From 4b77589e2e212efcb1282930a11f261d98c30b33 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 16 Apr 2025 15:51:58 -0700 Subject: [PATCH 01/17] dep-device-meta-9364071 --- windows/whats-new/deprecated-features.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index b7488294a0..b2b17236c7 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -47,6 +47,7 @@ The features in this article are no longer being actively developed, and might b | Feature | Details and mitigation | Deprecation announced | |---|---|---| +| Device metadata | Device metadata is deprecated and will be removed in a future release of Windows. For more information about the replacement for this functionality, see [**Placeholder link**](https://learn.microsoft.com/windows-hardware/drivers/). | April 2025 | | VBS enclaves for Windows 11, version 23H2 and earlier | [VBS enclaves](/windows/win32/trusted-execution/vbs-enclaves) are being deprecated on Windows 11, version 23H2 and earlier versions of Windows. Support for VBS enclaves will continue for Windows 11, version 24H2 and later.

VBS enclaves are being [deprecated on Windows Server 2022](/windows-server/get-started/removed-deprecated-features-windows-server) and earlier versions of Windows Server. Support for VBS enclaves will continue for Windows Server 2025 and later. | April 2025 | | Windows UWP Map control and Windows Maps platform APIs | The [Windows UWP Map control](/uwp/api/windows.ui.xaml.controls.maps) and [Windows Maps platform APIs](/uwp/api/windows.services.maps) within Windows have been deprecated as of April 8, 2025. The Maps UWP Control and Maps platform support within Windows will continue to function but will not be updated. For more information, see [Resources for deprecated features](deprecated-features-resources.md#windows-uwp-map-control-and-windows-maps-platform-apis). | April 8, 2025 | | Line printer daemon (LPR/LPD) | Deprecation reminder: [The line printer daemon protocol (LPR/LPD) was deprecated](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831568(v=ws.11)#printing) starting in Windows Server 2012. As removal of the line printer daemon protocol nears, we'd like to remind customers to ensure their environments are prepared for removal. When these features are eventually removed, clients that print to a server using this protocol, such as UNIX clients, will not be able to connect or print. Instead, UNIX clients should use IPP. Windows clients can connect to UNIX shared printers using the [Windows Standard Port Monitor](/troubleshoot/windows-server/printing/standard-port-monitor-for-tcpip). | [Original announcement: Windows Server 2012](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831568(v=ws.11)#printing)

Courtesy reminder: February 2025 | From 9a3d1591cba0598d4444be28af3664a0a04cc38e Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Apr 2025 15:45:01 -0700 Subject: [PATCH 02/17] dep-device-meta-9364071 --- windows/whats-new/deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index b2b17236c7..6b0d6e9d27 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -47,7 +47,7 @@ The features in this article are no longer being actively developed, and might b | Feature | Details and mitigation | Deprecation announced | |---|---|---| -| Device metadata | Device metadata is deprecated and will be removed in a future release of Windows. For more information about the replacement for this functionality, see [**Placeholder link**](https://learn.microsoft.com/windows-hardware/drivers/). | April 2025 | +| Device metadata | Device metadata is deprecated and will be removed in a future release of Windows. For more information about the replacement for this functionality, see [Driver Package Container Metadata](/windows-hardware/drivers/install/driver-package-container-metadata). | April 2025 | | VBS enclaves for Windows 11, version 23H2 and earlier | [VBS enclaves](/windows/win32/trusted-execution/vbs-enclaves) are being deprecated on Windows 11, version 23H2 and earlier versions of Windows. Support for VBS enclaves will continue for Windows 11, version 24H2 and later.

VBS enclaves are being [deprecated on Windows Server 2022](/windows-server/get-started/removed-deprecated-features-windows-server) and earlier versions of Windows Server. Support for VBS enclaves will continue for Windows Server 2025 and later. | April 2025 | | Windows UWP Map control and Windows Maps platform APIs | The [Windows UWP Map control](/uwp/api/windows.ui.xaml.controls.maps) and [Windows Maps platform APIs](/uwp/api/windows.services.maps) within Windows have been deprecated as of April 8, 2025. The Maps UWP Control and Maps platform support within Windows will continue to function but will not be updated. For more information, see [Resources for deprecated features](deprecated-features-resources.md#windows-uwp-map-control-and-windows-maps-platform-apis). | April 8, 2025 | | Line printer daemon (LPR/LPD) | Deprecation reminder: [The line printer daemon protocol (LPR/LPD) was deprecated](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831568(v=ws.11)#printing) starting in Windows Server 2012. As removal of the line printer daemon protocol nears, we'd like to remind customers to ensure their environments are prepared for removal. When these features are eventually removed, clients that print to a server using this protocol, such as UNIX clients, will not be able to connect or print. Instead, UNIX clients should use IPP. Windows clients can connect to UNIX shared printers using the [Windows Standard Port Monitor](/troubleshoot/windows-server/printing/standard-port-monitor-for-tcpip). | [Original announcement: Windows Server 2012](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831568(v=ws.11)#printing)

Courtesy reminder: February 2025 | From 51ec8f308fd32b88f8bcb250675e585c26c4b9ec Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Wed, 30 Apr 2025 09:27:31 -0600 Subject: [PATCH 03/17] Draft for Manage Notepad --- images/icons/csp.svg | 10 +++++ images/icons/group-policy.svg | 14 +++++++ images/icons/intune.svg | 23 +++++++++++ images/icons/registry.svg | 9 +++++ windows/client-management/manage-notepad.md | 45 +++++++++++++++++++++ windows/client-management/toc.yml | 21 ++++++---- 6 files changed, 114 insertions(+), 8 deletions(-) create mode 100644 images/icons/csp.svg create mode 100644 images/icons/group-policy.svg create mode 100644 images/icons/intune.svg create mode 100644 images/icons/registry.svg create mode 100644 windows/client-management/manage-notepad.md diff --git a/images/icons/csp.svg b/images/icons/csp.svg new file mode 100644 index 0000000000..6baa611d0f --- /dev/null +++ b/images/icons/csp.svg @@ -0,0 +1,10 @@ + + + + + + + + + + diff --git a/images/icons/group-policy.svg b/images/icons/group-policy.svg new file mode 100644 index 0000000000..e6ec2d2c2e --- /dev/null +++ b/images/icons/group-policy.svg @@ -0,0 +1,14 @@ + + + + + + + + + + + + + + diff --git a/images/icons/intune.svg b/images/icons/intune.svg new file mode 100644 index 0000000000..22148b48fb --- /dev/null +++ b/images/icons/intune.svg @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + + + + + + + + + diff --git a/images/icons/registry.svg b/images/icons/registry.svg new file mode 100644 index 0000000000..667bce7438 --- /dev/null +++ b/images/icons/registry.svg @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/windows/client-management/manage-notepad.md b/windows/client-management/manage-notepad.md new file mode 100644 index 0000000000..559a696e9a --- /dev/null +++ b/windows/client-management/manage-notepad.md @@ -0,0 +1,45 @@ +--- +title: Manage AI features in Notepad +description: Learn how to manage AI features in Notepad using Microsoft Intune and Group Policy. +ms.topic: how-to +ms.subservice: windows-copilot +ms.date: 04/30/2025 +ms.author: vinpa +author: vinaypamnani-msft +--- + +# Manage AI features in Notepad + +> **Looking for consumer information?** See [Enhance Your Writing with AI in Notepad](https://support.microsoft.com/topic/4088b954-c97b-46dc-813f-959be01746d5). + +Notepad in Windows includes AI features powered by Copilot that help refine and shorten text with the assistance of GPT. By default, these AI features are enabled on managed devices. IT admins can choose if they want to allow these features to be used in their organizations. + +This article provides information about managing AI features for Notepad in a commercial environment. + +## Configure policies for Notepad + +To configure Notepad policies, you can use: + +- Microsoft Intune +- CSP +- Group policy +- Registry + +The following instructions provide details how to configure your devices. Select the option that best suits your needs. + +#### [:::image type="icon" source="../../images/icons/intune.svg"::: **Intune**](#tab/intune) + +TODO + +#### [:::image type="icon" source="../../images/icons/csp.svg"::: **CSP**](#tab/csp) + +TODO + + +#### [:::image type="icon" source="../../images/icons/group-policy.svg" border="false"::: **GPO**](#tab/gpo) + +TODO + +#### [:::image type="icon" source="../../images/icons/registry.svg" border="false"::: **Registry**](#tab/reg) + +TODO \ No newline at end of file diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index 149a74c64d..c6427b24a0 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -48,20 +48,25 @@ items: href: enterprise-app-management.md - name: Manage updates href: device-update-management.md - - name: Updated Windows and Microsoft 365 Copilot Chat experience - href: manage-windows-copilot.md - - name: Manage Click to Do - href: manage-click-to-do.md - - name: Manage Recall - href: manage-recall.md - - name: Reference for sensitive information filtering in Recall - href: recall-sensitive-information-filtering.md - name: Secured-Core PC Configuration Lock href: config-lock.md - name: Certificate renewal href: certificate-renewal-windows-mdm.md - name: eSIM management href: esim-enterprise-management.md + - name: Manage Windows AI + expanded: false + items: + - name: Manage Click to Do + href: manage-click-to-do.md + - name: Manage Recall + href: manage-recall.md + - name: Reference for sensitive information filtering in Recall + href: recall-sensitive-information-filtering.md + - name: Manage Notepad + href: manage-notepad.md + - name: Updated Windows and Microsoft 365 Copilot Chat experience + href: manage-windows-copilot.md - name: Diagnose MDM failures expanded: false items: From a1c9af5ad35c646c650024db9d9d5b11fb6a2df6 Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Wed, 30 Apr 2025 10:40:00 -0600 Subject: [PATCH 04/17] Update --- images/icons/group-policy.svg | 14 ---- images/icons/intune.svg | 23 ------ .../client-management/images}/icons/csp.svg | 0 .../images/icons/group-policy.svg | 17 ++++- .../images}/icons/registry.svg | 0 windows/client-management/manage-notepad.md | 70 +++++++++++++++---- windows/client-management/toc.yml | 2 +- 7 files changed, 72 insertions(+), 54 deletions(-) delete mode 100644 images/icons/group-policy.svg delete mode 100644 images/icons/intune.svg rename {images => windows/client-management/images}/icons/csp.svg (100%) rename {images => windows/client-management/images}/icons/registry.svg (100%) diff --git a/images/icons/group-policy.svg b/images/icons/group-policy.svg deleted file mode 100644 index e6ec2d2c2e..0000000000 --- a/images/icons/group-policy.svg +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - - - - diff --git a/images/icons/intune.svg b/images/icons/intune.svg deleted file mode 100644 index 22148b48fb..0000000000 --- a/images/icons/intune.svg +++ /dev/null @@ -1,23 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - diff --git a/images/icons/csp.svg b/windows/client-management/images/icons/csp.svg similarity index 100% rename from images/icons/csp.svg rename to windows/client-management/images/icons/csp.svg diff --git a/windows/client-management/images/icons/group-policy.svg b/windows/client-management/images/icons/group-policy.svg index ace95add6b..e6ec2d2c2e 100644 --- a/windows/client-management/images/icons/group-policy.svg +++ b/windows/client-management/images/icons/group-policy.svg @@ -1,3 +1,14 @@ - - - \ No newline at end of file + + + + + + + + + + + + + + diff --git a/images/icons/registry.svg b/windows/client-management/images/icons/registry.svg similarity index 100% rename from images/icons/registry.svg rename to windows/client-management/images/icons/registry.svg diff --git a/windows/client-management/manage-notepad.md b/windows/client-management/manage-notepad.md index 559a696e9a..3c2d589a29 100644 --- a/windows/client-management/manage-notepad.md +++ b/windows/client-management/manage-notepad.md @@ -16,30 +16,74 @@ Notepad in Windows includes AI features powered by Copilot that help refine and This article provides information about managing AI features for Notepad in a commercial environment. -## Configure policies for Notepad +## Download the Notepad administrative template (ADMX) + +The [Notepad Administrative Template (ADMX)](https://todo) can be downloaded from the Microsoft Download Center. + +## Policy settings + +### DisableAIFeaturesInNotepad + +This policy setting allows you to control whether AI features are disabled in the Windows Notepad app.  + +- If this policy is enabled, AI features will not be accessible in the Notepad app.  +- If this policy is disabled or not configured, users will be able to access AI features in the Notepad app. + +**Supported versions** + +- Windows 11, version 22H2 or later. +- Notepad [TBD] + +**Allowed values** + +| Value | Description | +|:----------- |:------------------------- | +| 0 (Default) | AI features are enabled. | +| 1 | AI features are disabled. | + +## Configure policies To configure Notepad policies, you can use: - Microsoft Intune -- CSP - Group policy - Registry The following instructions provide details how to configure your devices. Select the option that best suits your needs. -#### [:::image type="icon" source="../../images/icons/intune.svg"::: **Intune**](#tab/intune) - -TODO - -#### [:::image type="icon" source="../../images/icons/csp.svg"::: **CSP**](#tab/csp) - -TODO +#### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune) -#### [:::image type="icon" source="../../images/icons/group-policy.svg" border="false"::: **GPO**](#tab/gpo) +To configure devices using Microsoft Intune, [import the Notepad administrative template (ADMX) files](/intune/intune-service/configuration/administrative-templates-import-custom#add-the-admx-and-adml-files) and then [create a custom **Configuration profile**](/intune/intune-service/configuration/administrative-templates-import-custom#create-a-profile-using-your-imported-files) based on the imported ADMX files. -TODO +> [!NOTE] +> The Notepad administrative template (ADMX) depends on the Windows administrative template (`C:\Windows\PolicyDefinitions\Windows.admx`) file, so make sure you import it as well. -#### [:::image type="icon" source="../../images/icons/registry.svg" border="false"::: **Registry**](#tab/reg) + -TODO \ No newline at end of file +#### [:::image type="icon" source="images/icons/group-policy.svg" border="false"::: **GPO**](#tab/gpo) + +For machines within a corporate network, you can use Group Policy with Active Directory (AD) to deploy Notepad policies. Steps: + +1. Download the latest [Notepad administrative template (ADMX)](#download-the-notepad-administrative-template-admx). + +2. On your domain controllers, copy and paste the following files to the relevant location, depending if you store Group Policy templates in the local `PolicyDefinitions` folder or the [Group Policy Central Store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store). Replace `contoso.com` with your domain name, and `en-US` if you're using a different language. + + - **Filename**: `WindowsNotepad.admx` + - **Local location**: `C:\Windows\PolicyDefinitions\` + - **Central Store**: `\\contoso.com\SYSVOL\contoso.com\Policies\PolicyDefinitions` + + - **Filename**: `en-US\WindowsNotepad.adml` + - **Local location**: `C:\Windows\PolicyDefinitions\en-US\` + - **Central Store**: `\\contoso.com\SYSVOL\contoso.com\Policies\PolicyDefinitions\en-US` + +3. On a device you use to manage Group Policy, open the **Group Policy Management Console (GPMC)** and create or edit a policy that targets your devices. + +4. To verify that the Notepad administrative template is available, browse to **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Notepad** . You should see policy settings for Notepad available for you to configure. + +#### [:::image type="icon" source="images/icons/registry.svg" border="false"::: **Registry**](#tab/reg) + +To disable AI features in Notepad, set the `DisableAIFeatures` registry value to `1` under `HKLM:\SOFTWARE\Policies\WindowsNotepad`. diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index c6427b24a0..c21275a117 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -55,7 +55,7 @@ items: - name: eSIM management href: esim-enterprise-management.md - name: Manage Windows AI - expanded: false + expanded: true items: - name: Manage Click to Do href: manage-click-to-do.md From 9a8448f6c2ef97231fe9b147c29c2b17f2b1114d Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Wed, 30 Apr 2025 10:47:13 -0600 Subject: [PATCH 05/17] Minor --- windows/client-management/manage-notepad.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/client-management/manage-notepad.md b/windows/client-management/manage-notepad.md index 3c2d589a29..9a687339e7 100644 --- a/windows/client-management/manage-notepad.md +++ b/windows/client-management/manage-notepad.md @@ -18,16 +18,16 @@ This article provides information about managing AI features for Notepad in a co ## Download the Notepad administrative template (ADMX) -The [Notepad Administrative Template (ADMX)](https://todo) can be downloaded from the Microsoft Download Center. +The [Notepad Administrative Template (ADMX)](https://todo) can be downloaded from the Microsoft Download Center. ## Policy settings ### DisableAIFeaturesInNotepad -This policy setting allows you to control whether AI features are disabled in the Windows Notepad app.  +This policy setting allows you to control whether AI features are disabled in the Windows Notepad app. -- If this policy is enabled, AI features will not be accessible in the Notepad app.  -- If this policy is disabled or not configured, users will be able to access AI features in the Notepad app. +- If this policy is enabled, users can't access AI features in the Notepad app. +- If this policy is disabled or not configured, users can access AI features in the Notepad app. **Supported versions** @@ -54,10 +54,10 @@ The following instructions provide details how to configure your devices. Select #### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune) -To configure devices using Microsoft Intune, [import the Notepad administrative template (ADMX) files](/intune/intune-service/configuration/administrative-templates-import-custom#add-the-admx-and-adml-files) and then [create a custom **Configuration profile**](/intune/intune-service/configuration/administrative-templates-import-custom#create-a-profile-using-your-imported-files) based on the imported ADMX files. +To configure devices using Microsoft Intune, [import the Notepad administrative template (ADMX) files](/intune/intune-service/configuration/administrative-templates-import-custom#add-the-admx-and-adml-files) and then [create a custom **Configuration profile**](/intune/intune-service/configuration/administrative-templates-import-custom#create-a-profile-using-your-imported-files) based on the imported ADMX files. > [!NOTE] -> The Notepad administrative template (ADMX) depends on the Windows administrative template (`C:\Windows\PolicyDefinitions\Windows.admx`) file, so make sure you import it as well. +> The Notepad administrative template (ADMX) depends on the Windows administrative template (`C:\Windows\PolicyDefinitions\Windows.admx`) file, so make sure you import it as well. diff --git a/windows/client-management/mdm/passportforwork-ddf.md b/windows/client-management/mdm/passportforwork-ddf.md index a40108a1d3..94763f451e 100644 --- a/windows/client-management/mdm/passportforwork-ddf.md +++ b/windows/client-management/mdm/passportforwork-ddf.md @@ -1,7 +1,7 @@ --- title: PassportForWork DDF file description: View the XML file containing the device description framework (DDF) for the PassportForWork configuration service provider. -ms.date: 02/13/2025 +ms.date: 04/30/2025 ms.topic: generated-reference --- @@ -1579,11 +1579,11 @@ Note that enhanced anti-spoofing for Windows Hello face authentication is not re 0 - ESS will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of peripheral Windows Hello capable devices will be allowed, subject to current feature limitations. In addition, with this setting, ESS will be enabled on devices with a mixture of biometric devices, such as an ESS capable FPR and a non-ESS capable camera. (not recommended) + ESS will be disabled on systems with capable software and hardware. Authentication operations of peripheral Windows Hello capable devices will be allowed, subject to current feature limitations. 1 - ESS will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of any peripheral biometric device will be blocked and not available for Windows Hello. (default and recommended for highest security) + ESS will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of any peripheral biometric device will be blocked and not available for Windows Hello. diff --git a/windows/client-management/mdm/policies-in-preview.md b/windows/client-management/mdm/policies-in-preview.md index 9be89eb1f4..e7a1b732c0 100644 --- a/windows/client-management/mdm/policies-in-preview.md +++ b/windows/client-management/mdm/policies-in-preview.md @@ -1,7 +1,7 @@ --- title: Configuration service provider preview policies description: Learn more about configuration service provider (CSP) policies that are available for Windows Insider Preview. -ms.date: 04/21/2025 +ms.date: 05/02/2025 ms.topic: generated-reference --- @@ -86,6 +86,7 @@ This article lists the policies that are applicable for Windows Insider Preview - [EnableDevDrive](policy-csp-filesystem.md#enabledevdrive) - [DevDriveAttachPolicy](policy-csp-filesystem.md#devdriveattachpolicy) +- [ClfsAuthenticationChecking](policy-csp-filesystem.md#clfsauthenticationchecking) ## HealthAttestation CSP @@ -135,6 +136,8 @@ This article lists the policies that are applicable for Windows Insider Preview ## LocalPoliciesSecurityOptions - [InteractiveLogon_NumberOfPreviousLogonsToCache](policy-csp-localpoliciessecurityoptions.md#interactivelogon_numberofpreviouslogonstocache) +- [NetworkAccess_RemotelyAccessibleRegistryPaths](policy-csp-localpoliciessecurityoptions.md#networkaccess_remotelyaccessibleregistrypaths) +- [NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths](policy-csp-localpoliciessecurityoptions.md#networkaccess_remotelyaccessibleregistrypathsandsubpaths) - [UserAccountControl_BehaviorOfTheElevationPromptForAdministratorProtection](policy-csp-localpoliciessecurityoptions.md#useraccountcontrol_behavioroftheelevationpromptforadministratorprotection) - [UserAccountControl_TypeOfAdminApprovalMode](policy-csp-localpoliciessecurityoptions.md#useraccountcontrol_typeofadminapprovalmode) @@ -179,7 +182,7 @@ This article lists the policies that are applicable for Windows Insider Preview ## SettingsSync -- [EnableWindowsbackup](policy-csp-settingssync.md#enablewindowsbackup) +- [EnableWindowsBackup](policy-csp-settingssync.md#enablewindowsbackup) ## Start @@ -220,6 +223,10 @@ This article lists the policies that are applicable for Windows Insider Preview - [DisableGenerativeFill](policy-csp-windowsai.md#disablegenerativefill) - [AllowRecallEnablement](policy-csp-windowsai.md#allowrecallenablement) +## WindowsBackupAndRestore CSP + +- [EnableWindowsRestore](windowsbackupandrestore-csp.md#enablewindowsrestore) + ## WindowsLicensing CSP - [SubscriptionType](windowslicensing-csp.md#subscriptionssubscriptiontype) diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 9fc3c22b95..50b70af65a 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -1,7 +1,7 @@ --- title: DeviceLock Policy CSP description: Learn more about the DeviceLock Area in Policy CSP. -ms.date: 03/12/2025 +ms.date: 04/30/2025 ms.topic: generated-reference --- @@ -24,7 +24,7 @@ ms.topic: generated-reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -63,7 +63,7 @@ Account lockout threshold - This security setting determines the number of faile | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -328,7 +328,7 @@ Determines the type of PIN or password required. This policy only applies if the | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -684,7 +684,7 @@ The number of authentication failures allowed before the device will be wiped. A | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1024,7 +1024,7 @@ This security setting determines the period of time (in days) that a password mu | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1077,7 +1077,7 @@ This security setting determines the least number of characters that a password | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1127,7 +1127,7 @@ This security setting determines the minimum password length for which password | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1187,7 +1187,7 @@ Complexity requirements are enforced when passwords are changed or created. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1359,7 +1359,7 @@ If you enable this setting, users will no longer be able to modify slide show se | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index fef26a3307..eaaee22550 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -1,7 +1,7 @@ --- title: Display Policy CSP description: Learn more about the Display Area in Policy CSP. -ms.date: 03/12/2025 +ms.date: 04/30/2025 ms.topic: generated-reference --- @@ -22,10 +22,14 @@ ms.topic: generated-reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +```User +./User/Vendor/MSFT/Policy/Config/Display/ConfigureMultipleDisplayMode +``` + ```Device ./Device/Vendor/MSFT/Policy/Config/Display/ConfigureMultipleDisplayMode ``` @@ -33,7 +37,7 @@ ms.topic: generated-reference -This policy sets the default display arrangement to pick between clone or extend. +Set the default display arrangement as clone, extend, internalOnly, externalOnly or default Windows Settings. @@ -47,7 +51,7 @@ This policy sets the default display arrangement to pick between clone or extend |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | -| Default Value | 1 | +| Default Value | 0 | @@ -55,9 +59,11 @@ This policy sets the default display arrangement to pick between clone or extend | Value | Description | |:--|:--| -| 0 | Default. | -| 1 (Default) | Clone. | -| 2 | Extend. | +| 0 (Default) | Default. | +| 1 | Internal Only. | +| 2 | External Only. | +| 3 | Clone. | +| 4 | Extend. | @@ -305,10 +311,14 @@ Enabling this setting lets you specify the system-wide default for desktop appli | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +```User +./User/Vendor/MSFT/Policy/Config/Display/SetClonePreferredResolutionSource +``` + ```Device ./Device/Vendor/MSFT/Policy/Config/Display/SetClonePreferredResolutionSource ``` @@ -316,7 +326,7 @@ Enabling this setting lets you specify the system-wide default for desktop appli -This policy sets the cloned monitor preferred resolution source to an internal or external monitor by default. +Set the cloned monitor preferred resolution source as internal or external monitor or set to default. @@ -330,7 +340,7 @@ This policy sets the cloned monitor preferred resolution source to an internal o |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | -| Default Value | 1 | +| Default Value | 0 | @@ -338,8 +348,8 @@ This policy sets the cloned monitor preferred resolution source to an internal o | Value | Description | |:--|:--| -| 0 | Default. | -| 1 (Default) | Internal. | +| 0 (Default) | Default. | +| 1 | Internal. | | 2 | External. | diff --git a/windows/client-management/mdm/policy-csp-filesystem.md b/windows/client-management/mdm/policy-csp-filesystem.md index 79f4e79033..6aa34c4df9 100644 --- a/windows/client-management/mdm/policy-csp-filesystem.md +++ b/windows/client-management/mdm/policy-csp-filesystem.md @@ -1,7 +1,7 @@ --- title: FileSystem Policy CSP description: Learn more about the FileSystem Area in Policy CSP. -ms.date: 03/12/2025 +ms.date: 04/30/2025 ms.topic: generated-reference --- @@ -18,6 +18,56 @@ ms.topic: generated-reference + +## ClfsAuthenticationChecking + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/FileSystem/ClfsAuthenticationChecking +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | ClfsAuthenticationChecking | +| ADMX File Name | FileSys.admx | + + + + + + + + ## DevDriveAttachPolicy diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 9c5d66ece3..721b0c112a 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -1,7 +1,7 @@ --- title: LocalPoliciesSecurityOptions Policy CSP description: Learn more about the LocalPoliciesSecurityOptions Area in Policy CSP. -ms.date: 03/12/2025 +ms.date: 04/30/2025 ms.topic: generated-reference --- @@ -361,7 +361,7 @@ Accounts: Rename guest account This security setting determines whether a differ | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -422,7 +422,7 @@ Audit: Audit the use of Backup and Restore privilege This security setting deter | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -463,7 +463,7 @@ Audit: Force audit policy subcategory settings (Windows Vista or later) to overr | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -736,7 +736,7 @@ Devices: Restrict CD-ROM access to locally logged-on user only This security set | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -789,7 +789,7 @@ Devices: Restrict floppy access to locally logged-on user only This security set | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -843,7 +843,7 @@ Domain member: Digitally encrypt or sign secure channel data (always) This secur | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -896,7 +896,7 @@ Domain member: Digitally encrypt secure channel data (when possible) This securi | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -946,7 +946,7 @@ Domain member: Digitally sign secure channel data (when possible) This security | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1000,7 +1000,7 @@ Domain member: Disable machine account password changes Determines whether a dom | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1053,7 +1053,7 @@ Domain member: Maximum machine account password age This security setting determ | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1353,7 +1353,7 @@ Interactive logon: Don't require CTRL+ALT+DEL This security setting determines w | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1557,7 +1557,7 @@ Interactive logon: Message title for users attempting to log on This security se | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 with [KB5052093](https://support.microsoft.com/help/5052093) [10.0.26100.3323] and later
✅ Windows Insider Preview | @@ -1599,7 +1599,7 @@ Interactive logon: Number of previous logons to cache (in case domain controller | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1888,7 +1888,7 @@ Microsoft network client: Send unencrypted password to connect to third-party SM | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2071,7 +2071,7 @@ Microsoft network server: Digitally sign communications (if client agrees) This | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2114,7 +2114,7 @@ Microsoft network server: Disconnect clients when logon hours expire This securi | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2155,7 +2155,7 @@ Microsoft network server: Server SPN target name validation level This policy se | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2336,7 +2336,7 @@ Network access: Don't allow anonymous enumeration of SAM accounts and shares Thi | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2384,7 +2384,7 @@ Network access: Don't allow storage of passwords and credentials for network aut | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2436,7 +2436,7 @@ Network access: Let Everyone permissions apply to anonymous users This security | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2476,7 +2476,7 @@ Network access: Named pipes that can be accessed anonymously This security setti | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 with [KB5053656](https://support.microsoft.com/help/5053656) [10.0.26100.3624] and later
✅ Windows Insider Preview | @@ -2519,7 +2519,7 @@ Network access: Remotely accessible registry paths This security setting determi | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 with [KB5053656](https://support.microsoft.com/help/5053656) [10.0.26100.3624] and later
✅ Windows Insider Preview | @@ -2668,7 +2668,7 @@ Network access: Restrict clients allowed to make remote calls to SAM This policy | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2708,7 +2708,7 @@ Network access: Shares that can be accessed anonymously This security setting de | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2752,7 +2752,7 @@ Network access: Sharing and security model for local accounts This security sett | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2982,7 +2982,7 @@ Network security: Don't store LAN Manager hash value on next password change Thi | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -3107,7 +3107,7 @@ Network security LAN Manager authentication level This security setting determin | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -3513,7 +3513,7 @@ Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers This po | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -3563,7 +3563,7 @@ Recovery console: Allow automatic administrative logon This security setting det | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -3720,7 +3720,7 @@ Shutdown: Clear virtual memory pagefile This security setting determines whether | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -3761,7 +3761,7 @@ System Cryptography: Force strong key protection for user keys stored on the com | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -3811,7 +3811,7 @@ System objects: Require case insensitivity for non-Windows subsystems This secur | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-mssecurityguide.md b/windows/client-management/mdm/policy-csp-mssecurityguide.md index 04b7621dc4..2e2b488259 100644 --- a/windows/client-management/mdm/policy-csp-mssecurityguide.md +++ b/windows/client-management/mdm/policy-csp-mssecurityguide.md @@ -1,7 +1,7 @@ --- title: MSSecurityGuide Policy CSP description: Learn more about the MSSecurityGuide Area in Policy CSP. -ms.date: 03/12/2025 +ms.date: 04/30/2025 ms.topic: generated-reference --- @@ -222,7 +222,7 @@ ms.topic: generated-reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md index 952086c203..cbfe6f3b95 100644 --- a/windows/client-management/mdm/policy-csp-networklistmanager.md +++ b/windows/client-management/mdm/policy-csp-networklistmanager.md @@ -1,7 +1,7 @@ --- title: NetworkListManager Policy CSP description: Learn more about the NetworkListManager Area in Policy CSP. -ms.date: 03/12/2025 +ms.date: 04/30/2025 ms.topic: generated-reference --- @@ -20,7 +20,7 @@ ms.topic: generated-reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -69,7 +69,7 @@ This policy setting allows you to specify whether users can change the network i | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -118,7 +118,7 @@ This policy setting allows you to specify whether users can change the network l | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -261,7 +261,7 @@ This policy setting provides the string that names a network. If this setting is | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -310,7 +310,7 @@ This policy setting allows you to configure the Network Location for networks th | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -359,7 +359,7 @@ This policy setting allows you to configure the Network Location type for networ | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-settingssync.md b/windows/client-management/mdm/policy-csp-settingssync.md index 65cf2fbf33..bd3593ba89 100644 --- a/windows/client-management/mdm/policy-csp-settingssync.md +++ b/windows/client-management/mdm/policy-csp-settingssync.md @@ -1,7 +1,7 @@ --- title: SettingsSync Policy CSP description: Learn more about the SettingsSync Area in Policy CSP. -ms.date: 03/12/2025 +ms.date: 04/30/2025 ms.topic: generated-reference --- @@ -140,39 +140,39 @@ If you don't set or disable this setting, syncing of the "language preferences" - -## EnableWindowsbackup + +## EnableWindowsBackup - + | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | - + - + ```Device -./Device/Vendor/MSFT/Policy/Config/SettingsSync/EnableWindowsbackup +./Device/Vendor/MSFT/Policy/Config/SettingsSync/EnableWindowsBackup ``` - + - + - + - + - + - + **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | - + - + [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] @@ -180,15 +180,15 @@ If you don't set or disable this setting, syncing of the "language preferences" | Name | Value | |:--|:--| -| Name | EnableWindowsbackup | +| Name | EnableWindowsBackup | | ADMX File Name | SettingSync.admx | - + - + - + - + diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index 4a1ac1541c..dd77b65a34 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -1,7 +1,7 @@ --- title: SystemServices Policy CSP description: Learn more about the SystemServices Area in Policy CSP. -ms.date: 03/12/2025 +ms.date: 04/30/2025 ms.topic: generated-reference --- @@ -20,7 +20,7 @@ ms.topic: generated-reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -170,7 +170,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -220,7 +220,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -270,7 +270,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -320,7 +320,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -370,7 +370,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -420,7 +420,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -470,7 +470,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -520,7 +520,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -570,7 +570,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -620,7 +620,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -670,7 +670,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -720,7 +720,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -770,7 +770,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -820,7 +820,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -870,7 +870,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index e5c1efb17d..710e7c41a9 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -1,7 +1,7 @@ --- title: UserRights Policy CSP description: Learn more about the UserRights Area in Policy CSP. -ms.date: 03/12/2025 +ms.date: 04/30/2025 ms.topic: generated-reference --- @@ -257,7 +257,7 @@ This user right allows a process to impersonate any user without authentication. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -366,7 +366,7 @@ This user right determines which users can log on to the computer. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -467,7 +467,7 @@ This user right determines which users can bypass file, directory, registry, and | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -582,7 +582,7 @@ This user right determines which users and groups can change the time and date o | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1058,7 +1058,7 @@ This security setting determines which service accounts are prevented from regis | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1590,7 +1590,7 @@ This user right determines which accounts can use a process to keep data in phys | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1639,7 +1639,7 @@ This security setting allows a user to be logged-on by means of a batch-queue fa | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1936,7 +1936,7 @@ This user right determines which users can use performance monitoring tools to m | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2034,7 +2034,7 @@ This user right determines which users are allowed to shut down a computer from | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2143,7 +2143,7 @@ This user right determines which users can bypass file, directory, registry, and | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5053657](https://support.microsoft.com/help/5053657) [10.0.22621.5126] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-windowsai.md b/windows/client-management/mdm/policy-csp-windowsai.md index a8007969a9..6f59fee325 100644 --- a/windows/client-management/mdm/policy-csp-windowsai.md +++ b/windows/client-management/mdm/policy-csp-windowsai.md @@ -1,7 +1,7 @@ --- title: WindowsAI Policy CSP description: Learn more about the WindowsAI Area in Policy CSP. -ms.date: 03/27/2025 +ms.date: 05/02/2025 ms.topic: generated-reference --- @@ -22,7 +22,7 @@ ms.topic: generated-reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 with [KB5052093](https://support.microsoft.com/help/5052093) [10.0.26100.3323] and later
✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 with [KB5055627](https://support.microsoft.com/help/5055627) [10.0.26100.3915] and later
✅ Windows Insider Preview | @@ -91,7 +91,7 @@ This policy setting allows you to determine whether the Recall optional componen | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 with [KB5052093](https://support.microsoft.com/help/5052093) [10.0.26100.3323] and later
✅ Windows Insider Preview | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 with [KB5055627](https://support.microsoft.com/help/5055627) [10.0.26100.3915] and later
✅ Windows Insider Preview | @@ -193,7 +193,7 @@ Click to Do lets people take action on content on their screens. When activated, |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | -| Default Value | 1 | +| Default Value | 0 | @@ -201,8 +201,8 @@ Click to Do lets people take action on content on their screens. When activated, | Value | Description | |:--|:--| -| 0 | Click to Do is enabled. | -| 1 (Default) | Click to Do is disabled. | +| 0 (Default) | Click to Do is enabled. | +| 1 | Click to Do is disabled. | @@ -226,7 +226,7 @@ Click to Do lets people take action on content on their screens. When activated, | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.4870] and later
✅ Windows 11, version 24H2 [10.0.26100.3360] and later
✅ Windows Insider Preview | @@ -288,7 +288,7 @@ This policy setting allows you to control whether Cocreator functionality is dis | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.4870] and later
✅ Windows 11, version 24H2 [10.0.26100.3360] and later
✅ Windows Insider Preview | @@ -350,7 +350,7 @@ This policy setting allows you to control whether generative fill functionality | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.4870] and later
✅ Windows 11, version 24H2 [10.0.26100.3360] and later
✅ Windows Insider Preview | @@ -469,7 +469,7 @@ The property value is the Application User Model ID (AUMID) for the target appli | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 with [KB5052093](https://support.microsoft.com/help/5052093) [10.0.26100.3323] and later
✅ Windows Insider Preview | +| ✅ Device
✅ User | ❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 with [KB5055627](https://support.microsoft.com/help/5055627) [10.0.26100.3915] and later
✅ Windows Insider Preview | @@ -538,7 +538,7 @@ For example: `code.exe;Microsoft.WindowsNotepad_8wekyb3d8bbwe!App;ms-teams.exe` | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 with [KB5052093](https://support.microsoft.com/help/5052093) [10.0.26100.3323] and later
✅ Windows Insider Preview | +| ✅ Device
✅ User | ❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 with [KB5055627](https://support.microsoft.com/help/5055627) [10.0.26100.3915] and later
✅ Windows Insider Preview | @@ -603,7 +603,7 @@ Adding `https://www.WoodgroveBank.com` to the list would also filter `https://Ac | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 with [KB5052093](https://support.microsoft.com/help/5052093) [10.0.26100.3323] and later
✅ Windows Insider Preview | +| ✅ Device
✅ User | ❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 with [KB5055627](https://support.microsoft.com/help/5055627) [10.0.26100.3915] and later
✅ Windows Insider Preview | @@ -679,7 +679,7 @@ Snapshots aren't deleted until the maximum storage allocation for Recall is reac | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 with [KB5052093](https://support.microsoft.com/help/5052093) [10.0.26100.3323] and later
✅ Windows Insider Preview | +| ✅ Device
✅ User | ❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 with [KB5055627](https://support.microsoft.com/help/5055627) [10.0.26100.3915] and later
✅ Windows Insider Preview | @@ -832,4 +832,4 @@ This policy setting allows you to turn off Windows Copilot. ## Related articles -[Policy configuration service provider](policy-configuration-service-provider.md) \ No newline at end of file +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 51966229d9..68a08b226b 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -986,6 +986,11 @@ items: items: - name: WindowsAutopilot DDF file href: windowsautopilot-ddf-file.md + - name: WindowsBackupAndRestore + href: windowsbackupandrestore-csp.md + items: + - name: WindowsBackupAndRestore DDF file + href: windowsbackupandrestore-ddf-file.md - name: WindowsDefenderApplicationGuard href: windowsdefenderapplicationguard-csp.md items: diff --git a/windows/client-management/mdm/windowsbackupandrestore-csp.md b/windows/client-management/mdm/windowsbackupandrestore-csp.md new file mode 100644 index 0000000000..159f7d68e6 --- /dev/null +++ b/windows/client-management/mdm/windowsbackupandrestore-csp.md @@ -0,0 +1,83 @@ +--- +title: WindowsBackupAndRestore CSP +description: Learn more about the WindowsBackupAndRestore CSP. +ms.date: 04/30/2025 +ms.topic: generated-reference +--- + + + + +# WindowsBackupAndRestore CSP + +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + + + + + + +The following list shows the WindowsBackupAndRestore configuration service provider nodes: + +- ./Device/Vendor/MSFT/WindowsBackupAndRestore + - [EnableWindowsRestore](#enablewindowsrestore) + + + +## EnableWindowsRestore + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WindowsBackupAndRestore/EnableWindowsRestore +``` + + + + +Sets a policy to enable Windows Restore. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `bool` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | false | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false (Default) | Windows Restore Not Configured. | +| true | Windows Restore Enabled. | + + + + + + + + + + + + + + +## Related articles + +[Configuration service provider reference](configuration-service-provider-reference.md) diff --git a/windows/client-management/mdm/windowsbackupandrestore-ddf-file.md b/windows/client-management/mdm/windowsbackupandrestore-ddf-file.md new file mode 100644 index 0000000000..f5a3975bae --- /dev/null +++ b/windows/client-management/mdm/windowsbackupandrestore-ddf-file.md @@ -0,0 +1,89 @@ +--- +title: WindowsBackupAndRestore DDF file +description: View the XML file containing the device description framework (DDF) for the WindowsBackupAndRestore configuration service provider. +ms.date: 04/30/2025 +ms.topic: generated-reference +--- + + + +# WindowsBackupAndRestore DDF file + +The following XML file contains the device description framework (DDF) for the WindowsBackupAndRestore configuration service provider. + +```xml + +]> + + 1.2 + + + + WindowsBackupAndRestore + ./Device/Vendor/MSFT + + + + + The root node for the Windows Backup and restore. + + + + + + + + + + + + + + 99.9.99999 + 9.9 + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; + + + + EnableWindowsRestore + + + + + + + + false + Sets a policy to enable Windows Restore. + + + + + + + + + + Enable Windows Restore + + + + + + false + Windows Restore Not Configured + + + true + Windows Restore Enabled + + + + + + +``` + +## Related articles + +[WindowsBackupAndRestore configuration service provider reference](windowsbackupandrestore-csp.md) diff --git a/windows/client-management/mdm/wirelessnetworkpreference-csp.md b/windows/client-management/mdm/wirelessnetworkpreference-csp.md index b356a16a04..cd372050db 100644 --- a/windows/client-management/mdm/wirelessnetworkpreference-csp.md +++ b/windows/client-management/mdm/wirelessnetworkpreference-csp.md @@ -1,7 +1,7 @@ --- title: WirelessNetworkPreference CSP description: Learn more about the WirelessNetworkPreference CSP. -ms.date: 04/21/2025 +ms.date: 04/30/2025 ms.topic: generated-reference --- @@ -577,8 +577,8 @@ When evaluating eSIM profiles for connectivity, this value configures the amount |:--|:--| | Format | `int` | | Access Type | Get, Replace | -| Allowed Values | Range: `[30-360]` | -| Default Value | 60 | +| Allowed Values | Range: `[20-360]` | +| Default Value | 30 | @@ -733,7 +733,7 @@ Nodes that indicate the status of the wireless connectivity management service. -An integer indicating the current status of the wireless connectivity management service. If the value is zero, there are no errors. \n\n 0 = No errors. \n 1 = No policies are configured. \n 2 = More than one policy has the same priority. \n 3 = More than one policy references the same PLMNID. \n 4 = Invalid PLMNID for one or more of the configured profiles. \n 5 = More than one eSIM profile stored in the eUICC with the same PLMN ID. \n 6 = Invalid configuration value for one or more of the cellular parameters. Please review CSP documentation. \n\n Warning: Any of these errors will result in a complete halt of the wireless connectivity management service. +An integer indicating the current status of the wireless connectivity management service. If the value is zero, there are no errors. \n\n 0 = No errors. \n 1 = No policies are configured. \n 2 = More than one policy has the same priority. \n 3 = More than one policy references the same PLMN ID. \n 4 = Invalid PLMN ID for one or more of the configured profiles. \n 5 = More than one eSIM profile stored in the eUICC with the same PLMN ID. \n 6 = Invalid configuration value for one or more of the cellular parameters. Please review CSP documentation. \n\n Warning: Any of these errors will result in a complete halt of the wireless connectivity management service. @@ -811,7 +811,7 @@ Count of operational eSIM profiles stored in the eUICC. -Count of operational eSIM profiles stored on the eUICC whose PLMN matches one of the ConnectionProfileIDs setup under the ConnectionProfiles node. Only matched profiles with no errors will be counted. If more than one eSIM profile with the same PLMN ID is configured on the policy and/or more than one eSIM profile with the same PLMN ID is stored in the eUICC, then they won't be counted even if there is a match. +Count of operational eSIM profiles stored on the eUICC whose PLMN ID matches one of the ConnectionProfileIDs setup under the ConnectionProfiles node. Only matched profiles with no errors will be counted. If more than one eSIM profile with the same PLMN ID is configured on the policy and/or more than one eSIM profile with the same PLMN ID is stored in the eUICC, then they won't be counted even if there is a match. diff --git a/windows/client-management/mdm/wirelessnetworkpreference-ddf-file.md b/windows/client-management/mdm/wirelessnetworkpreference-ddf-file.md index e23616812e..01d64c2b80 100644 --- a/windows/client-management/mdm/wirelessnetworkpreference-ddf-file.md +++ b/windows/client-management/mdm/wirelessnetworkpreference-ddf-file.md @@ -1,7 +1,7 @@ --- title: WirelessNetworkPreference DDF file description: View the XML file containing the device description framework (DDF) for the WirelessNetworkPreference configuration service provider. -ms.date: 04/21/2025 +ms.date: 04/30/2025 ms.topic: generated-reference --- @@ -25,7 +25,7 @@ The following XML file contains the device description framework (DDF) for the W - Represents information associated with wireless networks prioritization including detailed connectivity priorities for specific cellular networks with a unique PLMN_ID. + Represents information associated with wireless networks prioritization including detailed connectivity priorities for specific cellular networks with a unique PLMN ID. @@ -157,7 +157,7 @@ The following XML file contains the device description framework (DDF) for the W - Count of operational eSIM profiles stored on the eUICC whose PLMN matches one of the ConnectionProfileIDs setup under the ConnectionProfiles node. Only matched profiles with no errors will be counted. If more than one eSIM profile with the same PLMN ID is configured on the policy and/or more than one eSIM profile with the same PLMN ID is stored in the eUICC, then they will not be counted even if there is a match. + Count of operational eSIM profiles stored on the eUICC whose PLMN ID matches one of the ConnectionProfileIDs setup under the ConnectionProfiles node. Only matched profiles with no errors will be counted. If more than one eSIM profile with the same PLMN ID is configured on the policy and/or more than one eSIM profile with the same PLMN ID is stored in the eUICC, then they will not be counted even if there is a match. @@ -178,7 +178,7 @@ The following XML file contains the device description framework (DDF) for the W - An integer indicating the current status of the wireless connectivity management service. If the value is zero, there are no errors. \n\n 0 = No errors. \n 1 = No policies are configured. \n 2 = More than one policy has the same priority. \n 3 = More than one policy references the same PLMNID. \n 4 = Invalid PLMNID for one or more of the configured profiles. \n 5 = More than one eSIM profile stored in the eUICC with the same PLMN ID. \n 6 = Invalid configuration value for one or more of the cellular parameters. Please review CSP documentation. \n\n Warning: Any of these errors will result in a complete halt of the wireless connectivity management service. + An integer indicating the current status of the wireless connectivity management service. If the value is zero, there are no errors. \n\n 0 = No errors. \n 1 = No policies are configured. \n 2 = More than one policy has the same priority. \n 3 = More than one policy references the same PLMN ID. \n 4 = Invalid PLMN ID for one or more of the configured profiles. \n 5 = More than one eSIM profile stored in the eUICC with the same PLMN ID. \n 6 = Invalid configuration value for one or more of the cellular parameters. Please review CSP documentation. \n\n Warning: Any of these errors will result in a complete halt of the wireless connectivity management service. @@ -326,7 +326,7 @@ The following XML file contains the device description framework (DDF) for the W - 60 + 30 When evaluating eSIM profiles for connectivity, this value configures the amount of time (in seconds) that the agent will wait for network registration before considering this profile unsatisfactory and moving on to the next one. @@ -341,7 +341,7 @@ The following XML file contains the device description framework (DDF) for the W - [30-360] + [20-360] From 0e68821a2f63e699fd894ad3d9afc125c8c5bb1e Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 5 May 2025 09:04:56 -0700 Subject: [PATCH 08/17] update --- windows/whats-new/deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 561e694b6f..3b4bdd7f15 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -47,7 +47,7 @@ The features in this article are no longer being actively developed, and might b | Feature | Details and mitigation | Deprecation announced | |---|---|---| -| Device metadata | Device metadata is deprecated and will be removed in a future release of Windows. For more information about the replacement for this functionality, see [Driver Package Container Metadata](/windows-hardware/drivers/install/driver-package-container-metadata). | April 2025 | +| Device metadata | Device metadata is deprecated and will be removed in a future release of Windows. For more information about the replacement for this functionality, see [Driver Package Container Metadata](/windows-hardware/drivers/install/driver-package-container-metadata). | May 2025 | | Maps app | Maps app is deprecated. It will be removed from the Microsoft Store by July 2025 and will no longer be supported. For more information, see [Resources for deprecated features](deprecated-features-resources.md#maps-app). | April 2025 | | VBS enclaves for Windows 11, version 23H2 and earlier | [VBS enclaves](/windows/win32/trusted-execution/vbs-enclaves) are being deprecated on Windows 11, version 23H2 and earlier versions of Windows. Support for VBS enclaves will continue for Windows 11, version 24H2 and later.

**[Update May 2025]** Existing enclaves signed with the EKU 1.3.6.1.4.1.311.76.57.1.15 will continue to be supported for all Windows 11, version 23H2 and earlier versions of Windows, so long as no changes are made to the enclave that requires a re-sign of it. If a re-sign of the enclave occurs, the new EKU will be used to re-sign and the enclave will only be supported on Windows 11, version 24H2 and later. Existing enclaves signed with EKU 1.3.6.1.4.1.311.76.57.1.15 will continue to function without disruption on the following operating systems until a re-sign is needed:
  • Windows 10, version 22H2
  • Windows 11, version 22H2
  • Windows 11, version 23H2
  • Windows 11, version 24H2 and later
| April 2025 | | Windows UWP Map control and Windows Maps platform APIs | The [Windows UWP Map control](/uwp/api/windows.ui.xaml.controls.maps) and [Windows Maps platform APIs](/uwp/api/windows.services.maps) within Windows have been deprecated as of April 8, 2025. The Maps UWP Control and Maps platform support within Windows will continue to function but will not be updated. For more information, see [Resources for deprecated features](deprecated-features-resources.md#windows-uwp-map-control-and-windows-maps-platform-apis). | April 8, 2025 | From 9b95e6a054cde22f25e6509c834cd70c536ed1d6 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 6 May 2025 10:58:51 -0600 Subject: [PATCH 09/17] Fix typo --- windows/client-management/mdm/policy-csp-filesystem.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-filesystem.md b/windows/client-management/mdm/policy-csp-filesystem.md index 6aa34c4df9..6113c617a1 100644 --- a/windows/client-management/mdm/policy-csp-filesystem.md +++ b/windows/client-management/mdm/policy-csp-filesystem.md @@ -1,7 +1,7 @@ --- title: FileSystem Policy CSP description: Learn more about the FileSystem Area in Policy CSP. -ms.date: 04/30/2025 +ms.date: 05/06/2025 ms.topic: generated-reference --- @@ -145,7 +145,7 @@ Dev drive or developer volume is a volume optimized for performance of developer Disabling this setting will disallow creation of new developer volumes, existing developer volumes will mount as regular volumes. -If this setting isn't configured the default policy is to enable developer volumes while allowing antivirus filter to attach on a deveveloper volume. Further, if not configured, a local administrator can choose to not have antivirus filter attached to a developer volume. +If this setting isn't configured the default policy is to enable developer volumes while allowing antivirus filter to attach on a developer volume. Further, if not configured, a local administrator can choose to not have antivirus filter attached to a developer volume. A reboot is required for this setting to take effect. From 3bd47f2038409252b8ecd56d94793f7fcde89f1a Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 7 May 2025 10:24:07 -0400 Subject: [PATCH 10/17] update --- windows/configuration/taskbar/includes/example.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/configuration/taskbar/includes/example.md b/windows/configuration/taskbar/includes/example.md index 4a31f71fce..20782979f7 100644 --- a/windows/configuration/taskbar/includes/example.md +++ b/windows/configuration/taskbar/includes/example.md @@ -17,6 +17,7 @@ ms.topic: include + From 3b22c9740e2ca1207be29fdd8fec85f73e9e0ec2 Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Wed, 7 May 2025 11:28:11 -0600 Subject: [PATCH 11/17] Update appliesto --- windows/client-management/manage-notepad.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/client-management/manage-notepad.md b/windows/client-management/manage-notepad.md index 16adb1cb99..e36105a562 100644 --- a/windows/client-management/manage-notepad.md +++ b/windows/client-management/manage-notepad.md @@ -6,6 +6,8 @@ ms.subservice: windows-copilot ms.date: 04/30/2025 ms.author: vinpa author: vinaypamnani-msft +appliesto: +- ✅ Windows 11 --- # Manage AI features in Notepad From 9148e9bf69d5c0b73083ccfafa4c47052ff5a2b9 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Wed, 7 May 2025 19:31:31 -0400 Subject: [PATCH 12/17] Update date Updated article last month and updated date to 04/08, but forgot to update the year from 2024 to 2025 --- windows/deployment/mbr-to-gpt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md index 2e0fd5f1de..1e7ca6d9b9 100644 --- a/windows/deployment/mbr-to-gpt.md +++ b/windows/deployment/mbr-to-gpt.md @@ -4,7 +4,7 @@ description: Use MBR2GPT.EXE to convert a disk from the Master Boot Record (MBR) ms.service: windows-client author: frankroj ms.author: frankroj -ms.date: 04/08/2024 +ms.date: 05/07/2025 manager: aaroncz ms.localizationpriority: high ms.topic: how-to From 5029fed848dbdf52c1a567523a48345a0b9b5c1e Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Thu, 8 May 2025 09:55:04 -0600 Subject: [PATCH 13/17] Update link --- windows/client-management/manage-notepad.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/manage-notepad.md b/windows/client-management/manage-notepad.md index e36105a562..1259fb7c81 100644 --- a/windows/client-management/manage-notepad.md +++ b/windows/client-management/manage-notepad.md @@ -20,7 +20,7 @@ This article provides information about managing AI features for Notepad in a co ## Download the Notepad administrative template (ADMX) -The [Notepad Administrative Template (ADMX)](https://todo) can be downloaded from the Microsoft Download Center. The group policy settings contained in the ADMX file are machine-wide for all users. +The [Notepad Administrative Template (ADMX)](https://download.microsoft.com/download/72ea16a9-4cc9-4032-945d-3a56a483d034/WindowsNotepadAdminTemplates.cab) can be downloaded from the Microsoft Download Center. The group policy settings contained in the ADMX file are machine-wide for all users. ## Policy settings @@ -34,7 +34,7 @@ This policy setting allows you to control whether AI features are disabled in th **Supported versions** - Windows 11, version 22H2 or later. -- Notepad [TBD] +- Notepad version 11.2503.16.0 or later. ## Configure policies From e83e627ff6114f526c679a09e701b12bb64e4c1d Mon Sep 17 00:00:00 2001 From: chcart <120026950+chcart@users.noreply.github.com> Date: Thu, 8 May 2025 13:42:37 -0500 Subject: [PATCH 14/17] Update smart-card-group-policy-and-registry-settings.md to fix CCS Registry key shows CCS instead of CurrentControlSet. Customers are taking this literally and stuff is breaking. --- .../smart-card-group-policy-and-registry-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index b98266524f..ee0d629731 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -357,8 +357,8 @@ The following table lists the keys and the corresponding values to turn off cert | Registry Key | Details | |--|--| -| `HKEY_LOCAL_MACHINE\SYSTEM\CCS\Services\Kdc\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors` | Type = DWORD
Value = 1 | -| `HKEY_LOCAL_MACHINE\SYSTEM\CCS\Control\LSA\Kerberos\Parameters\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors` | Type = DWORD
Value = 1 | +| `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors` | Type = DWORD
Value = 1 | +| `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Kerberos\Parameters\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors` | Type = DWORD
Value = 1 | ## Additional smart card Group Policy settings and registry keys From 3314b982253a6a62019f397379f66ff09141fb29 Mon Sep 17 00:00:00 2001 From: mjay Date: Mon, 12 May 2025 14:39:19 +0200 Subject: [PATCH 15/17] Update configure-recovery-password-rotation.md Fix typo in 'Microsoft' and lowercase 'policy' --- .../bitlocker/includes/configure-recovery-password-rotation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/data-protection/bitlocker/includes/configure-recovery-password-rotation.md b/windows/security/operating-system-security/data-protection/bitlocker/includes/configure-recovery-password-rotation.md index d2d790df4b..55173efadc 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/includes/configure-recovery-password-rotation.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/includes/configure-recovery-password-rotation.md @@ -16,7 +16,7 @@ Possible values are: - `2`: numeric recovery password rotation upon use is *on* for both Microsoft Entra joined devices and Microsoft Entra hybrid joined devices > [!NOTE] -> The Policy is effective only when Micropsoft Entra ID or Active Directory backup for recovery password is configured to *required* +> The policy is effective only when Microsoft Entra ID or Active Directory backup for recovery password is configured to *required* > > - For OS drive: enable *Do not enable BitLocker until recovery information is stored to AD DS for operating system drives* > - For fixed drives: enable "*Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives* From a4c88bfff9a32bfd6de0f696cdfef38956836afc Mon Sep 17 00:00:00 2001 From: Christine Eaton <40660908+ceaton-msft@users.noreply.github.com> Date: Tue, 13 May 2025 14:40:58 +0100 Subject: [PATCH 16/17] Update windows-autopatch-hotpatch-updates.md Added clarity around Arm64 preview & added info on CSP to align with IT Pro blog being released. --- .../manage/windows-autopatch-hotpatch-updates.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md index 59e83f707a..3313aafdb0 100644 --- a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md +++ b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md @@ -50,7 +50,7 @@ VBS must be turned on for a device to be offered Hotpatch updates. For informati ### Arm 64 devices must disable compiled hybrid PE usage (CHPE) (Arm 64 CPU Only) > [!IMPORTANT] -> **Arm 64 devices are in public preview**. It's being actively developed and might not be complete. They're made available on a "Preview" basis. You can test and use these features in production environments and scenarios and provide feedback. +> **Hotpatch updates on Arm 64 devices are in public preview**. It's being actively developed and might not be complete. They're made available on a "Preview" basis. You can test and use these features in production environments and scenarios and provide feedback. This requirement only applies to Arm 64 CPU devices when using Hotpatch updates. Hotpatch updates aren't compatible with servicing CHPE OS binaries located in the `%SystemRoot%\SyChpe32` folder. @@ -63,6 +63,8 @@ To disable CHPE, create and/or set the following DWORD registry key: Path: `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management` DWORD key value: HotPatchRestrictions=1 +You can also use the CSP DisableCHPE (available on Windows Insider Preview). See [DisableCHPE](/windows/client-management/mdm/policy-csp-system#disablechpe). + > [!NOTE] > There are no plans to support hotpatch updates on Arm64 devices with CHPE enabled. Disabling CHPE is required only for Arm64 devices. AMD and Intel CPUs don’t have CHPE. From 3a7207cd08fb8f1b41fa89afd8193b5b0b00c9d3 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Tue, 13 May 2025 09:06:32 -0700 Subject: [PATCH 17/17] Update windows-autopatch-hotpatch-updates.md --- .../manage/windows-autopatch-hotpatch-updates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md index 3313aafdb0..4669de9482 100644 --- a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md +++ b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md @@ -63,7 +63,7 @@ To disable CHPE, create and/or set the following DWORD registry key: Path: `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management` DWORD key value: HotPatchRestrictions=1 -You can also use the CSP DisableCHPE (available on Windows Insider Preview). See [DisableCHPE](/windows/client-management/mdm/policy-csp-system#disablechpe). +You can also use the CSP DisableCHPE (available on Windows Insider Preview). For more information, see [DisableCHPE](/windows/client-management/mdm/policy-csp-system#disablechpe). > [!NOTE] > There are no plans to support hotpatch updates on Arm64 devices with CHPE enabled. Disabling CHPE is required only for Arm64 devices. AMD and Intel CPUs don’t have CHPE.