDCjux&{mA0KTWDA1L}{LJjocc9m;)1M1}+IX38EgM z^)jr7_Ily_nGaNpUmqNa9?qdCrPXA`svCQizhryza}KX?fUnkJoPFWW7~sZPT?uW~ zk65toGGlgam>b}sP68@bG5B*L1T$^NhAzB;JQ@68vA z6fYXIP^37t&_Z!26fMQwAy{#z6nFO`#S6tXKyY_yOH&9A!KGMnhkeuUZ)WG-ncdml znZ0xW$_xof-jj14`N;F`g@Gqu3XixHGZt$=KS$Q^+4iAx3Yp6)1^UrK^!s^Oo`rct zF1AyUuy77^puVW_ITapiz7+N`Gnfcv&Q;bY%1T193Uti;&dnksUyv{>&1X$@u}?bX zZ9$QJO^~Wg9TU7`$zTxe6=J+`dz8-HBtRWTYh+#d)**-vgM2-+xUst zjsOj!#J`&A)R5GDn6&#nZWf7f0V@Z-p#H?iFJJ$Fr*kgS&T^&&=t`wrVIO-quEt8; zcs4|;J#DjZyq!%K7GXmiI)U4f44=OL=yrkdI?sMoBu6~@7~h)@-%0e(#cKnK&?+3Z zk`E$BjY}W;&f#f0QK8@)iW4YQwp9tuS>GiHi}hju!R!k8c~HMo>Z5^^Vymu27EB)B zfhWff2A^(7CzuU=Fu6E1_OsEqS=1Pg4k%$3CJJVr^>LIDu%q5nHwOtUA)>52R*1|jRA8a@L->(e@-6rcU6f-ksvB07c9 zO55Qb--U7s0M84~o)%Yc?Sh$VNbov?$q@g2T<#JgyIV|4eDlIv=5-(Dr#)48JnBj- zO=>{8(jLrr&B=b@3l8N2L#KAFD&IzRVlWYyI))9rH_J`6*DBYQ9=TH2V2_{aVeo3w z{zQ|{&ePna{=$p$Ad>!(^ZW^zEVA?Z_UfjQ14(TIbd4cdBJ0xhnW*4FKl_rcCf(p@rr zV0JL0^~$cluP@?WECeSpc3!yuqjL`S;`sYm{>9&_FUG8fSYsOO!(0og$sDb z386nYE=j<WV>#ActYif-|-GyY7lF2UVt-iLMBpwY^60{wT-NY&{_X6f@0J*7I=1<62TVR1q9i zS&aACm&YRIvhEWAI;*!DOI`>9S@ClSNTVgDTf-TZi@Z~?c%F|WT1#k|bUbOEQ_=TF ztnd1j|Bt41`VxXZcAnm*ekG9h^H?O#$%y#l2%-Q%zAIfW4Yld@oh*|&f#GnFl2Is%K;Y{aV)FWcKQY%fkRW?wz*1`=#? zzaZ3i!l#Mxv3T`zlbQYtC;2v8@Y2u+-1Y2!=}RWN)m)h$3wt$Z@r;QA=7ef2?Xj!k z+ZB^Jir!z9G6PXJxWl))(>nyHOJR=m>RGZYhJvirNwH6rXTO}D;iU)q2s*jBgVd7u z2lBV(6u}yj0=e9c-SiJ*nPYocXM#a_-3L{#89s;#Q9Pb}M?TnzD+q@)DOCnW7!=eU z^R(#mxYV!u1-&_@Nb&Ia=5s~Fw0j$V_Cj8fDmrVSvYuU0J@m*`q3zfY&$<;<*C!YQ z3QPkaN<$M4|A|n&3Yr0Dc%aUvtF8b;u zW;rw$nM~6ZOApjNoDpOxt}#9$w|#gj?Rbpbh^Yik||hciZg55PwA;aTnvoiE<-`H84LWxmv_rY)6 zgin5PF}3lbA#O{?2$C^P_234K|Fvl%+B=v)DVqNRU>_{jt->L<;j4NQr3t9(O|)t; z>!-$#yDti_|2XRw&K7*Gmw1kvt_{GEe3iQxX=G&t&e%@MmaM@4M};H=jj$kSdb>wR z1XOej+l`!6@n!np42M?)AD$P!plz$f^~*jYv8xn)R3+7wfwOc=7x*q5j!Fd-lF6b& z2D(v#y&B0A!jD~f&7it7n#66tR*WML%l%5CBKR#npYtBPK;ovZzGg3;d*%y>ciy65 zXaqlKgtz2Rv=Dh=#TfhLjLiEB9l>%mE?rqbM?&p{(%6e~3-twL1Im0xx!aX;Bq z27X(=HG#t=loigO{X+_V37dAOangQJI2e#5#rGR4R^@^}%XzrwTx-<5Y1xIPx0Ibr zkWES5Isvs?BT`oo`(u4#pGSGv$GKHp7tJR??Hl5iYfg&qD1biAyTLFn`Xz_^iM)7@ zw^^W{h*w;?2~{w|4`+a%lO`OW978<F^Y32KB4MIfU;%^C zgt`)cg7{SV1XR3e==Mb80DLL$_E5p@cFff0cm{CJxS;oE609D_pKQN?-9fEwlcsg1 zC+rL%a-&M;RgEly6IoBBltv_tpB4e_f14)dLzh~3VSD4_Vds9Q(H(!&Dl9YrmROLj zI_?@*(Ui{V&5}R$L@izYt_i0b&f&*qb?Ii@5N&Q=p?Q&DiO%C3=gPudf6+kGhYmVJtCY=t|TQY%R4iG z6YFLPG^-QE_Hzx>nrz%1X)@pmzRiL`X_#D76=v?~1#0HAThyJ|`+(CyKMnm?JvCpP zK7qQ)D)Q;26#Sk!PRSjLs7p)#EPwRwQ>}`7@db0|A7qaG9k(l;RVDOU3jS-?sYx2Z+kSmgYj{RZq+7rhX-bg=B9FIuG zz#!@5VNR;}$oXbBi1gs_$PBk;o}!Ln40bcKw#mEqOx#4m2qszX29&Ei(nalSxXVdfbmrEn58{hAhKU(MaN_Re!N|r zd)t5somtr#myCMdmqc|~skG<)F1K^U0@;-#lgrD6;#|M0y4eyCT}l5(X}HWxb@N7X z`9C^mB{m|peYLvRa2a?^QuW_&=%xUFAO*LRs<;1}akeyU`)ZO|?WzBE`9e^e!-fo7 z3H!tw$AA7%m~W%sR%RJo{vM*y@mGEVV{_kwVp9`_A|@v%Y1Q9Z!X@_BY^!g#gby*)vO_9QB9vDboOw{!1a6a74P2>d~!(I;46}i(-iPKS!*>u z8wYLCl2;-*uphKYvEVNXvdaR&3&TBm7666F-v9uqbXy)c9LkEgW%Nk>w7PUItAX@k zs~(4Hsj5~d-B3#cV|_3>7Wca2_GsZYTsiZJaukUV4`%E~rI1NwMV7%o(}odvw^6Lh z{CuOrsNnFQwf0f+v_RKv^Tz(@>M zZe4)JDuY1Qu5IZD(`%R1%9RT95P+r;ru$@#hdrzeEHRaPgWl=;8}p4ObRa%Fu8i*s zghfzAZLN$%4ylv)dMPRE+J6?K=^9(CX~~Qx__UB=t>isz!te+l5*`e-h*5CYBojmE z1wD)E?5PcXdeO4W!E+zl!K(pawyJvQX@V$rqf$mlox)Xq1v^CwzOj3EXeqD2+V7M{ zGgTNdoVw>uNU(z!7iH5Nf`|}b9y9Z@`O;A=vjZwCR$!Pd=B$ZKNWyQm`2`39T=TJ> zU0%@+cz+)IesD2+NxAb4wRqp_+R?WDQcP+%h!nOjti9LXK9{>Y4P<~xvec*%2zb!h zXh&~CM%#33iVPT(6ugznrJ~PBxA4G6|C*GB|}+z0Ze;~}%< zML1FS&0^r+aPwh~nnL9{Y88{FGmzx=hh?l2=)n)3AoTUqV)B++I>moix+l!w+QUf8I0WwcS~s zwC%F{%$YGZFfT-$>s#jind7`^Uc0iy0C{IL33#{q1JW6?-bAKnqugs;D7@n_(}cLK zSTy^OWlH3qSK6k7c;_9)y-|kcPmPCG!NG0*ljorBOT7yjo0a3tFHiOUSGSS&E%d>_#16E$+ zHH%P_rfU5@NFK%0{USVwX8pN}q2jDJQ!lM~fc?)^N7vrRQ={S)>3svtC4yf7pk;CY zGwIqVkks1OCnpZHh=#IeBkUF5i3$e96!{|ZY|?zeAk%#(XcQdXnjLR6WgN12ds?d9 z8SS)`vGQ-K;iGxRVbfdbFix| zbgiCuAPbR%1P*q%W>-hHY|WmyxXGOCRlV={Bi8a8@rlU^Uv_(3SbcH+Hk$ouKteQ| zpCPZyO%%!JS(KUQ6#S$R>EIy$2`27T<}v$nAgP zm-pc@MQ{#G3UaR!JNv8nMuN;?JGCk`LxMU}H6|&5n-ZWIco#@C8Y8m4c{aaH!4iWg z34nL#IBjdJ(s~48j6G3@InGX`PkSjpu&5~TKG(E=p=;OqOUDs_tDPzx@0Z3xh~|Ef zpbl*!Pl;6-6I-Y4FWMQ>a z*G*r+xEiCa{%6_+TpvwWPT#^olZ=imsh+VM1n)rWR8uE`OWMwZ{b6Qn5n!7UJNq_K| zuyPhz8_N8h35%t#BB+I?2#j-i7hbN3>+~6m<9@sV->&lV1z`8DBS9)cDtA~m=TJ*{1G+0IjCF2VP zdLZJJ)r98^k7(h5k>8CQczG#r&+u|VNm6nad9n}w)Dw!^o@|UXy$0G>N3wmUHed8A zdP7TN#r(;SKq#L%-m2bw6tXKr)*lAM4SBpxw_XhCLpD)H^01BmlRDf2*nXQ+TWp)t z+>)Gg57|qsEPK0}Q>{ASsBGo|bIK|JOcrXdzXd0)%y&UI)Yn*rg#5U|ESxD>xM~tZ z(1bene&!{0O`>tCDl2AIO)vCJwoWd!A^N&7SDF9rFM>;`kFF(ZpxeP7nWg;Q{e23_ zJ$U3+EkPYefF=4&#%&5+bh1I@>wt2A`VEVEeep&MbT2p;P>{f8*Z{CSzXhbcSJ@L- zm1bscplvV?B?&wG9i*gv);CJV<+O5)-32)(bYBkbnpA{pkN+jAYSEAhFJZ?&G1b(Z zH$h!3%8W;l(D>(4`oKYJurF8FYue_83XzhXPiLa~LoAjY1?^%EpNBQg=0M5~w z8rskJ7!MbIJo*;YLx0CO=IkY7H?#?Kux`vaf+a%F{9;;a#?VR=q-PN+zzp zZ=)bvw||!j-p*M(mvfX%Q@iPFmQy$6J!5*f`D-*kFp~Ht-fnVnZ)p2 zZ;6;*WCnQfPcB`Yq*%tfG2$^S^{tJW^VfI!5DT*W{PKX~vcNdslWgi?fH{83Ce=>< z-g}lQZ>W%aYo%u&P=;4Dm=ISOmd(*pXQG@F7+<`vpEionuA{g8qhl&!g)H~q0A2Gr zguP>h<%OgYyt1J~^?6tJB%Ewi&@;xJzf zSmEWyC;hq{I@ThIvY^kWjdk>FjV79_Thss(S*;+iC6pN`;%t;dwfK0-*amit#jXjw zA6=Dk=4u-R-qY;Fk7N)?43a`U8Ob&n9wsln9Iz}I7UX%2UltoGs{2j(EOzS8+D7E% zK;yM1*9;-G)o(SnZ<3aQ8RGUz9zT$gz8GjZryicNN3}g}R#?d3OcP&dML6nqOlqN2 z65K@;iD^j3y@*t9n4(O#d8;7PMx|jpszVk5n-BhgOkq?@dBO*ceciZ|#x-^Rqr*!jwdek1A6|*XV?v(+%nH8|Ci5 z#C-+5q1n8@0q0pfgaJA?w~bW<(p7lRx_s~JDgli4WDn#PF^DP`ZbTEh(|`hWTK45% zU5r1n;NLRnL;6J!Il$I?L(2AF=o9{bdWn^W3LA$H&I^~Rd`YhGD!i)Q?IB}dIWFMG zPfQ7+(3l^hBMJ|>5D?g~*RmHQ<6ySlA(mO|E|`^sc#rGrboih}K?_})XghHu<6G+s zH`sayUZt5{%G^c(t6|P%T3+%YmAkja2Aap#TT8}WzcXRP74Fbgf68ifiiK(Y_TlnO z3+1|OeW)c>#P&f-{uV6o9|ahb$ZLxs6Q+G*%;M%Ihy`V;>EaOqS%REB~@}(1I1Hzl;+x)-!TD``Uxf1+94UqM7t zvz72z5Mu|j4_EAS$c}eTChsL@d1LaS8n3_=(S7tj*x6}8ajgQ2Mv6EZGA0u5+}>~Z z3$H@Io%Tf-ip8^H`qN?jEitc9YYvGY&*H&elZNR~CB$3x7S!;t&Zw0nGP&gIhwQ%8 znf7%mHN12M-lX8+T?6ZEy`y=$j7axASw`ioYmRemv*61nhdBR4F)9 zN6*s1F;(u0R`v0zFVdbAy~Ue_dK4^u$L~szPj~kWvW}KE(_)tKWFOSGo%}5mCHcwNU=^akCrCtpXwFyKx_MmV<8wR+*iDfVbi2-0ar~*^ zrmjEzb0;bfqb&W5Hs<@U1hoPTE@PM#bKY1f5z-^i9zH1F1YdFVvm$l|T6SqT1wRE$ z7*D!#zk~Zf!FhYb|a`$jM@RJ_J8bO>gYZ$kpE^J3zH;$EMxTvEJR(=vCUigE6pK;DrdDgrsvUOoAfDNIy8-Fp$Q!rLz< z0y)l$JL)f_{s9;>&quyd^gVp1&gIhqSD5Xh8|N(gbU0!F@QA-5rLQP?Icv%J(S+)V zzeQD*%Q1c*_qsP8ys?0d>WPhXaEAZ`;>?h`LmX6~E(5d(z=i$?UT!3a@_#?a@pZGr zZnj?jI}vRAXQ#hEpDf_u$pt2}`7BWb?Kc(>v!e~gk#Xt2FH$V#ETOskf|*N3)7xmQ zRSH5DhGE&Yd9|0{8860;aN06GRgjs1h;R23Mhb~$7X-{_J)Wpc1@xu)1K74IGmvEg zgBda>f0a@_H;j3v)BOw z`gd{Bz0iHq(BB}KfJW85>P7(>bh;Tz<@}0|MG9jbdyy_!stavA=Lu->;}&qVO3 zab&kWAnwnx-Q!H10N*3evpMPzJIZY{F%W;E)x0nj4|5o>c_oQmRGLjELbs;5sI(U+ zWb}=ox3W$C0&)E04P6I_7Me%mu54Gg`PmKJ8Vxac0yv9WhJwvQk$f1$bwSug`x)3y zJ!s0wtyc4Ynn(z#Rm>B2XOIR+SRA6{H9+^jncxJRYYWbmu>C-#i!$(n)b|fNBsXKS zx!srYpKY*H9&eL~4vo6giz7(tiHXG_67HiRv!d#Fp6!B6p!e0ItG@#+Y(#^7ki3x_ z@K){NWx%}S_|m8T9It$1cZ0^@Y9FSPk^(VE5`xXAcd+TMuGmZ|me^Y}h?lZYEx^#~=;-KxWBar~y90&zPURvo*m840~zX4a58a)62 diff --git a/windows/deployment/do/mcc-enterprise-prerequisites.md b/windows/deployment/do/mcc-enterprise-prerequisites.md index 435d884a51..dd24c349f2 100644 --- a/windows/deployment/do/mcc-enterprise-prerequisites.md +++ b/windows/deployment/do/mcc-enterprise-prerequisites.md @@ -19,7 +19,7 @@ ms.collection: tier3 - Windows 11 > [!NOTE] -> We are still accepting Enterprise/Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup) +> We're still accepting Enterprise and Education customers to join the private preview. To register your interest, fill out the survey located at [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup). ## Enterprise requirements for MCC 1. **Azure subscription**: MCC management portal is hosted within Azure and is used to create the Connected Cache [Azure resource](/azure/cloud-adoption-framework/govern/resource-consistency/resource-access-management) and IoT Hub resource. Both are free services. diff --git a/windows/deployment/do/mcc-isp-signup.md b/windows/deployment/do/mcc-isp-signup.md index b073f994f7..960485c7cb 100644 --- a/windows/deployment/do/mcc-isp-signup.md +++ b/windows/deployment/do/mcc-isp-signup.md @@ -21,7 +21,7 @@ ms.collection: tier3 This article details the process of signing up for Microsoft Connected Cache for Internet Service Providers (public preview). > [!NOTE] - > Microsoft Connected Cache is now in Public Preview! Instead of submitting a survey, you can directly onboard onto our product by following the instructions below. + > Microsoft Connected Cache is now in public review. Instead of submitting a survey, you can directly onboard by following the instructions in this article. ## Prerequisites diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md index 16ce235fe6..2be225b039 100644 --- a/windows/deployment/do/mcc-isp-support.md +++ b/windows/deployment/do/mcc-isp-support.md @@ -21,7 +21,9 @@ ms.collection: tier3 This article provides information on how to troubleshoot common issues with Microsoft Connected Cache for ISPs. ## Common issues + This section details a few common issues that customers face during the sign up process. + ### Sign up errors #### Cannot verify account @@ -43,17 +45,18 @@ Did you previously had access to your cache nodes but it's now no longer accessi ## Diagnose and Solve Problems -If this page is not resolving the issue you're facing with your cache node, you can use the **Diagnose and solve problems** functionality within your MCC resource to continue troubleshooting. **Diagnose and solve problems** contains solutions to most common problems that users may face as they onboard. -  -You can find **Diagnose and solve problems** on the left pane within your MCC resource as seen below: +If this article isn't resolving the issue you're facing with your cache node, you can use the **Diagnose and solve problems** functionality within your MCC resource to continue troubleshooting. **Diagnose and solve problems** contains solutions to most common problems that users may face as they onboard. + +You can find **Diagnose and solve problems** on the left pane within your MCC resource. :::image type="content" source="images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal." lightbox="images/mcc-isp-diagnose-solve.png"::: -Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you are facing and follow the prompts that narrow down the solution to the issue. +Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you're facing and follow the prompts that narrow down the solution to the issue. :::image type="content" source="images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select Troubleshoot to continue troubleshooting common issues related to the installation of Microsoft Connected Cache." lightbox="images/mcc-isp-diagnose-solve-troubleshoot.png"::: ## Steps to obtain an Azure subscription ID + To onboard onto Microsoft Connected Cache, you will need an Azure subscription ID. Follow the steps below to obtain your subscription ID: [!INCLUDE [Get Azure subscription](includes/get-azure-subscription.md)] diff --git a/windows/deployment/do/waas-microsoft-connected-cache.md b/windows/deployment/do/waas-microsoft-connected-cache.md index 4624dfd2bc..1f7147865b 100644 --- a/windows/deployment/do/waas-microsoft-connected-cache.md +++ b/windows/deployment/do/waas-microsoft-connected-cache.md @@ -27,14 +27,14 @@ Microsoft Connected Cache is a software-only caching solution that delivers Micr ## Microsoft Connected Cache for ISPs (preview) > [!NOTE] -> Microsoft Connected Cache for Internet Service Providers is now in Public Preview! Instead of submitting a survey, you can directly onboard onto our product by following the instructions on [Operator sign up and service onboarding for Microsoft Connected Cache](mcc-isp-signup.md). +> Microsoft Connected Cache for Internet Service Providers is now in public preview. Instead of submitting a survey, you can directly onboard by following the instructions in the [Operator sign up and service onboarding](mcc-isp-signup.md) article. Microsoft Connected Cache (MCC) for Internet Service Providers is currently in preview. MCC can be deployed to as many bare-metal servers or VMs as needed and is managed from a cloud portal. When deployed, MCC can help to reduce your network bandwidth usage for Microsoft software content and updates. Cache nodes are created in the cloud portal and are configured to deliver traffic to customers by manual CIDR or BGP routing. ## Microsoft Connected Cache for Enterprise and Education (early preview) > [!NOTE] -> We are still accepting Enterprise and Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup). +> We're still accepting Enterprise and Education customers to join the private preview. To register your interest, fill out the survey located at [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup). Microsoft Connected Cache (MCC) for Enterprise and Education (early preview) is a software-only caching solution that delivers Microsoft content within Enterprise and Education networks. MCC can be deployed to as many Windows servers, bare-metal servers, or VMs as needed, and is managed from a cloud portal. Cache nodes are created in the cloud portal and are configured by applying the client policy using management tools such as Intune. From cc7edeb1a95e81700ca6855567e82f158e90939d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 31 Mar 2023 11:28:30 -0700 Subject: [PATCH 25/26] edits --- windows/deployment/do/mcc-enterprise-prerequisites.md | 2 +- windows/deployment/do/mcc-isp-faq.yml | 2 +- windows/deployment/do/mcc-isp.md | 2 +- windows/deployment/do/waas-microsoft-connected-cache.md | 8 ++++++-- 4 files changed, 9 insertions(+), 5 deletions(-) diff --git a/windows/deployment/do/mcc-enterprise-prerequisites.md b/windows/deployment/do/mcc-enterprise-prerequisites.md index dd24c349f2..badea53748 100644 --- a/windows/deployment/do/mcc-enterprise-prerequisites.md +++ b/windows/deployment/do/mcc-enterprise-prerequisites.md @@ -19,7 +19,7 @@ ms.collection: tier3 - Windows 11 > [!NOTE] -> We're still accepting Enterprise and Education customers to join the private preview. To register your interest, fill out the survey located at [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup). +> We're still accepting Enterprise and Education customers to join the early preview. To register your interest, fill out the survey located at [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup). ## Enterprise requirements for MCC 1. **Azure subscription**: MCC management portal is hosted within Azure and is used to create the Connected Cache [Azure resource](/azure/cloud-adoption-framework/govern/resource-consistency/resource-access-management) and IoT Hub resource. Both are free services. diff --git a/windows/deployment/do/mcc-isp-faq.yml b/windows/deployment/do/mcc-isp-faq.yml index b07e11c2e1..ddcf91bb1e 100644 --- a/windows/deployment/do/mcc-isp-faq.yml +++ b/windows/deployment/do/mcc-isp-faq.yml @@ -86,6 +86,6 @@ sections: - question: I signed up for Microsoft Connected Cache, but I'm not receiving the verification email. What should I do? answer: First, check that the email under the NOC role is correct in your PeeringDB page. If the email associated with NOC role is correct, search for an email from the sender "microsoft-noreply@microsoft.com" with the email subject - "Here's your Microsoft Connected Cache verification code" in your Spam folders. Still can't find it? Ensure that your email admin rules allow emails from the sender "microsoft-noreply@microsoft.com". - question: I have an active MCC, but I'm noticing I hit the message limit for my IoT Hub each day. Does this affect my MCC performance and should I be concerned? - answer: Even when the quota of 8k messages is hit, the MCC functionality won't be affected. Your client devices will continue to download content as normal. You'll also not be charged above the 8k message limit, so you don't need to worry at all about getting a paid plan. MCC will always be a free service. So if functionality isn't impacted, what is? Instead, messages about the configuration or edge deployment would be impacted. This means that if there was a request to update your MCC and the daily quota was reached, your MCC might not update. In that case, you would just need to wait for the next day to update. This is only a limitation of the private preview and isn't an issue during public preview. + answer: Even when the quota of 8k messages is hit, the MCC functionality won't be affected. Your client devices will continue to download content as normal. You'll also not be charged above the 8k message limit, so you don't need to worry at all about getting a paid plan. MCC will always be a free service. So if functionality isn't impacted, what is? Instead, messages about the configuration or edge deployment would be impacted. This means that if there was a request to update your MCC and the daily quota was reached, your MCC might not update. In that case, you would just need to wait for the next day to update. This is only a limitation of the early preview and isn't an issue during public preview. - question: What do I do if I need more support and have more questions even after reading this FAQ page? answer: For further support for Microsoft Connected Cache, visit [Troubleshooting Issues for Microsoft Connected Cache for ISP (public preview)](mcc-isp-support.md). diff --git a/windows/deployment/do/mcc-isp.md b/windows/deployment/do/mcc-isp.md index 103077d2f5..9a067c4a51 100644 --- a/windows/deployment/do/mcc-isp.md +++ b/windows/deployment/do/mcc-isp.md @@ -565,7 +565,7 @@ To migrate, use the following steps: 1. Navigate to the cache node that you would like to migrate and select **Download Migration Package** using the button at the top of the page. 1. Follow the instructions under the **Connected Cache Migrate Scripts** section within Azure portal. - :::image type="content" source="images/mcc-isp-migrate.png" alt-text="A screenshot of Azure portal showing the migration instructions for migrating a cache node from the private preview to the public preview." lightbox="images/mcc-isp-migrate.png"::: + :::image type="content" source="images/mcc-isp-migrate.png" alt-text="A screenshot of Azure portal showing the migration instructions for migrating a cache node from the early preview to the public preview." lightbox="images/mcc-isp-migrate.png"::: 1. Go to https://portal.azure.com and navigate to your resource to check your migrated cache nodes. diff --git a/windows/deployment/do/waas-microsoft-connected-cache.md b/windows/deployment/do/waas-microsoft-connected-cache.md index 1f7147865b..dec5e3708d 100644 --- a/windows/deployment/do/waas-microsoft-connected-cache.md +++ b/windows/deployment/do/waas-microsoft-connected-cache.md @@ -22,7 +22,11 @@ ms.collection: tier3 > [!IMPORTANT] > Microsoft Connected Cache is currently a preview feature. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). -Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. Microsoft Connected Cache has two main offerings: 1) Microsoft Connected Cache for Internet Service Providers and 2) Microsoft Connected Cache for Enterprise and Education (early preview). Both products are created and managed in the cloud portal. +Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. Microsoft Connected Cache has two main offerings: +- Microsoft Connected Cache for Internet Service Providers +- Microsoft Connected Cache for Enterprise and Education (early preview). + +Both products are created and managed in the cloud portal. ## Microsoft Connected Cache for ISPs (preview) @@ -34,7 +38,7 @@ Microsoft Connected Cache (MCC) for Internet Service Providers is currently in p ## Microsoft Connected Cache for Enterprise and Education (early preview) > [!NOTE] -> We're still accepting Enterprise and Education customers to join the private preview. To register your interest, fill out the survey located at [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup). +> We're still accepting Enterprise and Education customers to join the early preview. To register your interest, fill out the survey located at [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup). Microsoft Connected Cache (MCC) for Enterprise and Education (early preview) is a software-only caching solution that delivers Microsoft content within Enterprise and Education networks. MCC can be deployed to as many Windows servers, bare-metal servers, or VMs as needed, and is managed from a cloud portal. Cache nodes are created in the cloud portal and are configured by applying the client policy using management tools such as Intune. From 3fa61473edf57a7085d676e7c5ce1506d7c56ad9 Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Fri, 31 Mar 2023 14:54:30 -0700 Subject: [PATCH 26/26] create standard include --- includes/ai-disclaimer-generic.md | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 includes/ai-disclaimer-generic.md diff --git a/includes/ai-disclaimer-generic.md b/includes/ai-disclaimer-generic.md new file mode 100644 index 0000000000..0e190e0e38 --- /dev/null +++ b/includes/ai-disclaimer-generic.md @@ -0,0 +1,10 @@ +--- +author: aczechowski +ms.author: aaroncz +ms.date: 03/31/2023 +ms.topic: include +ms.prod: windows-client +--- + +> [!NOTE] +> This article was partially created with the help of artificial intelligence. Before publishing, an author reviewed and revised the content as needed. For more information, see [Our principles for using AI-generated content in Microsoft Learn](/azure/principles-for-ai-generated-content).