15 KiB
title, description, author, manager, ms.author, ms.date, ms.localizationpriority, ms.prod, ms.technology, ms.topic
| title | description | author | manager | ms.author | ms.date | ms.localizationpriority | ms.prod | ms.technology | ms.topic |
|---|---|---|---|---|---|---|---|---|---|
| ADMX_AppXRuntime Policy CSP | Learn more about the ADMX_AppXRuntime Area in Policy CSP | vinaypamnani-msft | aaroncz | vinpa | 12/20/2022 | medium | windows-client | itpro-manage | reference |
Policy CSP - ADMX_AppXRuntime
Tip
Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see Understanding ADMX-backed policies.
You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to Enabling a policy.
The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see CDATA Sections.
AppxRuntimeApplicationContentUriRules
| Scope | Editions | Applicable OS |
|---|---|---|
| ✔️ Device ❌ User |
❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE |
✔️ Windows 10, version 2004 [10.0.19041.1202] and later ✔️ Windows 10, version 2009 [10.0.19042.1202] and later ✔️ Windows 10, version 21H1 [10.0.19043.1202] and later ✔️ Windows 11, version 21H2 [10.0.22000] and later |
./Device/Vendor/MSFT/Policy/Config/ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules
This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all Windows Store apps that use the enterpriseAuthentication capability on a computer.
If you enable this policy setting, you can define additional Content URI Rules that all Windows Store apps that use the enterpriseAuthentication capability on a computer can use.
If you disable or don't set this policy setting, Windows Store apps will only use the static Content URI Rules.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | chr (string) |
| Access Type | Add, Delete, Get, Replace |
Tip
This is an ADMX-backed policy and requires SyncML format for configuration. For details, see Understanding ADMX-backed policies.
ADMX mapping:
| Name | Value |
|---|---|
| Name | AppxRuntimeApplicationContentUriRules |
| Friendly Name | Turn on dynamic Content URI Rules for Windows store apps |
| Location | Computer Configuration |
| Path | Windows Components > App runtime |
| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\Packages\Applications |
| Registry Value Name | EnableDynamicContentUriRules |
| ADMX File Name | AppXRuntime.admx |
AppxRuntimeBlockFileElevation
| Scope | Editions | Applicable OS |
|---|---|---|
| ✔️ Device ✔️ User |
❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE |
✔️ Windows 10, version 2004 [10.0.19041.1202] and later ✔️ Windows 10, version 2009 [10.0.19042.1202] and later ✔️ Windows 10, version 21H1 [10.0.19043.1202] and later ✔️ Windows 11, version 21H2 [10.0.22000] and later |
./User/Vendor/MSFT/Policy/Config/ADMX_AppXRuntime/AppxRuntimeBlockFileElevation
./Device/Vendor/MSFT/Policy/Config/ADMX_AppXRuntime/AppxRuntimeBlockFileElevation
This policy setting lets you control whether Windows Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a Windows Store app might compromise the system by opening a file in the default desktop app for a file type.
If you enable this policy setting, Windows Store apps cannot open files in the default desktop app for a file type; they can open files only in other Windows Store apps.
If you disable or do not configure this policy setting, Windows Store apps can open files in the default desktop app for a file type.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | chr (string) |
| Access Type | Add, Delete, Get, Replace |
Tip
This is an ADMX-backed policy and requires SyncML format for configuration. For details, see Understanding ADMX-backed policies.
ADMX mapping:
| Name | Value |
|---|---|
| Name | AppxRuntimeBlockFileElevation |
| Friendly Name | Block launching desktop apps associated with a file. |
| Location | Computer and User Configuration |
| Path | Windows Components > App runtime |
| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
| Registry Value Name | BlockFileElevation |
| ADMX File Name | AppXRuntime.admx |
AppxRuntimeBlockHostedAppAccessWinRT
| Scope | Editions | Applicable OS |
|---|---|---|
| ✔️ Device ❌ User |
❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE |
✔️ Windows 10, version 2004 [10.0.19041.1202] and later ✔️ Windows 10, version 2009 [10.0.19042.1202] and later ✔️ Windows 10, version 21H1 [10.0.19043.1202] and later ✔️ Windows 11, version 21H2 [10.0.22000] and later |
./Device/Vendor/MSFT/Policy/Config/ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT
This policy setting controls whether Universal Windows apps with Windows Runtime API access directly from web content can be launched.
If you enable this policy setting, Universal Windows apps which declare Windows Runtime API access in ApplicationContentUriRules section of the manifest cannot be launched; Universal Windows apps which have not declared Windows Runtime API access in the manifest are not affected.
If you disable or do not configure this policy setting, all Universal Windows apps can be launched.
This policy should not be enabled unless recommended by Microsoft as a security response because it can cause severe app compatibility issues.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | chr (string) |
| Access Type | Add, Delete, Get, Replace |
Tip
This is an ADMX-backed policy and requires SyncML format for configuration. For details, see Understanding ADMX-backed policies.
ADMX mapping:
| Name | Value |
|---|---|
| Name | AppxRuntimeBlockHostedAppAccessWinRT |
| Friendly Name | Block launching Universal Windows apps with Windows Runtime API access from hosted content. |
| Location | Computer Configuration |
| Path | Windows Components > App runtime |
| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System |
| Registry Value Name | BlockHostedAppAccessWinRT |
| ADMX File Name | AppXRuntime.admx |
AppxRuntimeBlockProtocolElevation
| Scope | Editions | Applicable OS |
|---|---|---|
| ✔️ Device ✔️ User |
❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE |
✔️ Windows 10, version 2004 [10.0.19041.1202] and later ✔️ Windows 10, version 2009 [10.0.19042.1202] and later ✔️ Windows 10, version 21H1 [10.0.19043.1202] and later ✔️ Windows 11, version 21H2 [10.0.22000] and later |
./User/Vendor/MSFT/Policy/Config/ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation
./Device/Vendor/MSFT/Policy/Config/ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation
This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app.
If you enable this policy setting, Windows Store apps cannot open URIs in the default desktop app for a URI scheme; they can open URIs only in other Windows Store apps.
If you disable or do not configure this policy setting, Windows Store apps can open URIs in the default desktop app for a URI scheme.
Note: Enabling this policy setting does not block Windows Store apps from opening the default desktop app for the http, https, and mailto URI schemes. The handlers for these URI schemes are hardened against URI-based vulnerabilities from untrusted sources, reducing the associated risk.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | chr (string) |
| Access Type | Add, Delete, Get, Replace |
Tip
This is an ADMX-backed policy and requires SyncML format for configuration. For details, see Understanding ADMX-backed policies.
ADMX mapping:
| Name | Value |
|---|---|
| Name | AppxRuntimeBlockProtocolElevation |
| Friendly Name | Block launching desktop apps associated with a URI scheme |
| Location | Computer and User Configuration |
| Path | Windows Components > App runtime |
| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
| Registry Value Name | BlockProtocolElevation |
| ADMX File Name | AppXRuntime.admx |