diff --git a/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/AdmPwd.admx b/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/AdmPwd.admx
new file mode 100644
index 0000000..2fc8201
--- /dev/null
+++ b/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/AdmPwd.admx
@@ -0,0 +1,63 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/MSS-legacy.admx b/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/MSS-legacy.admx
new file mode 100644
index 0000000..ecede5a
--- /dev/null
+++ b/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/MSS-legacy.admx
@@ -0,0 +1,292 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1
+
+
+ 0
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/SecGuide.admx b/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/SecGuide.admx
new file mode 100644
index 0000000..82894f4
--- /dev/null
+++ b/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/SecGuide.admx
@@ -0,0 +1,547 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ >
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Block all Flash activation
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Block embedded Flash activation only
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Allow all Flash activation
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/en-us/AdmPwd.adml b/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/en-us/AdmPwd.adml
new file mode 100644
index 0000000..5cff00b
--- /dev/null
+++ b/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/en-us/AdmPwd.adml
@@ -0,0 +1,66 @@
+
+
+
+
+
+
+
+ LAPS
+ Enable local admin password management
+
+Enables management of password for local administrator account
+
+If you enable this setting, local administrator password is managed
+
+If you disable or not configure this setting, local administrator password is NOT managed
+
+ Password Settings
+
+Configures password parameters
+
+Password complexity: which characters are used when generating a new password
+ Default: Large letters + small letters + numbers + special characters
+
+Password length
+ Minimum: 8 characters
+ Maximum: 64 characters
+ Default: 14 characters
+
+Password age in days
+ Minimum: 1 day
+ Maximum: 365 days
+ Default: 30 days
+
+ At least Microsoft Windows Vista or Windows Server 2003 family
+ Large letters
+ Large letters + small letters
+ Large letters + small letters + numbers
+ Large letters + small letters + numbers + specials
+ Name of administrator account to manage
+
+Administrator account name: name of the local account you want to manage password for.
+ DO NOT configure when you use built-in admin account. Built-in admin account is auto-detected by well-known SID, even when renamed
+
+ DO configure when you use custom local admin account
+
+ Do not allow password expiration time longer than required by policy
+
+When you enable this setting, planned password expiration longer than password age dictated by "Password Settings" policy is NOT allowed. When such expiration is detected, password is changed immediately and password expiration is set according to policy.
+
+When you disable or not configure this setting, password expiration time may be longer than required by "Password Settings" policy.
+
+
+
+
+ Password Complexity
+ Password Length
+ Password Age (Days)
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/en-us/MSS-legacy.adml b/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/en-us/MSS-legacy.adml
new file mode 100644
index 0000000..ffae14c
--- /dev/null
+++ b/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/en-us/MSS-legacy.adml
@@ -0,0 +1,173 @@
+
+ MSS (Legacy)
+ The legacy "MSS" settings that had been exposed in Secpol, Security Options, using LocalGPO.wsf /ConfigSCE.
+
+
+ MSS (Legacy)
+
+ MSS: (AutoShareWks) Enable Administrative Shares (recommended except for highly secure environments)
+ MSS: (AutoShareWks) Enable Administrative Shares (recommended except for highly secure environments)
+ MSS: (AutoShareServer) Enable Administrative Shares (recommended except for highly secure environments)
+ MSS: (AutoShareServer) Enable Administrative Shares (recommended except for highly secure environments)
+ MSS: (AutoReboot) Allow Windows to automatically restart after a system crash (recommended except for highly secure environments)
+ MSS: (AutoReboot) Allow Windows to automatically restart after a system crash (recommended except for highly secure environments)
+ MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)
+ MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)
+ MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)
+ MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)
+ No additional protection, source routed packets are allowed
+ Medium, source routed packets ignored when IP forwarding is enabled
+ Highest protection, source routing is completely disabled
+ MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)
+ MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)
+ MSS: (DisableSavePassword) Prevent the dial-up passsword from being saved (recommended)
+ MSS: (DisableSavePassword) Prevent the dial-up passsword from being saved (recommended)
+ MSS: (EnableDeadGWDetect) Allow automatic detection of dead network gateways (could lead to DoS)
+ MSS: (EnableDeadGWDetect) Allow automatic detection of dead network gateways (could lead to DoS)
+ MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes
+ MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes
+ MSS: (Hidden) Hide Computer From the Browse List (not recommended except for highly secure environments)
+ MSS: (Hidden) Hide Computer From the Browse List (not recommended except for highly secure environments)
+ MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds
+ MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds
+ 150000 or 2.5 minutes
+ 300000 or 5 minutes (recommended)
+ 600000 or 10 minutes
+ 1200000 or 20 minutes
+ 2400000 or 40 minutes
+ 3600000 or 1 hour
+ 7200000 or 2 hours (default value)
+ MSS: (NoDefaultExempt) Configure IPSec exemptions for various types of network traffic.
+ MSS: (NoDefaultExempt) Configure IPSec exemptions for various types of network traffic.
+ Allow all exemptions (least secure).
+ Multicast, broadcast, & ISAKMP exempt (best for Windows XP).
+ RSVP, Kerberos, and ISAKMP are exempt.
+ Only ISAKMP is exempt (recommended for Windows Server 2003).
+ MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers
+ MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers
+ MSS: (NtfsDisable8dot3NameCreation) Enable the computer to stop generating 8.3 style filenames
+ MSS: (NtfsDisable8dot3NameCreation) Enable the computer to stop generating 8.3 style filenames
+ Enable 8Dot3 Creation on all Volumes
+ Disable 8Dot3 Creation on all Volumes
+ Set 8dot3 name creation per volume using FSUTIL (Windows 7 or later)
+ Disable 8Dot3 name creation on all volumes except system volume (Windows 7 or later)
+ MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)
+ MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)
+ MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)
+ MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)
+ MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)
+ MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)
+ MSS: (SynAttackProtect) Syn attack protection level (protects against DoS)
+ MSS: (SynAttackProtect) Syn attack protection level (protects against DoS)
+ No additional protection, use default settings
+ Connections time out sooner if a SYN attack is detected
+ MSS: (TcpMaxConnectResponseRetransmissions) SYN-ACK retransmissions when a connection request is not acknowledged
+ MSS: (TcpMaxConnectResponseRetransmissions) SYN-ACK retransmissions when a connection request is not acknowledged
+ No retransmission, half-open connections dropped after 3 seconds
+ 3 seconds, half-open connections dropped after 9 seconds
+ 3 & 6 seconds, half-open connections dropped after 21 seconds
+ 3, 6, & 9 seconds, half-open connections dropped after 45 seconds
+ MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)
+ MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)
+ MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)
+ MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)
+ MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning
+ MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning
+ 50%
+ 60%
+ 70%
+ 80%
+ 90%
+
+
+
+
+
+ DisableIPSourceRouting
+
+
+ DisableIPSourceRoutingIPv6
+
+
+ KeepAliveTime
+
+
+ NoDefaultExempt
+
+
+ NtfsDisable8dot3NameCreation
+
+
+ ScreenSaverGracePeriod
+
+
+ SynAttackProtect
+
+
+ TcpMaxConnectResponseRetransmissions
+
+
+ TcpMaxDataRetransmissions
+
+
+ WarningLevel
+
+
+
+
+
+
diff --git a/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/en-us/SecGuide.adml b/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/en-us/SecGuide.adml
new file mode 100644
index 0000000..122f7b4
--- /dev/null
+++ b/ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/en-us/SecGuide.adml
@@ -0,0 +1,213 @@
+
+
+
+ MS Security Guide
+ MS Security Guide mitigations
+
+
+
+ Only Windows 7, Windows Server 2008, Windows Server 2008R2, Windows Server 2012
+ Windows Server 2008 and newer
+
+ MS Security Guide
+ Apply UAC restrictions to local accounts on network logons
+ This setting controls whether local accounts can be used for remote administration via network logon (e.g., NET USE, connecting to C$, etc.). Local accounts are at high risk for credential theft when the same account and password is configured on multiple systems. Enabling this policy significantly reduces that risk.
+
+Enabled (recommended): Applies UAC token-filtering to local accounts on network logons. Membership in powerful group such as Administrators is disabled and powerful privileges are removed from the resulting access token. This configures the LocalAccountTokenFilterPolicy registry value to 0. This is the default behavior for Windows.
+
+Disabled: Allows local accounts to have full administrative rights when authenticating via network logon, by configuring the LocalAccountTokenFilterPolicy registry value to 1.
+
+For more information about local accounts and credential theft, see "Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques": http://www.microsoft.com/en-us/download/details.aspx?id=36036.
+
+For more information about LocalAccountTokenFilterPolicy, see http://support.microsoft.com/kb/951016.
+
+ WDigest Authentication (disabling may require KB2871997)
+ When WDigest authentication is enabled, Lsass.exe retains a copy of the user's plaintext password in memory, where it can be at risk of theft. Microsoft recommends disabling WDigest authentication unless it is needed.
+
+If this setting is not configured, WDigest authentication is disabled in Windows 8.1 and in Windows Server 2012 R2; it is enabled by default in earlier versions of Windows and Windows Server.
+
+Update KB2871997 must first be installed to disable WDigest authentication using this setting in Windows 7, Windows 8, Windows Server 2008 R2 and Windows Server 2012.
+
+Enabled: Enables WDigest authentication.
+
+Disabled (recommended): Disables WDigest authentication. For this setting to work on Windows 7, Windows 8, Windows Server 2008 R2 or Windows Server 2012, KB2871997 must first be installed.
+
+For more information, see http://support.microsoft.com/kb/2871997 and http://blogs.technet.com/b/srd/archive/2014/06/05/an-overview-of-kb2871997.aspx .
+
+ Lsass.exe audit mode
+ Enable auditing of Lsass.exe to evaluate feasibility of enabling LSA protection. For more information, see http://technet.microsoft.com/en-us/library/dn408187.aspx
+ LSA Protection
+ Enable LSA protection. For more information, see http://technet.microsoft.com/en-us/library/dn408187.aspx
+ Remove "Run As Different User" from context menus
+ This setting controls whether "Run As Different User" appears on the Shift+RightClick context menu for .bat, .cmd, .exe, and .msc files.
+
+Enabled (recommended): Keeps "Run As Different User" from appearing in the context menu when the user holds Shift while right-clicking on a .bat, .cmd, .exe, or .msc file in Explorer.
+
+Disabled: Restores the Windows default behavior for "Run As Different User."
+
+
+ Turn on Windows Defender protection against Potentially Unwanted Applications (DEPRECATED)
+ Beginning with Windows 10 v1809 and Windows Server v1809, this functionality should instead be configured through the following Group Policy setting:
+Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Configure detection for potentially unwanted applications.
+
+
+ Enable Structured Exception Handling Overwrite Protection (SEHOP)
+ If this setting is enabled, SEHOP is enforced. For more information, see https://support.microsoft.com/en-us/help/956607/how-to-enable-structured-exception-handling-overwrite-protection-sehop-in-windows-operating-systems.
+
+If this setting is disabled or not configured, SEHOP is not enforced for 32-bit processes.
+
+ Limits print driver installation to Administrators
+
+Determines whether users that aren't Administrator can install print drivers on this computer.
+
+By default, users that aren't Administrators can't install print drivers on this computer.
+
+If you enable this setting or do not configure it, the system will limit installation of print drivers to Administrators of this computer.
+
+If you disable this setting, the system will not limit installation of print drivers to this computer.
+
+Additional Information: https://support.microsoft.com/en-us/topic/kb5005010-restricting-installation-of-new-printer-drivers-after-applying-the-july-6-2021-updates-31b91c02-05bc-4ada-a7ea-183b129578a7 for additional information.
+
+ Configure SMB v1 server
+ Disabling this setting disables server-side processing of the SMBv1 protocol. (Recommended.)
+
+Enabling this setting enables server-side processing of the SMBv1 protocol. (Default.)
+
+Changes to this setting require a reboot to take effect.
+
+For more information, see https://support.microsoft.com/kb/2696547
+
+ Configure SMB v1 client driver
+ Configures the SMB v1 client driver's start type.
+
+To disable client-side processing of the SMBv1 protocol, select the "Enabled" radio button, then select "Disable driver" from the dropdown.
+WARNING: DO NOT SELECT THE "DISABLED" RADIO BUTTON UNDER ANY CIRCUMSTANCES!
+
+For Windows 7 and Servers 2008, 2008R2, and 2012, you must also configure the "Configure SMB v1 client (extra setting needed for pre-Win8.1/2012R2)" setting.
+
+To restore default SMBv1 client-side behavior, select "Enabled" and choose the correct default from the dropdown:
+* "Manual start" for Windows 7 and Windows Servers 2008, 2008R2, and 2012;
+* "Automatic start" for Windows 8.1 and Windows Server 2012R2 and newer.
+
+Changes to this setting require a reboot to take effect.
+
+For more information, see https://support.microsoft.com/kb/2696547
+
+ Configure SMB v1 client (extra setting needed for pre-Win8.1/2012R2)
+ APPLIES ONLY TO: Windows 7 and Windows Servers 2008, 2008R2 and 2012 (NOT 2012R2):
+
+To disable client-side processing of the SMBv1 protocol (recommended), do ALL of the following:
+* Set the SMBv1 client driver to "Disable driver" using the "Configure SMB v1 client driver" setting;
+* Enable this setting;
+* In the "Configure LanmanWorkstation dependencies" text box, enter the following three lines of text:
+Bowser
+MRxSmb20
+NSI
+
+To restore the default behavior for client-side SMBv1 protocol processing, do ALL of the following:
+* Set the SMBv1 client driver to "Manual start" using the "Configure SMB v1 client driver" setting;
+* Enable this setting;
+* In the "Configure LanmanWorkstation dependencies" text box, enter the following four lines of text:
+Bowser
+MRxSmb10
+MRxSmb20
+NSI
+
+WARNING: DO NOT SELECT THE "DISABLED" RADIO BUTTON UNDER ANY CIRCUMSTANCES!
+
+Changes to this setting require a reboot to take effect.
+
+For more information, see https://support.microsoft.com/kb/2696547
+
+ Disable driver (recommended)
+ Manual start (default for Win7/2008/2008R2/2012)
+ Automatic start (default for Win8.1/2012R2/newer)
+
+
+
+NetBT NodeType configuration
+The NetBT NodeType setting determines what methods NetBT uses to register and resolve names:
+* A B-node computer uses broadcasts.
+* A P-node computer uses only point-to-point name queries to a name server (WINS).
+* An M-node computer broadcasts first, and then queries the name server.
+* An H-node computer queries the name server first, and then broadcasts.
+Resolution through LMHOSTS or DNS follows these methods. If the NodeType value is present, it overrides any DhcpNodeType value.
+If neither NodeType nor DhcpNodeType is present, the computer uses B-node if there are no WINS servers configured for the network, or H-node if there is at least one WINS server configured.
+
+B-node
+P-node (recommended)
+M-node
+H-node
+
+
+
+Extended Protection for LDAP Authentication (Domain Controllers only) (DEPRECATED)
+Beginning with the Windows 10 and Windows Server v2004 security baseline this setting has been moved to Security Options\Domain controller: LDAP server channel binding token requirements.
+
+Enabled, always (recommended)
+Enabled, when supported
+Disabled
+
+
+ Block Flash activation in Office documents
+ This policy setting controls whether the Adobe Flash control can be activated by Office documents. Note that activation blocking applies only within Office processes.
+
+If you enable this policy setting, you can choose from three options to control whether and how Flash is blocked from activation:
+
+1. "Block all activation" prevents the Flash control from being loaded, whether directly referenced by the document or indirectly by another embedded object.
+
+2. "Block embedding/linking, allow other activation" prevents the Flash control from being loaded when directly referenced by the document, but does not prevent activation through another object.
+
+3. "Allow all activation" restores Office's default behavior, allowing the Flash control to be activated.
+
+Because this setting is not a true Group Policy setting and "tattoos" the registry, enabling the "Allow all activation" option is the only way to restore default behavior after either of the "Block" options has been applied. We do not recommend configuring this setting to "Disabled," nor to "Not Configured" after it has been enabled.
+
+ Block all activation
+ Block embedding/linking, allow other activation
+ Allow all activation
+ Restrict legacy JScript execution for Office
+ This policy setting controls JScript execution per Security Zone within Internet Explorer and WebBrowser Control (WebOC) for Office applications.
+
+It's important to determine whether legacy JScript is being used to provide business-critical functionality before you enable this setting.
+
+If Enabled, Office applications will not execute legacy JScript for the Internet or Restricted Sites zones and users aren’t notified by the application that legacy JScript execution is restricted. Modern JScript9 will continue to function for all zones.
+
+If Disabled or Not Configured JScript will function without any restrictions.
+
+The values are set in hexadecimal and should be converted prior to changing the setting value. To learn more about Internet Explorer Feature Control Key and the Restrict JScript process-level policy for Windows, please refer to: https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330734(v=vs.85)#restrict-jscript-at-a-process-level
+
+
+
+
+
+
+ Configure MrxSmb10 driver
+
+
+ Configure LanmanWorkstation dependencies
+
+
+ Configure NetBT NodeType
+
+
+ Configure LdapEnforceChannelBinding
+
+
+ Block Flash player in Office
+
+
+ Excel:
+ Publisher:
+ PowerPoint:
+ OneNote:
+ Visio:
+ Project:
+ Word:
+ Outlook:
+ Access:
+
+
+
+
+
+