adam/windows-ansible
1
0 Fork 0
mirror of https://git.ecdf.ed.ac.uk/win_automation/windows-ansible.git synced 2026-10-31 17:20:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

cleanup file

Browse Source
This commit is contained in:
abrown38 committed 2024-04-08 18:41:49 +00:00
1 parent 3031cb4b47
commit 86276aa8a3
481 files changed
+125722 -16
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

policy_templates/en-US/AVSValidationGP.adml
+27
View File
@@ -0,0 +1,27 @@
<?xml version="1.0" encoding="utf-8"?>
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Licensing Group Policy</displayName>
<description>Licensing Group Policy</description>
<resources>
<stringTable>
<string id="NoAcquireGT">Turn off KMS Client Online AVS Validation</string>
<string id="NoAcquireGT_Help">
This policy setting lets you opt-out of sending KMS client activation data to Microsoft automatically. Enabling this setting prevents this computer from sending data to Microsoft regarding its activation state.
If you disable or do not configure this policy setting, KMS client activation data will be sent to Microsoft services when this device activates.
Policy Options:
- Not Configured (default -- data will be automatically sent to Microsoft)
- Disabled (data will be automatically sent to Microsoft)
- Enabled (data will not be sent to Microsoft)
</string>
<string id="AllowWindowsEntitlementReactivation">Control Device Reactivation for Retail devices</string>
<string id="AllowWindowsEntitlementReactivation_Help">
This policy setting controls whether OS Reactivation is blocked on a device.
Policy Options:
- Not Configured (default -- Windows registration and reactivation is allowed)
- Disabled (Windows registration and reactivation is not allowed)
- Enabled (Windows registration is allowed)
</string>
<string id="SoftwareProtectionPlatform">Software Protection Platform</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/AccountNotifications.adml
+23
View File
@@ -0,0 +1,23 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2015 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="AccountNotifications">Account Notifications</string>
<string id="DisableAccountNotifications">Turn off account notifications in Start</string>
<string id="DisableAccountNotificationsExplain">
This policy allows you to prevent Windows from displaying notifications to Microsoft account (MSA) and local users in Start (user tile).
Notifications include getting users to: reauthenticate; backup their device; manage cloud storage quotas as well as manage their Microsoft 365 or XBOX subscription.
If you enable this policy setting, Windows will not send account related notifications for local and MSA users to the user tile in Start.
If you disable or do not configure this policy setting, Windows will send account related notifications for local and MSA users to the user tile in Start.
No reboots or service restarts are required for this policy setting to take effect.
</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/ActiveXInstallService.adml
+77
View File
@@ -0,0 +1,77 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>ActiveX Installer Service</displayName>
<description>Installs ActiveX controls from approved installation sites</description>
<resources>
<stringTable>
<string id="AxInstSv">ActiveX Installer Service</string>
<string id="AxISURLZonePolicies">Establish ActiveX installation policy for sites in Trusted zones</string>
<string id="AxISURLZonePolicies_explain">This policy setting controls the installation of ActiveX controls for sites in Trusted zone.
If you enable this policy setting, ActiveX controls are installed according to the settings defined by this policy setting.
If you disable or do not configure this policy setting, ActiveX controls prompt the user before installation.
If the trusted site uses the HTTPS protocol, this policy setting can also control how ActiveX Installer Service responds to certificate errors. By default all HTTPS connections must supply a server certificate that passes all validation criteria. If you are aware that a trusted site has a certificate error but you want to trust it anyway you can select the certificate errors that you want to ignore.
Note: This policy setting applies to all sites in Trusted zones.
</string>
<string id="TrustedZoneDisabled">Don't install</string>
<string id="TrustedZonePrompt">Prompt the user</string>
<string id="TrustedZoneSilentInstall">Silently install</string>
<string id="ApprovedActiveXInstallSites">Approved Installation Sites for ActiveX Controls</string>
<string id="ApprovedActiveXInstallSites_explain">This policy setting determines which ActiveX installation sites standard users in your organization can use to install ActiveX controls on their computers. When this setting is enabled, the administrator can create a list of approved Activex Install sites specified by host URL.
If you enable this setting, the administrator can create a list of approved ActiveX Install sites specified by host URL.
If you disable or do not configure this policy setting, ActiveX controls prompt the user for administrative credentials before installation.
Note: Wild card characters cannot be used when specifying the host URLs.
</string>
</stringTable>
<presentationTable>
<presentation id="AxISURLZonePolicies">
<dropdownList refId="InstallTrustedOCX" noSort="true" defaultItem="2">Installation Policy for ActiveX control signed by trusted publisher</dropdownList>
<dropdownList refId="InstallSignedOCX" noSort="true" defaultItem="1">Installation Policy for signed ActiveX control</dropdownList>
<dropdownList refId="InstallUnSignedOCX" noSort="true" defaultItem="0">Installation Policy for unsigned ActiveX control</dropdownList>
<text>Permit connection to trusted sites with the following server certificate errors.</text>
<checkBox refId="IgnoreUnknownCA" defaultChecked="false">Unknown certifcation authority (CA)</checkBox>
<checkBox refId="IgnoreInvalidCN" defaultChecked="false">Invalid certificate name (CN)</checkBox>
<checkBox refId="IgnoreInvalidCertDate" defaultChecked="false">Expired certificate validation date</checkBox>
<checkBox refId="IgnoreWrongCertUsage" defaultChecked="false">Wrong certificate usage</checkBox>
</presentation>
<presentation id="ApprovedActiveXInstallSites">
<listBox refId="ApprovedActiveXInstallSiteslist">Host URLs</listBox>
<text>Contains policy for the host URL.</text>
<text>For example </text>
<text>HostName: http://activex.microsoft.com</text>
<text>Value: 2,1,0,0</text>
<text>The value for each Host URL is four settings in CSV format.</text>
<text>Which represents "TPSSignedControl,SignedControl,UnsignedControl,ServerCertificatePolicy</text>
<text>The three left most values in the policy control the installation of ActiveX controls based on their signature.</text>
<text>They can be one of the following.</text>
<text>0: ActiveX control will not be installed</text>
<text>1: Prompt the user to install ActiveX control</text>
<text>2: ActiveX control will be silently installed</text>
<text>Controls signed by certificates in trusted publisher store will be silently installed </text>
<text>Silent installation for unsigned controls is not supported</text>
<text></text>
<text>The right most value in the policy is a bitmasked flag</text>
<text>The flags are used for ignoring https certificate errors.</text>
<text>The default value is 0.</text>
<text>Which means that the https connections must pass all security checks</text>
<text></text>
<text>Use the combination of the following values</text>
<text>to ignore invalid certificate errors</text>
<text>0x00000100 Ignore Unknown CA</text>
<text>0x00001000 Ignore invalid CN</text>
<text>0x00002000 Ignore invalid certificate date</text>
<text>0x00000200 Ignore wrong certificate usage</text>
<text></text>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/AddRemovePrograms.adml
+124
View File
@@ -0,0 +1,124 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="Arp">Add or Remove Programs</string>
<string id="DefaultCategory">Specify default category for Add New Programs</string>
<string id="DefaultCategory_Help">Specifies the category of programs that appears when users open the "Add New Programs" page.
If you enable this setting, only the programs in the category you specify are displayed when the "Add New Programs" page opens. Users can use the Category box on the "Add New Programs" page to display programs in other categories.
To use this setting, type the name of a category in the Category box for this setting. You must enter a category that is already defined in Add or Remove Programs. To define a category, use Software Installation.
If you disable this setting or do not configure it, all programs (Category: All) are displayed when the "Add New Programs" page opens.
You can use this setting to direct users to the programs they are most likely to need.
Note: This setting is ignored if either the "Remove Add or Remove Programs" setting or the "Hide Add New Programs page" setting is enabled.</string>
<string id="NoAddFromCDorFloppy">Hide the "Add a program from CD-ROM or floppy disk" option</string>
<string id="NoAddFromCDorFloppy_Help">Removes the "Add a program from CD-ROM or floppy disk" section from the Add New Programs page. This prevents users from using Add or Remove Programs to install programs from removable media.
If you disable this setting or do not configure it, the "Add a program from CD-ROM or floppy disk" option is available to all users.
This setting does not prevent users from using other tools and methods to add or remove program components.
Note: If the "Hide Add New Programs page" setting is enabled, this setting is ignored. Also, if the "Prevent removable media source for any install" setting (located in User Configuration\Administrative Templates\Windows Components\Windows Installer) is enabled, users cannot add programs from removable media, regardless of this setting.</string>
<string id="NoAddFromInternet">Hide the "Add programs from Microsoft" option</string>
<string id="NoAddFromInternet_Help">Removes the "Add programs from Microsoft" section from the Add New Programs page. This setting prevents users from using Add or Remove Programs to connect to Windows Update.
If you disable this setting or do not configure it, "Add programs from Microsoft" is available to all users.
This setting does not prevent users from using other tools and methods to connect to Windows Update.
Note: If the "Hide Add New Programs page" setting is enabled, this setting is ignored.</string>
<string id="NoAddFromNetwork">Hide the "Add programs from your network" option</string>
<string id="NoAddFromNetwork_Help">Prevents users from viewing or installing published programs.
This setting removes the "Add programs from your network" section from the Add New Programs page. The "Add programs from your network" section lists published programs and provides an easy way to install them.
Published programs are those programs that the system administrator has explicitly made available to the user with a tool such as Windows Installer. Typically, system administrators publish programs to notify users that the programs are available, to recommend their use, or to enable users to install them without having to search for installation files.
If you enable this setting, users cannot tell which programs have been published by the system administrator, and they cannot use Add or Remove Programs to install published programs. However, they can still install programs by using other methods, and they can view and install assigned (partially installed) programs that are offered on the desktop or on the Start menu.
If you disable this setting or do not configure it, "Add programs from your network" is available to all users.
Note: If the "Hide Add New Programs page" setting is enabled, this setting is ignored.</string>
<string id="NoAddPage">Hide Add New Programs page</string>
<string id="NoAddPage_Help">Removes the Add New Programs button from the Add or Remove Programs bar. As a result, users cannot view or change the attached page.
The Add New Programs button lets users install programs published or assigned by a system administrator.
If you disable this setting or do not configure it, the Add New Programs button is available to all users.
This setting does not prevent users from using other tools and methods to install programs.</string>
<string id="NoAddRemovePrograms">Remove Add or Remove Programs</string>
<string id="NoAddRemovePrograms_Help">Prevents users from using Add or Remove Programs.
This setting removes Add or Remove Programs from Control Panel and removes the Add or Remove Programs item from menus.
Add or Remove Programs lets users install, uninstall, repair, add, and remove features and components of Windows 2000 Professional and a wide variety of Windows programs. Programs published or assigned to the user appear in Add or Remove Programs.
If you disable this setting or do not configure it, Add or Remove Programs is available to all users.
When enabled, this setting takes precedence over the other settings in this folder.
This setting does not prevent users from using other tools and methods to install or uninstall programs.</string>
<string id="NoChooseProgramsPage">Hide the Set Program Access and Defaults page</string>
<string id="NoChooseProgramsPage_Help">Removes the Set Program Access and Defaults button from the Add or Remove Programs bar. As a result, users cannot view or change the associated page.
The Set Program Access and Defaults button lets administrators specify default programs for certain activities, such as Web browsing or sending e-mail, as well as which programs are accessible from the Start menu, desktop, and other locations.
If you disable this setting or do not configure it, the Set Program Access and Defaults button is available to all users.
This setting does not prevent users from using other tools and methods to change program access or defaults.
This setting does not prevent the Set Program Access and Defaults icon from appearing on the Start menu. See the "Remove Set Program Access and Defaults from Start menu" setting.</string>
<string id="NoRemovePage">Hide Change or Remove Programs page</string>
<string id="NoRemovePage_Help">Removes the Change or Remove Programs button from the Add or Remove Programs bar. As a result, users cannot view or change the attached page.
The Change or Remove Programs button lets users uninstall, repair, add, or remove features of installed programs.
If you disable this setting or do not configure it, the Change or Remove Programs page is available to all users.
This setting does not prevent users from using other tools and methods to delete or uninstall programs.</string>
<string id="NoServices">Go directly to Components Wizard</string>
<string id="NoServices_Help">Prevents users from using Add or Remove Programs to configure installed services.
This setting removes the "Set up services" section of the Add/Remove Windows Components page. The "Set up services" section lists system services that have not been configured and offers users easy access to the configuration tools.
If you disable this setting or do not configure it, "Set up services" appears only when there are unconfigured system services. If you enable this setting, "Set up services" never appears.
This setting does not prevent users from using other methods to configure services.
Note: When "Set up services" does not appear, clicking the Add/Remove Windows Components button starts the Windows Component Wizard immediately. Because the only remaining option on the Add/Remove Windows Components page starts the wizard, that option is selected automatically, and the page is bypassed.
To remove "Set up services" and prevent the Windows Component Wizard from starting, enable the "Hide Add/Remove Windows Components page" setting. If the "Hide Add/Remove Windows Components page" setting is enabled, this setting is ignored.</string>
<string id="NoSupportInfo">Remove Support Information</string>
<string id="NoSupportInfo_Help">Removes links to the Support Info dialog box from programs on the Change or Remove Programs page.
Programs listed on the Change or Remove Programs page can include a "Click here for support information" hyperlink. When clicked, the hyperlink opens a dialog box that displays troubleshooting information, including a link to the installation files and data that users need to obtain product support, such as the Product ID and version number of the program. The dialog box also includes a hyperlink to support information on the Internet, such as the Microsoft Product Support Services Web page.
If you disable this setting or do not configure it, the Support Info hyperlink appears.
Note: Not all programs provide a support information hyperlink.</string>
<string id="NoWindowsSetupPage">Hide Add/Remove Windows Components page</string>
<string id="NoWindowsSetupPage_Help">Removes the Add/Remove Windows Components button from the Add or Remove Programs bar. As a result, users cannot view or change the associated page.
The Add/Remove Windows Components button lets users configure installed services and use the Windows Component Wizard to add, remove, and configure components of Windows from the installation files.
If you disable this setting or do not configure it, the Add/Remove Windows Components button is available to all users.
This setting does not prevent users from using other tools and methods to configure services or add or remove program components. However, this setting blocks user access to the Windows Component Wizard.</string>
</stringTable>
<presentationTable>
<presentation id="DefaultCategory">
<textBox refId="DefaultCategoryBox">
<label>Category:</label>
</textBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/AllowBuildPreview.adml
+18
View File
@@ -0,0 +1,18 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="AllowBuildPreview">Toggle user control over Insider builds</string>
<string id="AllowBuildPreview_Explain">This policy setting determines whether users can get preview builds of Windows, by configuring controls in Settings &gt; Update and security &gt; Windows Insider Program.
If you enable or do not configure this policy setting, users can download and install preview builds of Windows by configuring Windows Insider Program settings.
If you disable this policy setting, Windows Insider Program settings will be unavailable to users through the Settings app.
This policy is only supported up to Windows 10, Version 1703. Please use 'Manage preview builds' under 'Windows Update for Business' for newer Windows 10 versions.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/AppCompat.adml
+92
View File
@@ -0,0 +1,92 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="AppCompat">Application Compatibility</string>
<string id="AppCompat_Prevent16BitMach_Help">Specifies whether to prevent the MS-DOS subsystem (ntvdm.exe) from running on this computer. This setting affects the launching of 16-bit applications in the operating system.
You can use this setting to turn off the MS-DOS subsystem, which will reduce resource usage and prevent users from running 16-bit applications. To run any 16-bit application or any application with 16-bit components, ntvdm.exe must be allowed to run. The MS-DOS subsystem starts when the first 16-bit application is launched. While the MS-DOS subsystem is running, any subsequent 16-bit applications launch faster, but overall resource usage on the system is increased.
If the status is set to Enabled, the MS-DOS subsystem is prevented from running, which then prevents any 16-bit applications from running. In addition, any 32-bit applications with 16-bit installers or other 16-bit components cannot run.
If the status is set to Disabled, the MS-DOS subsystem runs for all users on this computer.
If the status is set to Not Configured, the OS falls back on a local policy set by the registry DWORD value HKLM\System\CurrentControlSet\Control\WOW\DisallowedPolicyDefault. If that value is non-0, this prevents all 16-bit applications from running. If that value is 0, 16-bit applications are allowed to run. If that value is also not present, on Windows 10 and above the OS will launch the 16-bit application support control panel to allow an elevated administrator to make the decision; on windows 7 and downlevel, the OS will allow 16-bit applications to run.
Note: This setting appears in only Computer Configuration.</string>
<string id="AppCompat_RemoveProgramCompatPropPage_Help">This policy controls the visibility of the Program Compatibility property page shell extension. This shell extension is visible on the property context-menu of any program shortcut or executable file.
The compatibility property page displays a list of options that can be selected and applied to the application to resolve the most common issues affecting legacy applications. Enabling this policy setting removes the property page from the context-menus, but does not affect previous compatibility settings applied to application using this interface.</string>
<string id="AppCompat_TurnOffApplicationImpactTelemetry_Help">The policy controls the state of the Application Telemetry engine in the system.
Application Telemetry is a mechanism that tracks anonymous usage of specific Windows system components by applications.
Turning Application Telemetry off by selecting "enable" will stop the collection of usage data.
If the customer Experience Improvement program is turned off, Application Telemetry will be turned off regardless of how this policy is set.
Disabling telemetry will take effect on any newly launched applications. To ensure that telemetry collection has stopped for all applications, please reboot your machine.</string>
<string id="AppCompat_TurnOffEngine_Help"> This policy controls the state of the application compatibility engine in the system.
The engine is part of the loader and looks through a compatibility database every time an application is started on the system. If a match for the application is found it provides either run-time solutions or compatibility fixes, or displays an Application Help message if the application has a know problem.
Turning off the application compatibility engine will boost system performance. However, this will degrade the compatibility of many popular legacy applications, and will not block known incompatible applications from installing. (For Instance: This may result in a blue screen if an old anti-virus application is installed.)
The Windows Resource Protection and User Account Control features of Windows use the application compatibility engine to provide mitigations for application problems. If the engine is turned off, these mitigations will not be applied to applications and their installers and these applications may fail to install or run properly.
This option is useful to server administrators who require faster performance and are aware of the compatibility of the applications they are using. It is particularly useful for a web server where applications may be launched several hundred times a second, and the performance of the loader is essential.
NOTE: Many system processes cache the value of this setting for performance reasons. If you make changes to this setting, please reboot to ensure that your system accurately reflects those changes.</string>
<string id="AppCompat_TurnOffProgramCompatibilityAssistant_Help">This policy setting controls the state of the Program Compatibility Assistant (PCA).
The PCA monitors applications run by the user. When a potential compatibility issue with an application is detected, the PCA will prompt the user with recommended solutions. To configure the diagnostic settings for the PCA, go to System-&gt;Troubleshooting and Diagnostics-&gt;Application Compatibility Diagnostics.
If you enable this policy setting, the PCA will be turned off. The user will not be presented with solutions to known compatibility issues when running applications. Turning off the PCA can be useful for system administrators who require better performance and are already aware of application compatibility issues.
If you disable or do not configure this policy setting, the PCA will be turned on. To configure the diagnostic settings for the PCA, go to System-&gt;Troubleshooting and Diagnostics-&gt;Application Compatibility Diagnostics.
Note: The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to run. These services can be configured by using the Services snap-in to the Microsoft Management Console.</string>
<string id="AppCompat_TurnOffProgramCompatibilityAssistant_Help_User">This setting exists only for backward compatibility, and is not valid for this version of Windows. To configure the Program Compatibility Assistant, use the 'Turn off Program Compatibility Assistant' setting under Computer Configuration\Administrative Templates\Windows Components\Application Compatibility.</string>
<string id="AppCompat_TurnOffUserActionRecord_Help">This policy setting controls the state of Steps Recorder.
Steps Recorder keeps a record of steps taken by the user. The data generated by Steps Recorder can be used in feedback systems such as Windows Error Reporting to help developers understand and fix problems. The data includes user actions such as keyboard input and mouse input, user interface data, and screen shots. Steps Recorder includes an option to turn on and off data collection.
If you enable this policy setting, Steps Recorder will be disabled.
If you disable or do not configure this policy setting, Steps Recorder will be enabled.</string>
<string id="AppCompat_TurnOffSwitchBack_Help">The policy controls the state of the Switchback compatibility engine in the system.
Switchback is a mechanism that provides generic compatibility mitigations to older applications by providing older behavior to old applications and new behavior to new applications.
Switchback is on by default.
If you enable this policy setting, Switchback will be turned off. Turning Switchback off may degrade the compatibility of older applications. This option is useful for server administrators who require performance and are aware of compatibility of the applications they are using.
If you disable or do not configure this policy setting, the Switchback will be turned on.
Please reboot the system after changing the setting to ensure that your system accurately reflects those changes.</string>
<string id="AppCompat_TurnOffProgramInventory_Help">This policy setting controls the state of the Inventory Collector.
The Inventory Collector inventories applications, files, devices, and drivers on the system and sends the information to Microsoft. This information is used to help diagnose compatibility problems.
If you enable this policy setting, the Inventory Collector will be turned off and data will not be sent to Microsoft. Collection of installation data through the Program Compatibility Assistant is also disabled.
If you disable or do not configure this policy setting, the Inventory Collector will be turned on.
Note: This policy setting has no effect if the Customer Experience Improvement Program is turned off. The Inventory Collector will be off.</string>
<string id="AppCompatPrevent16Bit">Prevent access to 16-bit applications</string>
<string id="AppCompatPrevent16BitMach">Prevent access to 16-bit applications</string>
<string id="AppCompatRemoveProgramCompatPropPage">Remove Program Compatibility Property Page</string>
<string id="AppCompatTurnOffApplicationImpactTelemetry">Turn off Application Telemetry</string>
<string id="AppCompatTurnOffEngine">Turn off Application Compatibility Engine</string>
<string id="AppCompatTurnOffProgramCompatibilityAssistant">Turn off Program Compatibility Assistant</string>
<string id="AppCompatTurnOffSwitchBack">Turn off SwitchBack Compatibility Engine</string>
<string id="AppCompatTurnOffUserActionRecord">Turn off Steps Recorder</string>
<string id="AppCompatTurnOffProgramInventory">Turn off Inventory Collector</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/AppHVSI.adml
+169
View File
@@ -0,0 +1,169 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Microsoft Defender Application Guard</displayName>
<description>Turn on Microsoft Defender Application Guard in Managed Mode</description>
<resources>
<stringTable>
<string id="AppHVSICat_DisplayName">Microsoft Defender Application Guard</string>
<string id="AppHVSI_AllowAppHVSI_DisplayName">Turn on Microsoft Defender Application Guard in Managed Mode</string>
<string id="AppHVSI_AllowAppHVSI_Explain">This policy setting enables application isolation through Microsoft Defender Application Guard.
Application Guard uses Windows Hypervisor to create a virtualized environment for apps that are configured to use virtualization-based security isolation. While in isolation, improper user interactions and app vulnerabilities can’t compromise the kernel or any other apps running outside of the virtualized environment.
If you enable this setting, Application Guard is turned on for your organization.
</string>
<string id="AppHVSI_ClipboardSettings_DisplayName">Configure Microsoft Defender Application Guard clipboard settings</string>
<string id="AppHVSI_ClipboardSettings_Explain">This policy setting allows you to decide how the clipboard behaves while in Microsoft Defender Application Guard.
If you enable this setting, you must choose from the following behaviors:
- Disable clipboard functionality completely between the host and Application Guard
- Enable the clipboard to copy content from Application Guard to the host
- Enable the clipboard to copy content from the host to Application Guard.
Note:
We recommend that you don't enable copying from the host to Application Guard. If you enable this functionality, a potentially compromised Application Guard session will have access to the host device’s clipboard and its content.
If you choose to enable copying, you must also choose the type of content that can be copied, by using the content options:
- 1. Allows text copying.
- 2. Allows image copying.
- 3. Allows both text and image copying.
If you disable or don't configure this setting, all clipboard functionality is turned off in Application Guard.
</string>
<string id="AppHVSI_ClipboardSettings_DropdownList_Option_OperationDisabled">Block clipboard operations(default)</string>
<string id="AppHVSI_ClipboardSettings_DropdownList_Option_ContainerToHostEnabled">Enable clipboard operation from an isolated session to the host</string>
<string id="AppHVSI_ClipboardSettings_DropdownList_Option_HostToContainerEnabled">Enable clipboard operation from an host to the isolated session</string>
<string id="AppHVSI_ClipboardSettings_DropdownList_Option_BothDirectionsEnabled">Enable clipboard operation both directions</string>
<string id="AppHVSI_PrintingSettings_DisplayName">Configure Microsoft Defender Application Guard print settings</string>
<string id="AppHVSI_PrintingSettings_Explain">This policy setting allows you to decide how the print functionality behaves while in Microsoft Defender Application Guard.
If you enable this setting, you must choose one or many of the following behaviors:
- Disable all print functionality in Application Guard.
- Enable printing to existing network printers.
- Enable printing to local printers.
- Enable printing to PDF, allows people to print as PDF and save the resulting file on the host.
- Enable printing to XPS, allows people to print as XPS and save the resulting file on the host.
If you disable or don't configure this setting, all print functionality is turned off in Application Guard.
</string>
<string id="AppHVSI_CertificateThumbprints_DisplayName">Allow Microsoft Defender Application Guard to use Root Certificate Authorities from the user’s device</string>
<string id="AppHVSI_CertificateThumbprints_Explain">This policy setting allows certain device level Root Certificates to be shared with the Microsoft Defender Application Guard container.
If you enable this setting, certificates with a thumbprint matching the ones specified will be transferred into the container. Multiple certificates can be specified by using a comma to separate the thumbprints for each certificate you want to transfer.
If you disable or don’t configure this setting, certificates are not shared with the Microsoft Defender Application Guard container.
Example: b4e72779a8a362c860c36a6461f31e3aa7e58c14,1b1d49f06d2a697a544a1059bd59a7b058cda924
</string>
<string id="AppHVSI_BlockNonEnterpriseContent_DisplayName">Prevent enterprise websites from loading non-enterprise content in Microsoft Edge and Internet Explorer</string>
<string id="AppHVSI_BlockNonEnterpriseContent_Explain">This policy setting allows you to decide whether websites can load non-enterprise content in Microsoft Edge and Internet Explorer.
If you enable this setting, non-enterprise content embedded on enterprise sites are stopped from opening in Internet Explorer or Microsoft Edge outside of Microsoft Defender Application Guard.
If you disable or don't configure this setting, non-enterprise sites can open outside of the Microsoft Defender Application Guard container, directly in Internet Explorer and Microsoft Edge.
</string>
<string id="AppHVSI_AllowCameraMicrophoneRedirection_DisplayName">Allow camera and microphone access in Microsoft Defender Application Guard</string>
<string id="AppHVSI_AllowCameraMicrophoneRedirection_Explain">The policy allows you to determine whether applications inside Microsoft Defender Application Guard can access the device’s camera and microphone when these settings are enabled on the user’s device.
If you enable this policy, applications inside Microsoft Defender Application Guard will be able to access the camera and microphone on the user’s device.
If you disable or don't configure this policy, applications inside Microsoft Defender Application Guard will be unable to access the camera and microphone on the user’s device.
Important: If you turn on this policy, a compromised container could bypass camera and microphone permissions and access the camera and microphone without the user’s knowledge. To prevent unauthorized access, we recommend that camera and microphone privacy settings be turned off on the user’s device when they are not needed.
</string>
<string id="AppHVSI_AllowPersistence_DisplayName">Allow data persistence for Microsoft Defender Application Guard</string>
<string id="AppHVSI_AllowPersistence_Explain">This policy setting allows you to decide whether data should persist across different sessions in Microsoft Defender Application Guard.
If you enable this setting, Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.
Note:
If you enable this setting, you can still delete a user's data from a specific device using the Reset-ApplicationGuard PowerShell command. Running this command deletes all employee data, regardless of configuration, and can result in data loss for the employee.
If you disable or don't configure this setting, Application Guard deletes all user data within the Application Guard container.
</string>
<string id="AppHVSI_AllowVirtualGPU_DisplayName">Allow hardware-accelerated rendering for Microsoft Defender Application Guard</string>
<string id="AppHVSI_AllowVirtualGPU_Explain">This policy setting determines whether Microsoft Defender Application Guard renders graphics using hardware or software acceleration.
If you enable this setting, Microsoft Defender Application Guard uses Hyper-V to access supported, high-security rendering graphics hardware (GPUs). These GPUs improve rendering performance and battery life while using Microsoft Defender Application Guard, particularly for video playback and other graphics-intensive use cases. If you enable this setting without connecting any high-security rendering graphics hardware, Microsoft Defender Application Guard will automatically revert to software-based (CPU) rendering.
Note:
Be aware that enabling this setting with potentially compromised graphics devices or drivers might pose a risk to the host device.
If you disable or don’t configure this setting, Microsoft Defender Application Guard uses software-based (CPU) rendering and won’t load any third-party graphics drivers or interact with any connected graphics hardware.
</string>
<string id="AppHVSI_AuditApplicationGuard_DisplayName">Allow auditing events in Microsoft Defender Application Guard</string>
<string id="AppHVSI_AuditApplicationGuard_Explain">This policy setting allows you to decide whether auditing events can be collected from Microsoft Defender Application Guard.
If you enable this setting, Application Guard inherits auditing policies from your device and logs system events from the Application Guard container to your host.
If you disable or don't configure this setting, event logs aren't collected from your Application Guard container.
</string>
<string id="AppHVSI_SaveFilesToHost_DisplayName">Allow files to download and save to the host operating system from Microsoft Defender Application Guard</string>
<string id="AppHVSI_SaveFilesToHost_Explain">This policy setting determines whether to save downloaded files to the host operating system from the Microsoft Defender Application Guard container.
If you enable this setting, people can save downloaded files from the Microsoft Defender Application Guard container to the host operating system.
If you disable or don't configure this setting, people can't save downloaded files from the Microsoft Defender Application Guard container to the host operating system.
</string>
</stringTable>
<presentationTable>
<presentation id="AppHVSI_AllowAppHVSI_Presentation">
<decimalTextBox refId="AppHVSI_AllowAppHVSI_TextBox" defaultValue="1"></decimalTextBox>
<text>
Options:
0. Disable Microsoft Defender Application Guard
1. Enable Microsoft Defender Application Guard for Microsoft Edge ONLY
2. Enable Microsoft Defender Application Guard for isolated Windows environments ONLY
3. Enable Microsoft Defender Application Guard for Microsoft Edge AND isolated Windows environments
</text>
</presentation>
<presentation id="AppHVSIClipboardSettings_Presentation">
<dropdownList refId="AppHVSIClipboardSettings_CopyPasteDirection_DropdownList" noSort="true" defaultItem="0">Clipboard behavior setting.</dropdownList>
<decimalTextBox refId="AppHVSIClipboardFileType_AllowedFileType_TextBox" defaultValue="1">Clipboard content options.
</decimalTextBox>
</presentation>
<presentation id="AppHVSIPrintingSettings_Presentation">
<decimalTextBox refId="AppHVSIPrintingSettings_TextBox" defaultValue="0">Allowed print types in Application Guard.
</decimalTextBox>
<text>To determine which types of printing to allow, you must choose:
- 0. Disables all print functionality.
- 1. Enables only XPS printing.
- 2. Enables only PDF printing.
- 3. Enables both PDF and XPS printing.
- 4. Enables only local printing.
- 5. Enables both local and XPS printing.
- 6. Enables both local and PDF printing.
- 7. Enables local, PDF, and XPS printing.
- 8. Enables only network printing.
- 9. Enables both network and XPS printing.
- 10. Enables both network and PDF printing.
- 11. Enables network, PDF, and XPS printing.
- 12. Enables both network and local printing.
- 13. Enables network, local, and XPS printing.
- 14. Enables network, local, and PDF printing.
- 15. Enables all printing.
</text>
</presentation>
<presentation id="AppHVSICertificateThumbprints_Presentation">
<textBox refId="AppHVSICertificateThumbprints_TextBox">
<label>Thumbprints of the certificates to share</label>
</textBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/AppPrivacy.adml
+601
View File
@@ -0,0 +1,601 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="AppPrivacy">App Privacy</string>
<string id="UserInControl">User is in control</string>
<string id="ForceAllow">Force Allow</string>
<string id="ForceDeny">Force Deny</string>
<string id="LetAppsAccessAccountInfo_Name">Let Windows apps access account information</string>
<string id="LetAppsAccessAccountInfo_Explain">This policy setting specifies whether Windows apps can access account information.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access account information by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access account information and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access account information and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access account information by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessCalendar_Name">Let Windows apps access the calendar</string>
<string id="LetAppsAccessCalendar_Explain">This policy setting specifies whether Windows apps can access the calendar.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the calendar by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access the calendar and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access the calendar and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the calendar by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessCallHistory_Name">Let Windows apps access call history</string>
<string id="LetAppsAccessCallHistory_Explain">This policy setting specifies whether Windows apps can access call history.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access call history by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access the call history and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access the call history and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the call history by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessCamera_Name">Let Windows apps access the camera</string>
<string id="LetAppsAccessCamera_Explain">This policy setting specifies whether Windows apps can access the camera.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the camera by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access the camera and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access the camera and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the camera by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessContacts_Name">Let Windows apps access contacts</string>
<string id="LetAppsAccessContacts_Explain">This policy setting specifies whether Windows apps can access contacts.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access contacts by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access contacts and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access contacts and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access contacts by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessEmail_Name">Let Windows apps access email</string>
<string id="LetAppsAccessEmail_Explain">This policy setting specifies whether Windows apps can access email.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access email by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access email and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access email and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access email by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessGraphicsCaptureProgrammatic_Name">Let Windows apps take screenshots of various windows or displays</string>
<string id="LetAppsAccessGraphicsCaptureProgrammatic_Explain">This policy setting specifies whether Windows apps can take screenshots of various windows or displays.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to take screenshots of various windows or displays and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to take screenshots of various windows or displays and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessGraphicsCaptureWithoutBorder_Name">Let Windows apps turn off the screenshot border</string>
<string id="LetAppsAccessGraphicsCaptureWithoutBorder_Explain">This policy setting specifies whether Windows apps can turn off the screenshot border.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to turn off the screenshot border and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to turn off the screenshot border and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessHumanPresence_Name">Let Windows apps access presence sensing</string>
<string id="LetAppsAccessHumanPresence_Explain">This policy setting specifies whether Windows apps can access presence sensing.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access presence sensing by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access presence sensing and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access presence sensing and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access presence sensing by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessLocation_Name">Let Windows apps access location</string>
<string id="LetAppsAccessLocation_Explain">This policy setting specifies whether Windows apps can access location.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access location by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access location and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access location and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access location by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessMessaging_Name">Let Windows apps access messaging</string>
<string id="LetAppsAccessMessaging_Explain">This policy setting specifies whether Windows apps can read or send messages (text or MMS).
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can read or send messages by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps can read or send messages and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps cannot read or send messages and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can read or send messages by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessMicrophone_Name">Let Windows apps access the microphone</string>
<string id="LetAppsAccessMicrophone_Explain">This policy setting specifies whether Windows apps can access the microphone.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the microphone by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access the microphone and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access the microphone and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the microphone by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessMotion_Name">Let Windows apps access motion</string>
<string id="LetAppsAccessMotion_Explain">This policy setting specifies whether Windows apps can access motion data.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access motion data by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access motion data and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access motion data and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access motion data by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessNotifications_Name">Let Windows apps access notifications</string>
<string id="LetAppsAccessNotifications_Explain">This policy setting specifies whether Windows apps can access notifications.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access notifications by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access notifications and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access notifications and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access notifications by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessPhone_Name">Let Windows apps make phone calls</string>
<string id="LetAppsAccessPhone_Explain">This policy setting specifies whether Windows apps can make phone calls.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can make phone calls by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to make phone calls and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to make phone calls and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can make phone calls by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessRadios_Name">Let Windows apps control radios</string>
<string id="LetAppsAccessRadios_Explain">This policy setting specifies whether Windows apps have access to control radios.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps have access to control radios by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps will have access to control radios and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps will not have access to control radios and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps have access to control radios by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsSyncWithDevices_Name">Let Windows apps communicate with unpaired devices</string>
<string id="LetAppsSyncWithDevices_Explain">This policy setting specifies whether Windows apps can communicate with unpaired wireless devices.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to communicate with unpaired wireless devices and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to communicate with unpaired wireless devices and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessTasks_Name">Let Windows apps access Tasks</string>
<string id="LetAppsAccessTasks_Explain">This policy setting specifies whether Windows apps can access tasks.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access tasks by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access tasks and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access tasks and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access tasks by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessTrustedDevices_Name">Let Windows apps access trusted devices</string>
<string id="LetAppsAccessTrustedDevices_Explain">This policy setting specifies whether Windows apps can access trusted devices.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access trusted devices by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access trusted devices and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access trusted devices and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access trusted devices by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsRunInBackground_Name">Let Windows apps run in the background</string>
<string id="LetAppsRunInBackground_Explain">This policy setting specifies whether Windows apps can run in the background.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can run in the background by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to run in the background and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to run in the background and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can run in the background by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsGetDiagnosticInfo_Name">Let Windows apps access diagnostic information about other apps</string>
<string id="LetAppsGetDiagnosticInfo_Explain">This policy setting specifies whether Windows apps can get diagnostic information about other Windows apps, including user name.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can get diagnostic information about other apps using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to get diagnostic information about other apps and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to get diagnostic information about other apps and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can get diagnostic information about other apps by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsAccessGazeInput_Name">Let Windows apps access an eye tracker device</string>
<string id="LetAppsAccessGazeInput_Explain">This policy setting specifies whether Windows apps can access the eye tracker.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the eye tracker by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access the eye tracker and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access the eye tracker and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the eye tracker by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
<string id="LetAppsActivateWithVoice_Name">Let Windows apps activate with voice</string>
<string id="LetAppsActivateWithVoice_Explain">This policy setting specifies whether Windows apps can be activated by voice.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can be activated with a voice keyword by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to be activated with a voice keyword and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to be activated with a voice keyword and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can be activated with a voice keyword by using Settings &gt; Privacy on the device.
This policy is applied to Windows apps and Cortana.
</string>
<string id="LetAppsActivateWithVoiceAboveLock_Name">Let Windows apps activate with voice while the system is locked</string>
<string id="LetAppsActivateWithVoiceAboveLock_Explain">
This policy setting specifies whether Windows apps can be activated by voice while the system is locked.
If you choose the "User is in control" option, employees in your organization can decide whether users can interact with applications using speech while the system is locked by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, users can interact with applications using speech while the system is locked and employees in your organization cannot change it.
If you choose the "Force Deny" option, users cannot interact with applications using speech while the system is locked and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether users can interact with applications using speech while the system is locked by using Settings &gt; Privacy on the device.
This policy is applied to Windows apps and Cortana. It takes precedence of the “Allow Cortana above lock” policy. This policy is applicable only when “Allow voice activation” policy is configured to allow applications to be activated with voice.
</string>
<string id="LetAppsAccessBackgroundSpatialPerception_Name">Let Windows apps access user movements while running in the background</string>
<string id="LetAppsAccessBackgroundSpatialPerception_Explain">This policy setting specifies whether Windows apps can access the movement of the user's head, hands, motion controllers, and other tracked objects, while the apps are running in the background.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the user's movements while the apps are running in the background by using Settings &gt; Privacy on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access user movements while the apps are running in the background and employees in your organization cannot change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access user movements while the apps are running in the background and employees in your organization cannot change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the user's movements while the apps are running in the background by using Settings &gt; Privacy on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
</string>
</stringTable>
<presentationTable>
<presentation id="LetAppsAccessCalendar">
<dropdownList refId="LetAppsAccessCalendar_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessCalendar_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessCalendar_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessCalendar_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessPhone">
<dropdownList refId="LetAppsAccessPhone_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessPhone_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessPhone_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessPhone_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessCallHistory">
<dropdownList refId="LetAppsAccessCallHistory_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessCallHistory_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessCallHistory_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessCallHistory_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessCamera">
<dropdownList refId="LetAppsAccessCamera_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessCamera_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessCamera_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessCamera_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessContacts">
<dropdownList refId="LetAppsAccessContacts_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessContacts_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessContacts_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessContacts_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessEmail">
<dropdownList refId="LetAppsAccessEmail_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessEmail_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessEmail_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessEmail_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessGraphicsCaptureProgrammatic">
<dropdownList refId="LetAppsAccessGraphicsCaptureProgrammatic_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessGraphicsCaptureProgrammatic_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessGraphicsCaptureProgrammatic_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessGraphicsCaptureProgrammatic_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessGraphicsCaptureWithoutBorder">
<dropdownList refId="LetAppsAccessGraphicsCaptureWithoutBorder_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessGraphicsCaptureWithoutBorder_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessGraphicsCaptureWithoutBorder_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessGraphicsCaptureWithoutBorder_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessHumanPresence">
<dropdownList refId="LetAppsAccessHumanPresence_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessHumanPresence_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessHumanPresence_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessHumanPresence_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessLocation">
<dropdownList refId="LetAppsAccessLocation_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessLocation_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessLocation_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessLocation_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessMessaging">
<dropdownList refId="LetAppsAccessMessaging_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessMessaging_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessMessaging_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessMessaging_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessMicrophone">
<dropdownList refId="LetAppsAccessMicrophone_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessMicrophone_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessMicrophone_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessMicrophone_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessMotion">
<dropdownList refId="LetAppsAccessMotion_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessMotion_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessMotion_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessMotion_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessNotifications">
<dropdownList refId="LetAppsAccessNotifications_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessNotifications_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessNotifications_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessNotifications_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessRadios">
<dropdownList refId="LetAppsAccessRadios_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessRadios_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessRadios_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessRadios_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessAccountInfo">
<dropdownList refId="LetAppsAccessAccountInfo_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessAccountInfo_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessAccountInfo_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessAccountInfo_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsSyncWithDevices">
<dropdownList refId="LetAppsSyncWithDevices_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsSyncWithDevices_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsSyncWithDevices_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsSyncWithDevices_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessTasks">
<dropdownList refId="LetAppsAccessTasks_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessTasks_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessTasks_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessTasks_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessTrustedDevices">
<dropdownList refId="LetAppsAccessTrustedDevices_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessTrustedDevices_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessTrustedDevices_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessTrustedDevices_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsRunInBackground">
<dropdownList refId="LetAppsRunInBackground_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsRunInBackground_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsRunInBackground_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsRunInBackground_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsGetDiagnosticInfo">
<dropdownList refId="LetAppsGetDiagnosticInfo_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsGetDiagnosticInfo_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsGetDiagnosticInfo_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsGetDiagnosticInfo_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsAccessGazeInput">
<dropdownList refId="LetAppsAccessGazeInput_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessGazeInput_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessGazeInput_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessGazeInput_ForceDenyTheseApps_List"/>
</presentation>
<presentation id="LetAppsActivateWithVoice">
<dropdownList refId="LetAppsActivateWithVoice_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
</presentation>
<presentation id="LetAppsActivateWithVoiceAboveLock">
<dropdownList refId="LetAppsActivateWithVoiceAboveLock_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
</presentation>
<presentation id="LetAppsAccessBackgroundSpatialPerception">
<dropdownList refId="LetAppsAccessBackgroundSpatialPerception_Enum" noSort="true" defaultItem="0">Default for all apps:</dropdownList>
<text>Put user in control of these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps_List"/>
<text>Force allow these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps_List"/>
<text>Force deny these specific apps (use Package Family Names):</text>
<multiTextBox refId="LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps_List"/>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/AppXRuntime.adml
+55
View File
@@ -0,0 +1,55 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Copyright (C) Microsoft. All rights reserved. -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>App runtime</displayName>
<description>App runtime policies</description>
<resources>
<stringTable>
<string id="AppxRuntime">App runtime</string>
<string id="AppxRuntime_Help">Contains settings to manage the behavior of Windows Store apps.</string>
<string id="AppxRuntimeBlockFileElevation">Block launching desktop apps associated with a file.</string>
<string id="AppxRuntimeBlockFileElevationExplanation">This policy setting lets you control whether Windows Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a Windows Store app might compromise the system by opening a file in the default desktop app for a file type.
If you enable this policy setting, Windows Store apps cannot open files in the default desktop app for a file type; they can open files only in other Windows Store apps.
If you disable or do not configure this policy setting, Windows Store apps can open files in the default desktop app for a file type.</string>
<string id="AppxRuntimeBlockProtocolElevation">Block launching desktop apps associated with a URI scheme</string>
<string id="AppxRuntimeBlockProtocolElevationExplanation">This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app.
If you enable this policy setting, Windows Store apps cannot open URIs in the default desktop app for a URI scheme; they can open URIs only in other Windows Store apps.
If you disable or do not configure this policy setting, Windows Store apps can open URIs in the default desktop app for a URI scheme.
Note: Enabling this policy setting does not block Windows Store apps from opening the default desktop app for the http, https, and mailto URI schemes. The handlers for these URI schemes are hardened against URI-based vulnerabilities from untrusted sources, reducing the associated risk.</string>
<string id="AppxRuntimeApplicationContentUriRules">Turn on dynamic Content URI Rules for Windows store apps</string>
<string id="AppxRuntimeApplicationContentUriRulesExplanation">This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all Windows Store apps that use the enterpriseAuthentication capability on a computer.
If you enable this policy setting, you can define additional Content URI Rules that all Windows Store apps that use the enterpriseAuthentication capability on a computer can use.
If you disable or don't set this policy setting, Windows Store apps will only use the static Content URI Rules.</string>
<string id="AppxRuntimeMicrosoftAccountsOptional">Allow Microsoft accounts to be optional</string>
<string id="AppxRuntimeMicrosoftAccountsOptionalExplanation">This policy setting lets you control whether Microsoft accounts are optional for Windows Store apps that require an account to sign in. This policy only affects Windows Store apps that support it.
If you enable this policy setting, Windows Store apps that typically require a Microsoft account to sign in will allow users to sign in with an enterprise account instead.
If you disable or do not configure this policy setting, users will need to sign in with a Microsoft account.</string>
<string id="AppxRuntimeBlockHostedAppAccessWinRT">Block launching Universal Windows apps with Windows Runtime API access from hosted content.</string>
<string id="AppxRuntimeBlockHostedAppAccessWinRTExplanation">
This policy setting controls whether Universal Windows apps with Windows Runtime API access directly from web content can be launched.
If you enable this policy setting, Universal Windows apps which declare Windows Runtime API access in ApplicationContentUriRules section of the manifest cannot be launched; Universal Windows apps which have not declared Windows Runtime API access in the manifest are not affected.
If you disable or do not configure this policy setting, all Universal Windows apps can be launched.
This policy should not be enabled unless recommended by Microsoft as a security response because it can cause severe app compatibility issues.
</string>
</stringTable>
<presentationTable>
<presentation id="AppxRuntimeApplicationContentUriRules">
<text>To turn on dynamic Content URI Rules, click Show, and then type the Content URI Rules in the list.</text>
<listBox refId="ListBox_ContentUriRules" required="false">Content URI Rules: </listBox>
<text>Only https:// URIs are supported.</text>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/AppxPackageManager.adml
+97
View File
@@ -0,0 +1,97 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Copyright (C) Microsoft. All rights reserved. -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<!-- displayName and description are not used. Not supported by current Group Policy tools. -->
<displayName>Appx Package Manager</displayName>
<description>Appx Package Manager</description>
<resources>
<stringTable>
<string id="AppxDeployment">App Package Deployment</string>
<string id="AppxDeploymentAllowAllTrustedApps">Allow all trusted apps to install</string>
<string id="AppxDeploymentAllowAllTrustedAppsExplanation">This policy setting allows you to manage the installation of trusted line-of-business (LOB) or developer-signed Windows Store apps.
If you enable this policy setting, you can install any LOB or developer-signed Windows Store app (which must be signed with a certificate chain that can be successfully validated by the local computer).
If you disable or do not configure this policy setting, you cannot install LOB or developer-signed Windows Store apps.</string>
<string id="AllowAutomaticAppArchiving">Archive infrequently used apps</string>
<string id="AllowAutomaticAppArchivingExplanation">This policy setting controls whether the system can archive infrequently used apps.
If you enable this policy setting, then the system will periodically check for and archive infrequently used apps.
If you disable this policy setting, then the system will not archive any apps.
If you do not configure this policy setting (default), then the system will follow default behavior, which is to periodically check for and archive infrequently used apps, and the user will be able to configure this setting themselves.</string>
<string id="AllowDeploymentInSpecialProfiles">Allow deployment operations in special profiles</string>
<string id="AllowDeploymentInSpecialProfilesExplanation">This policy setting allows you to manage the deployment of Windows Store apps when the user is signed in using a special profile. Special profiles are the following user profiles, where changes are discarded after the user signs off:
Roaming user profiles to which the "Delete cached copies of roaming profiles" Group Policy setting applies
Mandatory user profiles and super-mandatory profiles, which are created by an administrator
Temporary user profiles, which are created when an error prevents the correct profile from loading
User profiles for the Guest account and members of the Guests group
If you enable this policy setting, Group Policy allows deployment operations (adding, registering, staging, updating, or removing an app package) of Windows Store apps when using a special profile.
If you disable or do not configure this policy setting, Group Policy blocks deployment operations of Windows Store apps when using a special profile.</string>
<string id="AllowDevelopmentWithoutDevLicense">Allows development of Windows Store apps and installing them from an integrated development environment (IDE)</string>
<string id="AllowDevelopmentWithoutDevLicenseExplanation">
Allows or denies development of Microsoft Store applications and installing them directly from an IDE.
If you enable this setting and enable the "Allow all trusted apps to install" Group Policy, you can develop Microsoft Store apps and install them directly from an IDE.
If you disable or do not configure this setting, you cannot develop Microsoft Store apps or install them directly from an IDE.
</string>
<string id="DisableDeploymentToNonSystemVolumes">Disable installing Windows apps on non-system volumes</string>
<string id="DisableDeploymentToNonSystemVolumesExplanation">
This policy setting allows you to manage installing Windows apps on additional volumes such as secondary partitions, USB drives, or SD cards.
If you enable this setting, you can't move or install Windows apps on volumes that are not the system volume.
If you disable or do not configure this setting, you can move or install Windows apps on other volumes.
</string>
<string id="RestrictAppDataToSystemVolume">Prevent users' app data from being stored on non-system volumes</string>
<string id="RestrictAppDataToSystemVolumeExplanation">
Prevent users' app data from moving to another location when an app is moved or installed on another location.
If you enable this setting, all users' app data will stay on the system volume, regardless of where the app is installed.
If you disable or do not configure this setting, then when an app is moved to a different volume, the users' app data will also move to this volume.
</string>
<string id="AllowSharedLocalAppData">Allow a Windows app to share application data between users</string>
<string id="AllowSharedLocalAppDataExplanation">Manages a Windows app's ability to share data between users who have installed the app.
If you enable this policy, a Windows app can share app data with other instances of that app. Data is shared through the SharedLocal folder. This folder is available through the Windows.Storage API.
If you disable this policy, a Windows app can't share app data with other instances of that app. If this policy was previously enabled, any previously shared app data will remain in the SharedLocal folder.
</string>
<string id="BlockNonAdminUserInstall">Prevent non-admin users from installing packaged Windows apps</string>
<string id="BlockNonAdminUserInstallExplanation">Manages non-Administrator users' ability to install Windows app packages.
If you enable this policy, non-Administrators will be unable to initiate installation of Windows app packages. Administrators who wish to install an app will need to do so from an Administrator context (for example, an Administrator PowerShell window). All users will still be able to install Windows app packages via the Microsoft Store, if permitted by other policies.
If you disable or do not configure this policy, all users will be able to initiate installation of Windows app packages.
</string>
<string id="DisableBackgroundAutoUpdates">Not allow sideloaded apps to auto-update in the background</string>
<string id="DisableBackgroundAutoUpdatesExplanation">Manages a sideloaded apps' ability to auto-update in the background.
If you enable this policy, sideloaded apps will not auto-update in the background.
If you disable this policy, sideloaded apps will auto-update in the background.
Default is 'disabled' (key not present).
</string>
<string id="DisableMeteredNetworkBackgroundAutoUpdates">Not allow sideloaded apps to auto-update in the background on a metered network</string>
<string id="DisableMeteredNetworkBackgroundAutoUpdatesExplanation">Manages a sideloaded apps' ability to auto-update in the background on a metered network.
If you enable this policy, sideloaded apps will not auto-update in the background on a metered network.
If you disable this policy, sideloaded apps will auto-update in the background on a metered network.
Default is 'disabled' (key not present).
</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/AttachmentManager.adml
+116
View File
@@ -0,0 +1,116 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="AM_AM">Attachment Manager</string>
<string id="AM_CallIOfficeAntiVirus">Notify antivirus programs when opening attachments</string>
<string id="AM_EstimateFileHandlerRisk">Trust logic for file attachments</string>
<string id="AM_ExplainCallIOfficeAntiVirus">This policy setting allows you to manage the behavior for notifying registered antivirus programs. If multiple programs are registered, they will all be notified. If the registered antivirus program already performs on-access checks or scans files as they arrive on the computer's email server, additional calls would be redundant.
If you enable this policy setting, Windows tells the registered antivirus program to scan the file when a user opens a file attachment. If the antivirus program fails, the attachment is blocked from being opened.
If you disable this policy setting, Windows does not call the registered antivirus programs when file attachments are opened.
If you do not configure this policy setting, Windows does not call the registered antivirus programs when file attachments are opened.</string>
<string id="AM_ExplainEstimateFileHandlerRisk">This policy setting allows you to configure the logic that Windows uses to determine the risk for file attachments.
Preferring the file handler instructs Windows to use the file handler data over the file type data. For example, trust notepad.exe, but don't trust .txt files.
Preferring the file type instructs Windows to use the file type data over the file handler data. For example, trust .txt files, regardless of the file handler.
Using both the file handler and type data is the most restrictive option. Windows chooses the more restrictive recommendation which will cause users to see more trust prompts than choosing the other options.
If you enable this policy setting, you can choose the order in which Windows processes risk assessment data.
If you disable this policy setting, Windows uses its default trust logic, which prefers the file handler over the file type.
If you do not configure this policy setting, Windows uses its default trust logic, which prefers the file handler over the file type.</string>
<string id="AM_ExplainMarkZoneOnSavedAtttachments">This policy setting allows you to manage whether Windows marks file attachments with information about their zone of origin (such as restricted, Internet, intranet, local). This requires NTFS in order to function correctly, and will fail without notice on FAT32. By not preserving the zone information, Windows cannot make proper risk assessments.
If you enable this policy setting, Windows does not mark file attachments with their zone information.
If you disable this policy setting, Windows marks file attachments with their zone information.
If you do not configure this policy setting, Windows marks file attachments with their zone information.</string>
<string id="AM_ExplainRemoveZoneInfo">This policy setting allows you to manage whether users can manually remove the zone information from saved file attachments by clicking the Unblock button in the file's property sheet or by using a check box in the security warning dialog. Removing the zone information allows users to open potentially dangerous file attachments that Windows has blocked users from opening.
If you enable this policy setting, Windows hides the check box and Unblock button.
If you disable this policy setting, Windows shows the check box and Unblock button.
If you do not configure this policy setting, Windows hides the check box and Unblock button.</string>
<string id="AM_ExplainSetFileRiskLevel">This policy setting allows you to manage the default risk level for file types. To fully customize the risk level for file attachments, you may also need to configure the trust logic for file attachments.
High Risk: If the attachment is in the list of high-risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file.
Moderate Risk: If the attachment is in the list of moderate-risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file.
Low Risk: If the attachment is in the list of low-risk file types, Windows will not prompt the user before accessing the file, regardless of the file's zone information.
If you enable this policy setting, you can specify the default risk level for file types.
If you disable this policy setting, Windows sets the default risk level to moderate.
If you do not configure this policy setting, Windows sets the default risk level to moderate.</string>
<string id="AM_ExplainSetHighRiskInclusion">This policy setting allows you to configure the list of high-risk file types. If the file attachment is in the list of high-risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file. This inclusion list takes precedence over the medium-risk and low-risk inclusion lists (where an extension is listed in more than one inclusion list).
If you enable this policy setting, you can create a custom list of high-risk file types.
If you disable this policy setting, Windows uses its built-in list of file types that pose a high risk.
If you do not configure this policy setting, Windows uses its built-in list of high-risk file types.</string>
<string id="AM_ExplainSetLowRiskInclusion">This policy setting allows you to configure the list of low-risk file types. If the attachment is in the list of low-risk file types, Windows will not prompt the user before accessing the file, regardless of the file's zone information. This inclusion list overrides the list of high-risk file types built into Windows and has a lower precedence than the high-risk or medium-risk inclusion lists (where an extension is listed in more than one inclusion list).
If you enable this policy setting, you can specify file types that pose a low risk.
If you disable this policy setting, Windows uses its default trust logic.
If you do not configure this policy setting, Windows uses its default trust logic.</string>
<string id="AM_ExplainSetModRiskInclusion">This policy setting allows you to configure the list of moderate-risk file types. If the attachment is in the list of moderate-risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file. This inclusion list overrides the list of potentially high-risk file types built into Windows and it takes precedence over the low-risk inclusion list but has a lower precedence than the high-risk inclusion list (where an extension is listed in more than one inclusion list).
If you enable this policy setting, you can specify file types which pose a moderate risk.
If you disable this policy setting, Windows uses its default trust logic.
If you do not configure this policy setting, Windows uses its default trust logic.</string>
<string id="AM_HandlerBased">Preferring the file handler</string>
<string id="AM_HandlerDisabled">Preferring the file type</string>
<string id="AM_HandlerMostSecure">Looking at the file handler and type</string>
<string id="AM_HighRisk">High Risk</string>
<string id="AM_LowRisk">Low Risk</string>
<string id="AM_MarkZoneOnSavedAtttachments">Do not preserve zone information in file attachments</string>
<string id="AM_ModRisk">Moderate Risk</string>
<string id="AM_RemoveZoneInfo">Hide mechanisms to remove zone information</string>
<string id="AM_SetFileRiskLevel">Default risk level for file attachments</string>
<string id="AM_SetHighRiskInclusion">Inclusion list for high risk file types</string>
<string id="AM_SetLowRiskInclusion">Inclusion list for low file types</string>
<string id="AM_SetModRiskInclusion">Inclusion list for moderate risk file types</string>
</stringTable>
<presentationTable>
<presentation id="AM_EstimateFileHandlerRisk">
<dropdownList refId="AM_TrustLogicSetting" defaultItem="0">Determine risk by</dropdownList>
</presentation>
<presentation id="AM_SetFileRiskLevel">
<dropdownList refId="AM_RiskLevel" defaultItem="1">Set the default risk level</dropdownList>
</presentation>
<presentation id="AM_SetHighRiskInclusion">
<textBox refId="AM_InstructHighRiskInclusionList">
<label>Specify high risk extensions (include a leading period, e.g. .cmd;.exe;).</label>
</textBox>
</presentation>
<presentation id="AM_SetLowRiskInclusion">
<textBox refId="AM_InstructLowRiskInclusionList">
<label>Specify low risk extensions (include a leading period, e.g. .bmp;.gif;).</label>
</textBox>
</presentation>
<presentation id="AM_SetModRiskInclusion">
<textBox refId="AM_InstructModRiskInclusionList">
<label>Specify moderate risk extensions (include a leading period, e.g. .doc;.pdf;).</label>
</textBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/AuditSettings.adml
+26
View File
@@ -0,0 +1,26 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Audit Process Creation</displayName>
<description>Configuration settings for auditing process creation.</description>
<resources>
<stringTable>
<string id="AuditSettings">Audit Process Creation</string>
<string id="IncludeCmdLine">Include command line in process creation events</string>
<string id="IncludeCmdLine_explain">This policy setting determines what information is logged in security audit events when a new process has been created.
This setting only applies when the Audit Process Creation policy is enabled. If you enable this policy setting the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied.
If you disable or do not configure this policy setting, the process's command line information will not be included in Audit Process Creation events.
Default: Not configured
Note: When this policy setting is enabled, any user with access to read the security events will be able to read the command line arguments for any successfully created process. Command line arguments can contain sensitive or private information such as passwords or user data.
</string>
</stringTable>
<presentationTable>
<presentation id="IncludeCmdLine">
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/AutoPlay.adml
+67
View File
@@ -0,0 +1,67 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="AutoPlay">AutoPlay Policies</string>
<string id="AutoPlay_Help">Configure various AutoPlay behaviors.</string>
<string id="NoAutorun">Set the default behavior for AutoRun</string>
<string id="NoAutorun_Help">This policy setting sets the default behavior for Autorun commands.
Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines.
Prior to Windows Vista, when media containing an autorun command is inserted, the system will automatically execute the program without user intervention.
This creates a major security concern as code may be executed without user's knowledge. The default behavior starting with Windows Vista is to prompt the user whether autorun command is to be run. The autorun command is represented as a handler in the Autoplay dialog.
If you enable this policy setting, an Administrator can change the default Windows Vista or later behavior for autorun to:
a) Completely disable autorun commands, or
b) Revert back to pre-Windows Vista behavior of automatically executing the autorun command.
If you disable or not configure this policy setting, Windows Vista or later will prompt the user whether autorun command is to be run.</string>
<string id="NoAutorun_Disabled">Do not execute any autorun commands</string>
<string id="NoAutorun_XP">Automatically execute autorun commands</string>
<string id="DontSetAutoplayCheckbox">Prevent AutoPlay from remembering user choices.</string>
<string id="DontSetAutoplayCheckbox_Help">This policy setting allows you to prevent AutoPlay from remembering user's choice of what to do when a device is connected.
If you enable this policy setting, AutoPlay prompts the user to choose what to do when a device is connected.
If you disable or do not configure this policy setting, AutoPlay remembers user's choice of what to do when a device is connected.</string>
<string id="NoAutoplayfornonVolume">Disallow Autoplay for non-volume devices</string>
<string id="NoAutoplayfornonVolume_Help">This policy setting disallows AutoPlay for MTP devices like cameras or phones.
If you enable this policy setting, AutoPlay is not allowed for MTP devices like cameras or phones.
If you disable or do not configure this policy setting, AutoPlay is enabled for non-volume devices.</string>
<string id="Autorun">Turn off Autoplay</string>
<string id="Autorun_Help">This policy setting allows you to turn off the Autoplay feature.
Autoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs and the music on audio media start immediately.
Prior to Windows XP SP2, Autoplay is disabled by default on removable drives, such as the floppy disk drive (but not the CD-ROM drive), and on network drives.
Starting with Windows XP SP2, Autoplay is enabled for removable drives as well, including Zip drives and some USB mass storage devices.
If you enable this policy setting, Autoplay is disabled on CD-ROM and removable media drives, or disabled on all drives.
This policy setting disables Autoplay on additional types of drives. You cannot use this setting to enable Autoplay on drives on which it is disabled by default.
If you disable or do not configure this policy setting, AutoPlay is enabled.
Note: This policy setting appears in both the Computer Configuration and User Configuration folders. If the policy settings conflict, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration.</string>
<string id="Autorun_NoCD">CD-ROM and removable media drives</string>
<string id="Autorun_None">All drives</string>
</stringTable>
<presentationTable>
<presentation id="NoAutorun">
<dropdownList refId="NoAutorun_Dropdown" noSort="true" defaultItem="0">Default AutoRun Behavior</dropdownList>
</presentation>
<presentation id="Autorun">
<dropdownList refId="Autorun_Box" defaultItem="0">Turn off Autoplay on:</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/Biometrics.adml
+60
View File
@@ -0,0 +1,60 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2008 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Biometrics Configuration Settings</displayName>
<description>Biometrics Configuration Settings</description>
<resources>
<stringTable>
<string id="BiometricsConfiguration">Biometrics</string>
<string id="FaceConfiguration">Facial Features</string>
<string id="Biometrics_EnableBio">Allow the use of biometrics</string>
<string id="Biometrics_EnableBio_Help">This policy setting allows or prevents the Windows Biometric Service to run on this computer.
If you enable or do not configure this policy setting, the Windows Biometric Service is available, and users can run applications that use biometrics on Windows. If you want to enable the ability to log on with biometrics, you must also configure the "Allow users to log on using biometrics" policy setting.
If you disable this policy setting, the Windows Biometric Service is unavailable, and users cannot use any biometric feature in Windows.
Note: Users who log on using biometrics should create a password recovery disk; this will prevent data loss in the event that someone forgets their logon credentials.
</string>
<string id="Biometrics_EnableCredProv">Allow users to log on using biometrics</string>
<string id="Biometrics_EnableCredProv_Help">This policy setting determines whether users can log on or elevate User Account Control (UAC) permissions using biometrics. By default, local users will be able to log on to the local computer, but the "Allow domain users to log on using biometrics" policy setting will need to be enabled for domain users to log on to the domain.
If you enable or do not configure this policy setting, all users can log on to a local Windows-based computer and can elevate permissions with UAC using biometrics.
If you disable this policy setting, biometrics cannot be used by any users to log on to a local Windows-based computer.
Note: Users who log on using biometrics should create a password recovery disk; this will prevent data loss in the event that someone forgets their logon credentials.
</string>
<string id="Biometrics_EnableDomainCredProv">Allow domain users to log on using biometrics</string>
<string id="Biometrics_EnableDomainCredProv_Help">This policy setting determines whether users with a domain account can log on or elevate User Account Control (UAC) permissions using biometrics.
If you enable or do not configure this policy setting, Windows allows domain users to log on to a domain-joined computer using biometrics.
If you disable this policy setting, Windows prevents domain users from logging on to a domain-joined computer using biometrics.
Note: Prior to Windows 10, not configuring this policy setting would have prevented domain users from using biometrics to log on.
</string>
<string id="Biometrics_FUSTimeout">Specify timeout for fast user switching events</string>
<string id="Biometrics_FUSTimeout_Help">This policy setting specifies the number of seconds a pending fast user switch event will remain active before the switch is initiated. By default, a fast user switch event is active for 10 seconds before becoming inactive.
If you enable this policy setting, you can configure the fast user switch event timeout to specify the number of seconds the event remains active. This value cannot exceed 60 seconds.
If you disable or do not configure this policy setting, a default value of 10 seconds is used for fast-user switch event timeouts.
</string>
<string id="Face_EnhancedAntiSpoofing">Configure enhanced anti-spoofing</string>
<string id="Face_EnhancedAntiSpoofing_Help">This policy setting determines whether enhanced anti-spoofing is required for Windows Hello face authentication.
If you enable this setting, Windows requires all users on managed devices to use enhanced anti-spoofing for Windows Hello face authentication. This disables Windows Hello face authentication on devices that do not support enhanced anti-spoofing.
If you disable or don't configure this setting, Windows doesn't require enhanced anti-spoofing for Windows Hello face authentication.
Note that enhanced anti-spoofing for Windows Hello face authentication is not required on unmanaged devices.
</string>
</stringTable>
<presentationTable>
<presentation id="Biometrics_FUSTimeout">
<decimalTextBox refId="Pol_Biometrics_FUSTimeout" defaultValue="10">Timeout in seconds:</decimalTextBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/Bits.adml
+387
View File
@@ -0,0 +1,387 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.2" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<!-- Supported Platforms -->
<string id="SUPPORTED_WindowsXPSP2WindowsNETSP1orBITS20">Windows XP SP2 or Windows Server 2003 SP1, or computers with BITS 2.0 installed.</string>
<string id="SUPPORTED_WindowsXPWindowsNETorBITS15">Windows XP or Windows Server 2003, or computers with BITS 1.5 installed.</string>
<string id="SUPPORTED_Windows7OrBITS35">Windows 7 or computers with BITS 3.5 installed.</string>
<string id="SUPPORTED_Windows8OrBITS5">Windows 8 or Windows Server 2012 or Windows RT or computers with BITS 5 installed.</string>
<!-- Supported Platforms -->
<!-- Component name -->
<string id="BITS">Background Intelligent Transfer Service (BITS)</string>
<!-- Component name -->
<!-- inactive job timeout -->
<string id="BITS_Job_Timeout">Timeout for inactive BITS jobs</string>
<string id="BITS_Job_Timeout_Help">This policy setting specifies the number of days a pending BITS job can remain inactive before the job is considered abandoned. By default BITS will wait 90 days before considering an inactive job abandoned. After a job is determined to be abandoned, the job is deleted from BITS and any downloaded files for the job are deleted from the disk.
Note: Any property changes to the job or any successful download action will reset this timeout.
Consider increasing the timeout value if computers tend to stay offline for a long period of time and still have pending jobs.
Consider decreasing this value if you are concerned about orphaned jobs occupying disk space.
If you enable this policy setting, you can configure the inactive job timeout to specified number of days.
If you disable or do not configure this policy setting, the default value of 90 (days) will be used for the inactive job timeout.</string>
<!-- inactive job timeout -->
<!-- max job download time -->
<string id="BITS_MaxDownloadTime">Limit the maximum BITS job download time</string>
<string id="BITS_MaxDownloadTimeText">This policy setting limits the amount of time that Background Intelligent Transfer Service (BITS) will take to download the files in a BITS job.
The time limit applies only to the time that BITS is actively downloading files. When the cumulative download time exceeds this limit, the job is placed in the error state.
By default BITS uses a maximum download time of 90 days (7,776,000 seconds).
If you enable this policy setting, you can set the maximum job download time to a specified number of seconds.
If you disable or do not configure this policy setting, the default value of 90 days (7,776,000 seconds) will be used.</string>
<!-- max job download time -->
<!-- max bandwidth -->
<string id="BITS_MaxBandwidth">Limit the maximum network bandwidth for BITS background transfers</string>
<string id="BITS_MaxBandwidth_Help">This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers. (This policy setting does not affect foreground transfers.)
You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A.M. to 5:00 P.M., and use all available unused bandwidth the rest of the day's hours.
If you enable this policy setting, BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0.
If you disable or do not configure this policy setting, BITS uses all available unused bandwidth.
Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose.
Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs).</string>
<string id="BITS_MaxBandwidthTime10AM">10 AM</string>
<string id="BITS_MaxBandwidthTime10PM">10 PM</string>
<string id="BITS_MaxBandwidthTime11AM">11 AM</string>
<string id="BITS_MaxBandwidthTime11PM">11 PM</string>
<string id="BITS_MaxBandwidthTime12AM">12 AM</string>
<string id="BITS_MaxBandwidthTime12PM">12 PM</string>
<string id="BITS_MaxBandwidthTime1AM">1 AM</string>
<string id="BITS_MaxBandwidthTime1PM">1 PM</string>
<string id="BITS_MaxBandwidthTime2AM">2 AM</string>
<string id="BITS_MaxBandwidthTime2PM">2 PM</string>
<string id="BITS_MaxBandwidthTime3AM">3 AM</string>
<string id="BITS_MaxBandwidthTime3PM">3 PM</string>
<string id="BITS_MaxBandwidthTime4AM">4 AM</string>
<string id="BITS_MaxBandwidthTime4PM">4 PM</string>
<string id="BITS_MaxBandwidthTime5AM">5 AM</string>
<string id="BITS_MaxBandwidthTime5PM">5 PM</string>
<string id="BITS_MaxBandwidthTime6AM">6 AM</string>
<string id="BITS_MaxBandwidthTime6PM">6 PM</string>
<string id="BITS_MaxBandwidthTime7AM">7 AM</string>
<string id="BITS_MaxBandwidthTime7PM">7 PM</string>
<string id="BITS_MaxBandwidthTime8AM">8 AM</string>
<string id="BITS_MaxBandwidthTime8PM">8 PM</string>
<string id="BITS_MaxBandwidthTime9AM">9 AM</string>
<string id="BITS_MaxBandwidthTime9PM">9 PM</string>
<string id="BITS_MaxBandwidthDaysSunday">Sunday</string>
<string id="BITS_MaxBandwidthDaysMonday">Monday</string>
<string id="BITS_MaxBandwidthDaysTuesday">Tuesday</string>
<string id="BITS_MaxBandwidthDaysWednesday">Wednesday</string>
<string id="BITS_MaxBandwidthDaysThursday">Thursday</string>
<string id="BITS_MaxBandwidthDaysFriday">Friday</string>
<string id="BITS_MaxBandwidthDaysSaturday">Saturday</string>
<string id="BITS_MaxBandwidthLimitKbps">Kbps</string>
<string id="BITS_MaxBandwidthLimitMbps">Mbps</string>
<string id="BITS_MaxBandwidthLimitUnlimited">Unlimited</string>
<string id="BITS_MaxBandwidthV2_Work">Set up a work schedule to limit the maximum network bandwidth used for BITS background transfers</string>
<string id="BITS_MaxBandwidthV2_Work_Help">This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the work and nonwork days and hours. The work schedule is defined using a weekly calendar, which consists of days of the week and hours of the day. All hours and days that are not defined in a work schedule are considered non-work hours.
If you enable this policy setting, you can set up a schedule for limiting network bandwidth during both work and nonwork hours. After the work schedule is defined, you can set the bandwidth usage limits for each of the three BITS background priority levels: high, normal, and low.
You can specify a limit to use for background jobs during a work schedule. For example, you can limit the network bandwidth of low priority jobs to 128 Kbps from 8:00 A.M. to 5:00 P.M. on Monday through Friday, and then set the limit to 512 Kbps for nonwork hours.
If you disable or do not configure this policy setting, BITS uses all available unused bandwidth for background job transfers.
</string>
<string id="BITS_MaxBandwidthV2_Maintenance">Set up a maintenance schedule to limit the maximum network bandwidth used for BITS background transfers</string>
<string id="BITS_MaxBandwidthV2_Maintenance_Help">This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the maintenance days and hours. Maintenance schedules further limit the network bandwidth that is used for background transfers.
If you enable this policy setting, you can define a separate set of network bandwidth limits and set up a schedule for the maintenance period.
You can specify a limit to use for background jobs during a maintenance schedule. For example, if normal priority jobs are currently limited to 256 Kbps on a work schedule, you can further limit the network bandwidth of normal priority jobs to 0 Kbps from 8:00 A.M. to 10:00 A.M. on a maintenance schedule.
If you disable or do not configure this policy setting, the limits defined for work or nonwork schedules will be used.
Note: The bandwidth limits that are set for the maintenance period supersede any limits defined for work and other schedules.
</string>
<!-- max bandwidth -->
<!-- cost transfer policies -->
<string id="BITS_SetTransferPolicyOnCostedNetwork">Set default download behavior for BITS jobs on costed networks</string>
<string id="BITS_SetTransferPolicyOnCostedNetwork_Help">
This policy setting defines the default behavior that the Background Intelligent Transfer Service (BITS) uses for background transfers when the system is connected to a costed network (3G, etc.). Download behavior policies further limit the network usage of background transfers.
If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority.
For example, you can specify that background jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are:
- Always transfer
- Transfer unless roaming
- Transfer unless surcharge applies (when not roaming or overcap)
- Transfer unless nearing limit (when not roaming or nearing cap)
- Transfer only if unconstrained
- Custom--allows you to specify a bitmask, in which the bits describe cost states allowed or disallowed for this priority: (bits described here)
0x1 - The cost is unknown or the connection is unlimited and is considered to be unrestricted of usage charges and capacity constraints.
0x2 - The usage of this connection is unrestricted up to a certain data limit
0x4 - The usage of this connection is unrestricted up to a certain data limit and plan usage is less than 80 percent of the limit.
0x8 - Usage of this connection is unrestricted up to a certain data limit and plan usage is between 80 percent and 100 percent of the limit.
0x10 - Usage of this connection is unrestricted up to a certain data limit, which has been exceeded. Surcharge applied or unknown.
0x20 - Usage of this connection is unrestricted up to a certain data limit, which has been exceeded. No surcharge applies, but speeds are likely reduced.
0x40 - The connection is costed on a per-byte basis.
0x80 - The connection is roaming.
0x80000000 - Ignore congestion.
</string>
<string id="BITS_TransferPolicyAlwaysTransfer">Always transfer</string>
<string id="BITS_TransferPolicyNotRoamingTransfer">Transfer unless roaming</string>
<string id="BITS_TransferPolicyNoSurcharge">Transfer unless surcharge applies (when not roaming or overcap)</string>
<string id="BITS_TransferPolicyStandard">Transfer unless nearing limit (when not roaming or nearing cap)</string>
<string id="BITS_TransferPolicyUnrestricted">Transfer only if unconstrained</string>
<string id="BITS_Custom">Custom</string>
<!-- cost transfer policies -->
<!-- enable peercaching -->
<string id="BITS_EnablePeercaching">Allow BITS Peercaching</string>
<string id="BITS_EnablePeercachingText">This policy setting determines if the Background Intelligent Transfer Service (BITS) peer caching feature is enabled on a specific computer. By default, the files in a BITS job are downloaded only from the origin server specified by the job's owner.
If BITS peer caching is enabled, BITS caches downloaded files and makes them available to other BITS peers. When transferring a download job, BITS first requests the files for the job from its peers in the same IP subnet. If none of the peers in the subnet have the requested files, BITS downloads them from the origin server.
If you enable this policy setting, BITS downloads files from peers, caches the files, and responds to content requests from peers. Using the "Do not allow the computer to act as a BITS peer caching server" and "Do not allow the computer to act as a BITS peer caching client" policy settings, it is possible to control BITS peer caching functionality at a more detailed level. However, it should be noted that the "Allow BITS peer caching" policy setting must be enabled for the other two policy settings to have any effect.
If you disable or do not configure this policy setting, the BITS peer caching feature will be disabled, and BITS will download files directly from the origin server.</string>
<!-- enable peercaching -->
<!-- peercache size limit -->
<string id="BITS_MaxCacheSize">Limit the BITS Peercache size</string>
<string id="BITS_MaxCacheSizeText">This policy setting limits the maximum amount of disk space that can be used for the BITS peer cache, as a percentage of the total system disk size. BITS will add files to the peer cache and make those files available to peers until the cache content reaches the specified cache size. By default, BITS will use 1 percent of the total system disk for the peercache.
If you enable this policy setting, you can enter the percentage of disk space to be used for the BITS peer cache. You can enter a value between 1 percent and 80 percent.
If you disable or do not configure this policy setting, the default size of the BITS peer cache is 1 percent of the total system disk size.
Note: This policy setting has no effect if the "Allow BITS peer caching" setting is disabled or not configured.</string>
<!-- peercache size limit -->
<!-- max peercaching content age limit-->
<string id="BITS_MaxContentAge">Limit the age of files in the BITS Peercache</string>
<string id="BITS_MaxContentAgeText">This policy setting limits the maximum age of files in the Background Intelligent Transfer Service (BITS) peer cache. In order to make the most efficient use of disk space, by default BITS removes any files in the peer cache that have not been accessed in the past 90 days.
If you enable this policy setting, you can specify in days the maximum age of files in the cache. You can enter a value between 1 and 120 days.
If you disable or do not configure this policy setting, files that have not been accessed for the past 90 days will be removed from the peer cache.
Note: This policy setting has no effect if the "Allow BITS Peercaching" policy setting is disabled or not configured.</string>
<!-- max peercaching content age limit-->
<!-- disable peercache client-->
<string id="BITS_DisablePeercachingClient">Do not allow the computer to act as a BITS Peercaching client</string>
<string id="BITS_DisablePeercachingClientText">This policy setting specifies whether the computer will act as a BITS peer caching client. By default, when BITS peer caching is enabled, the computer acts as both a peer caching server (offering files to its peers) and a peer caching client (downloading files from its peers).
If you enable this policy setting, the computer will no longer use the BITS peer caching feature to download files; files will be downloaded only from the origin server. However, the computer will still make files available to its peers.
If you disable or do not configure this policy setting, the computer attempts to download peer-enabled BITS jobs from peer computers before reverting to the origin server.
Note: This policy setting has no effect if the "Allow BITS peer caching" policy setting is disabled or not configured.</string>
<!-- disable peercache client-->
<!-- disable peercache server-->
<string id="BITS_DisablePeercachingServer">Do not allow the computer to act as a BITS Peercaching server</string>
<string id="BITS_DisablePeercachingServerText">This policy setting specifies whether the computer will act as a BITS peer caching server. By default, when BITS peer caching is enabled, the computer acts as both a peer caching server (offering files to its peers) and a peer caching client (downloading files from its peers).
If you enable this policy setting, the computer will no longer cache downloaded files and offer them to its peers. However, the computer will still download files from peers.
If you disable or do not configure this policy setting, the computer will offer downloaded and cached files to its peers.
Note: This setting has no effect if the "Allow BITS peer caching" setting is disabled or not configured.</string>
<!-- disable peercache server-->
<!-- limit peercache bandwidth-->
<string id="BITS_MaxBandwidthServedForPeers">Limit the maximum network bandwidth used for Peercaching</string>
<string id="BITS_MaxBandwidthServedForPeersText">This policy setting limits the network bandwidth that BITS uses for peer cache transfers (this setting does not affect transfers from the origin server).
To prevent any negative impact to a computer caused by serving other peers, by default BITS will use up to 30 percent of the bandwidth of the slowest active network interface. For example, if a computer has both a 100 Mbps network card and a 56 Kbps modem, and both are active, BITS will use a maximum of 30 percent of 56 Kbps.
You can change the default behavior of BITS, and specify a fixed maximum bandwidth that BITS will use for peer caching.
If you enable this policy setting, you can enter a value in bits per second (bps) between 1048576 and 4294967200 to use as the maximum network bandwidth used for peer caching.
If you disable this policy setting or do not configure it, the default value of 30 percent of the slowest active network interface will be used.
Note: This setting has no effect if the "Allow BITS peer caching" policy setting is disabled or not configured.</string>
<!-- limit peercache bandwidth-->
<!-- max jobs per computer -->
<string id="BITS_MaxJobsPerMachine">Limit the maximum number of BITS jobs for this computer</string>
<string id="BITS_MaxJobsPerMachineText">This policy setting limits the number of BITS jobs that can be created for all users of the computer. By default, BITS limits the total number of jobs that can be created on the computer to 300 jobs. You can use this policy setting to raise or lower the maximum number of user BITS jobs.
If you enable this policy setting, BITS will limit the maximum number of BITS jobs to the specified number.
If you disable or do not configure this policy setting, BITS will use the default BITS job limit of 300 jobs.
Note: BITS jobs created by services and the local administrator account do not count toward this limit.</string>
<!-- max jobs per computer -->
<!-- max jobs per user -->
<string id="BITS_MaxJobsPerUser">Limit the maximum number of BITS jobs for each user</string>
<string id="BITS_MaxJobsPerUserText">This policy setting limits the number of BITS jobs that can be created by a user. By default, BITS limits the total number of jobs that can be created by a user to 60 jobs. You can use this setting to raise or lower the maximum number of BITS jobs a user can create.
If you enable this policy setting, BITS will limit the maximum number of BITS jobs a user can create to the specified number.
If you disable or do not configure this policy setting, BITS will use the default user BITS job limit of 300 jobs.
Note: This limit must be lower than the setting specified in the "Maximum number of BITS jobs for this computer" policy setting, or 300 if the "Maximum number of BITS jobs for this computer" policy setting is not configured. BITS jobs created by services and the local administrator account do not count toward this limit.</string>
<!-- max jobs per computer -->
<!-- max files per job -->
<string id="BITS_MaxFilesPerJob">Limit the maximum number of files allowed in a BITS job</string>
<string id="BITS_MaxFilesPerJobText">This policy setting limits the number of files that a BITS job can contain. By default, a BITS job is limited to 200 files. You can use this setting to raise or lower the maximum number of files a BITS jobs can contain.
If you enable this policy setting, BITS will limit the maximum number of files a job can contain to the specified number.
If you disable or do not configure this policy setting, BITS will use the default value of 200 for the maximum number of files a job can contain.
Note: BITS Jobs created by services and the local administrator account do not count toward this limit.</string>
<!-- max files per job -->
<!-- max ranges per file -->
<string id="BITS_MaxRangesPerFile">Limit the maximum number of ranges that can be added to the file in a BITS job</string>
<string id="BITS_MaxRangesPerFileText">This policy setting limits the number of ranges that can be added to a file in a BITS job. By default, files in a BITS job are limited to 500 ranges per file. You can use this setting to raise or lower the maximum number ranges per file.
If you enable this policy setting, BITS will limit the maximum number of ranges that can be added to a file to the specified number.
If you disable or do not configure this policy setting, BITS will limit ranges to 500 ranges per file.
Note: BITS Jobs created by services and the local administrator account do not count toward this limit.</string>
<!-- max ranges per file -->
<!-- disable branch cache-->
<string id="BITS_DisableBranchCache">Do not allow the BITS client to use Windows Branch Cache</string>
<string id="BITS_DisableBranchCacheText">This setting affects whether the BITS client is allowed to use Windows Branch Cache. If the Windows Branch Cache component is installed and enabled on a computer, BITS jobs on that computer can use Windows Branch Cache by default.
If you enable this policy setting, the BITS client does not use Windows Branch Cache.
If you disable or do not configure this policy setting, the BITS client uses Windows Branch Cache.
Note: This policy setting does not affect the use of Windows Branch Cache by applications other than BITS. This policy setting does not apply to BITS transfers over SMB. This setting has no effect if the computer's administrative settings for Windows Branch Cache disable its use entirely.
</string>
<!-- disable branch cache-->
</stringTable>
<presentationTable>
<presentation id="BITS_Job_Timeout">
<decimalTextBox refId="BITS_Job_Timeout_Time" defaultValue="90">Inactive Job Timeout in Days:</decimalTextBox>
</presentation>
<presentation id="BITS_MaxDownloadTime">
<decimalTextBox refId="BITS_MaxDownloadSeconds" defaultValue="54000">Active Job Timeout in seconds:</decimalTextBox>
</presentation>
<presentation id="BITS_MaxBandwidth">
<decimalTextBox refId="BITS_MaxTransferRateText" defaultValue="10" spinStep="10">Limit background transfer rate (Kbps) to:</decimalTextBox>
<dropdownList refId="BITS_BandwidthLimitSchedFrom" noSort="true" defaultItem="8">From</dropdownList>
<dropdownList refId="BITS_BandwidthLimitSchedTo" noSort="true" defaultItem="17">to</dropdownList>
<text>At all other times</text>
<checkBox refId="BITS_UseSystemMaximum" defaultChecked="true">Use all available unused bandwidth</checkBox>
<text>OR</text>
<decimalTextBox refId="BITS_MaxTransferRateText_1" defaultValue="20" spinStep="10">Limit background transfer rate (Kbps) to:</decimalTextBox>
</presentation>
<presentation id="BITS_MaxContentAge">
<decimalTextBox refId="BITS_MaxContentAgeList" defaultValue="90">Number of days:</decimalTextBox>
</presentation>
<presentation id="BITS_MaxCacheSize">
<decimalTextBox refId="BITS_MaxSize" defaultValue="5">Percentage of disk space to be used for the BITS peercache:</decimalTextBox>
</presentation>
<presentation id="BITS_MaxBandwidthServedForPeers">
<decimalTextBox refId="BITS_MaxBandwidthServedForPeersList" defaultValue="1048576">Maximum network bandwidth used for Peercaching (bps):</decimalTextBox>
</presentation>
<presentation id="BITS_MaxJobsPerMachine">
<decimalTextBox refId="BITS_MaxJobsPerMachineList" defaultValue="300">Maximum number of BITS jobs for this computer:</decimalTextBox>
</presentation>
<presentation id="BITS_MaxJobsPerUser">
<decimalTextBox refId="BITS_MaxJobsPerUserList" defaultValue="60">Maximum number of BITS jobs for each user:</decimalTextBox>
</presentation>
<presentation id="BITS_MaxFilesPerJob">
<decimalTextBox refId="BITS_MaxFilesPerJobList" defaultValue="200">Maximum number of files allowed in a BITS job:</decimalTextBox>
</presentation>
<presentation id="BITS_MaxRangesPerFile">
<decimalTextBox refId="BITS_MaxRangesPerFileList" defaultValue="500">Maximum number of ranges that can be added to the file in a BITS job:</decimalTextBox>
</presentation>
<presentation id="BITS_MaxBandwidthV2_Work">
<checkBox refId="BITS_IgnoreLimitsOnLan" defaultChecked="false">Ignore bandwidth limits if the source and the destination are on the same subnet.</checkBox>
<text>Work Days</text>
<dropdownList refId="BITS_WorkDaysFrom" noSort="true" defaultItem="1">From</dropdownList>
<dropdownList refId="BITS_WorkDaysTo" noSort="true" defaultItem="5">To</dropdownList>
<text> </text>
<text>Daily Work Hours</text>
<dropdownList refId="BITS_WorkHoursFrom" noSort="true" defaultItem="8">From</dropdownList>
<dropdownList refId="BITS_WorkHoursTo" noSort="true" defaultItem="17">To</dropdownList>
<text> </text>
<text>Bandwidth Limits During Work Hours</text>
<decimalTextBox refId="BITS_WorkHighPriorityLimit" defaultValue="0">High Priority Limit:</decimalTextBox>
<dropdownList refId="BITS_WorkHighPriorityUnit" noSort="true" defaultItem="2">High Priority Unit:</dropdownList>
<decimalTextBox refId="BITS_WorkNormalPriorityLimit" defaultValue="0">Normal Priority Limit:</decimalTextBox>
<dropdownList refId="BITS_WorkNormalPriorityUnit" noSort="true" defaultItem="2">Normal Priority Unit:</dropdownList>
<decimalTextBox refId="BITS_WorkLowPriorityLimit" defaultValue="0">Low Priority Limit:</decimalTextBox>
<dropdownList refId="BITS_WorkLowPriorityUnit" noSort="true" defaultItem="2">Low Priority Unit:</dropdownList>
<text> </text>
<text>Bandwidth Limits During Non-Work Hours</text>
<decimalTextBox refId="BITS_NonWorkHighPriorityLimit" defaultValue="0">High Priority Limit:</decimalTextBox>
<dropdownList refId="BITS_NonWorkHighPriorityUnit" noSort="true" defaultItem="2">High Priority Unit:</dropdownList>
<decimalTextBox refId="BITS_NonWorkNormalPriorityLimit" defaultValue="0">Normal Priority Limit:</decimalTextBox>
<dropdownList refId="BITS_NonWorkNormalPriorityUnit" noSort="true" defaultItem="2">Normal Priority Unit:</dropdownList>
<decimalTextBox refId="BITS_NonWorkLowPriorityLimit" defaultValue="0">Low Priority Limit:</decimalTextBox>
<dropdownList refId="BITS_NonWorkLowPriorityUnit" noSort="true" defaultItem="2">Low Priority Unit:</dropdownList>
</presentation>
<presentation id="BITS_SetTransferPolicyOnCostedNetwork">
<text>Set default transfer behaviour for BITS jobs on costed network</text>
<dropdownList refId="BITS_TransferPolicyForegroundPriorityValue" noSort="true" defaultItem="0">Foreground </dropdownList>
<decimalTextBox refId="BITS_TransferPolicyForegroundPriorityValueCustom" defaultValue="255">Foreground (Custom)</decimalTextBox>
<dropdownList refId="BITS_TransferPolicyHighPriorityValue" noSort="true" defaultItem="0">High </dropdownList>
<decimalTextBox refId="BITS_TransferPolicyHighPriorityValueCustom" defaultValue="255">High (Custom)</decimalTextBox>
<dropdownList refId="BITS_TransferPolicyNormalPriorityValue" noSort="true" defaultItem="0">Normal </dropdownList>
<decimalTextBox refId="BITS_TransferPolicyNormalPriorityValueCustom" defaultValue="255">Normal (Custom)</decimalTextBox>
<dropdownList refId="BITS_TransferPolicyLowPriorityValue" noSort="true" defaultItem="0">Low </dropdownList>
<decimalTextBox refId="BITS_TransferPolicyLowPriorityValueCustom" defaultValue="255">Low (Custom)</decimalTextBox>
</presentation>
<presentation id="BITS_MaxBandwidthV2_Maintenance">
<text>Maintenance Days</text>
<dropdownList refId="BITS_MaintenanceDaysFrom" noSort="true" defaultItem="1">From</dropdownList>
<dropdownList refId="BITS_MaintenanceDaysTo" noSort="true" defaultItem="5">To</dropdownList>
<text> </text>
<text>Daily Maintenance Hours</text>
<dropdownList refId="BITS_MaintenanceHoursFrom" noSort="true" defaultItem="20">From</dropdownList>
<dropdownList refId="BITS_MaintenanceHoursTo" noSort="true" defaultItem="22">To</dropdownList>
<text> </text>
<text>Bandwidth Limits During Maintenance Hours</text>
<decimalTextBox refId="BITS_MaintenanceHighPriorityLimit" defaultValue="0">High Priority Limit:</decimalTextBox>
<dropdownList refId="BITS_MaintenanceHighPriorityUnit" noSort="true" defaultItem="2">High Priority Unit:</dropdownList>
<decimalTextBox refId="BITS_MaintenanceNormalPriorityLimit" defaultValue="0">Normal Priority Limit:</decimalTextBox>
<dropdownList refId="BITS_MaintenanceNormalPriorityUnit" noSort="true" defaultItem="2">Normal Priority Unit:</dropdownList>
<decimalTextBox refId="BITS_MaintenanceLowPriorityLimit" defaultValue="0">Low Priority Limit:</decimalTextBox>
<dropdownList refId="BITS_MaintenanceLowPriorityUnit" noSort="true" defaultItem="2">Low Priority Unit:</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/CEIPEnable.adml
+34
View File
@@ -0,0 +1,34 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="WindowsCEIPCat">Windows Customer Experience Improvement Program</string>
<string id="CorporateSQM">Allow Corporate redirection of Customer Experience Improvement uploads</string>
<string id="CorporateSQMExp">If you enable this setting all Customer Experience Improvement Program uploads are redirected to Microsoft Operations Manager server.
If you disable this setting uploads are not redirected to a Microsoft Operations Manager server.
If you do not configure this setting uploads are not redirected to a Microsoft Operations Manager server.</string>
<string id="StudyId">Tag Windows Customer Experience Improvement data with Study Identifier</string>
<string id="StudyIdExp">This policy setting will enable tagging of Windows Customer Experience Improvement data when a study is being conducted.
If you enable this setting then Windows CEIP data uploaded will be tagged.
If you do not configure this setting or disable it, then CEIP data will not be tagged with the Study Identifier.
</string>
</stringTable>
<presentationTable>
<presentation id="CorporateSQM">
<textBox refId="CorporateSQMURL">
<label>Corporate SQM URL: </label>
</textBox>
</presentation>
<presentation id="StudyId">
<decimalTextBox refId="StudyIdVal"> Study Identifier: </decimalTextBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/COM.adml
+20
View File
@@ -0,0 +1,20 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="AppMgmt_COM_SearchForCLSID">Download missing COM components</string>
<string id="AppMgmt_COM_SearchForCLSID_Help">This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires.
Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all their functions unless Windows has internally registered the required components.
If you enable this policy setting and a component registration is missing, the system searches for it in Active Directory and, if it is found, downloads it. The resulting searches might make some programs start or run slowly.
If you disable or do not configure this policy setting, the program continues without the registration. As a result, the program might not perform all its functions, or it might stop.
This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/Camera.adml
BIN
View File
Binary file not shown.
policy_templates/en-US/CipherSuiteOrder.adml
+52
View File
@@ -0,0 +1,52 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="SSLConfiguration">SSL Configuration Settings</string>
<string id="SSLCipherSuiteOrder">SSL Cipher Suite Order</string>
<string id="SSLCipherSuiteOrder_Help">This policy setting determines the cipher suites used by the Secure Socket Layer (SSL).
If you enable this policy setting, SSL cipher suites are prioritized in the order specified.
If you disable or do not configure this policy setting, default cipher suite order is used.
Link for all the cipherSuites: http://go.microsoft.com/fwlink/?LinkId=517265
</string>
<string id="SSLCurveOrder">ECC Curve Order</string>
<string id="SSLCurveOrder_Help">This policy setting determines the priority order of ECC curves used with ECDHE cipher suites.
If you enable this policy setting, ECC curves are prioritized in the order specified.(Enter one Curve name per line)
If you disable or do not configure this policy setting, the default ECC curve order is used.
Default Curve Order
============
curve25519
NistP256
NistP384
To See all the curves supported on the system, Use the following command:
CertUtil.exe -DisplayEccCurve
</string>
</stringTable>
<presentationTable>
<presentation id="SSLCipherSuiteOrder">
<textBox refId="Pol_SSLCipherSuiteOrder">
<label>SSL Cipher Suites</label>
<defaultValue>TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_NULL_SHA256,TLS_RSA_WITH_NULL_SHA,TLS_PSK_WITH_AES_256_GCM_SHA384,TLS_PSK_WITH_AES_128_GCM_SHA256,TLS_PSK_WITH_AES_256_CBC_SHA384,TLS_PSK_WITH_AES_128_CBC_SHA256,TLS_PSK_WITH_NULL_SHA384,TLS_PSK_WITH_NULL_SHA256</defaultValue>
</textBox>
</presentation>
<presentation id="SSLCurveOrder">
<text>Type the ECC curve names in the preferred order (one curve name per line)</text>
<multiTextBox refId="SSLCurveOrderList">ECC Curve Order:</multiTextBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/CloudContent.adml
+102
View File
@@ -0,0 +1,102 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2015 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="CloudContent">Cloud Content</string>
<string id="ConfigureWindowsSpotlight">Configure Windows spotlight on lock screen</string>
<string id="ConfigureWindowsSpotlight_Help">This policy setting lets you configure Windows spotlight on the lock screen.
If you enable this policy setting, "Windows spotlight" will be set as the lock screen provider and users will not be able to modify their lock screen. "Windows spotlight" will display daily images from Microsoft on the lock screen.
Additionally, if you check the "Include content from Enterprise spotlight" checkbox and your organization has setup an Enterprise spotlight content service in Azure, the lock screen will display internal messages and communications configured in that service, when available. If your organization does not have an Enterprise spotlight content service, the checkbox will have no effect.
If you disable this policy setting, Windows spotlight will be turned off and users will no longer be able to select it as their lock screen. Users will see the default lock screen image and will be able to select another image, unless you have enabled the "Prevent changing lock screen image" policy.
If you do not configure this policy, Windows spotlight will be available on the lock screen and will be selected by default, unless you have configured another default lock screen image using the "Force a specific default lock screen and logon image" policy.
Note: This policy is only available for Enterprise SKUs</string>
<string id="DisableWindowsSpotlightFeatures">Turn off all Windows spotlight features</string>
<string id="DisableWindowsSpotlightFeatures_Help">This policy setting lets you turn off all Windows Spotlight features at once.
If you enable this policy setting, Windows spotlight on lock screen, Windows tips, Microsoft consumer features and other related features will be turned off. You should enable this policy setting if your goal is to minimize network traffic from target devices.
If you disable or do not configure this policy setting, Windows spotlight features are allowed and may be controlled individually using their corresponding policy settings.</string>
<string id="DisableWindowsSpotlightOnActionCenter">Turn off Windows Spotlight on Action Center</string>
<string id="DisableWindowsSpotlightOnActionCenter_Help">If you enable this policy, Windows Spotlight notifications will no longer be shown on Action Center.
If you disable or do not configure this policy, Microsoft may display notifications in Action Center that will suggest apps or features to help users be more productive on Windows.</string>
<string id="DisableWindowsSpotlightOnSettings">Turn off Windows Spotlight on Settings</string>
<string id="DisableWindowsSpotlightOnSettings_Help">If you enable this policy, Windows Spotlight suggestions will no longer be shown in Settings app.
If you disable or do not configure this policy, Microsoft may suggest apps or features in Settings app to help users be productive on Windows or their linked phone.</string>
<string id="DisableTailoredExperiencesWithDiagnosticData">Do not use diagnostic data for tailored experiences</string>
<string id="DisableTailoredExperiencesWithDiagnosticData_Help">This policy setting lets you prevent Windows from using diagnostic data to provide tailored experiences to the user.
If you enable this policy setting, Windows will not use diagnostic data from this device (this data may include browser, app and feature usage, depending on the "diagnostic data" setting value) to customize content shown on lock screen, Windows tips, Microsoft consumer features and other related features. If these features are enabled, users will still see recommendations, tips and offers, but they may be less relevant.
If you disable or do not configure this policy setting, Microsoft will use diagnostic data to provide personalized recommendations, tips and offers to tailor Windows for the user's needs, and make it work better for them.
Note: this setting does not control Cortana tailored experiences, since there are separate policies to configure it.</string>
<string id="DisableWindowsConsumerFeatures">Turn off Microsoft consumer experiences</string>
<string id="DisableWindowsConsumerFeatures_Help">This policy setting turns off experiences that help consumers make the most of their devices and Microsoft account.
If you enable this policy setting, users will no longer see personalized recommendations from Microsoft and notifications about their Microsoft account.
If you disable or do not configure this policy setting, users may see suggestions from Microsoft and notifications about their Microsoft account.
Note: This setting only applies to Enterprise and Education SKUs.</string>
<string id="DisableSoftLanding">Do not show Windows tips</string>
<string id="DisableSoftLanding_Help">This policy setting prevents Windows tips from being shown to users.
If you enable this policy setting, users will no longer see Windows tips.
If you disable or do not configure this policy setting, users may see contextual popups explaining how to use Windows. Microsoft uses diagnostic data to determine which tips to show.
Note: If you disable or do not configure this policy setting, but enable the "Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Allow Telemetry" policy setting with a level of "Basic" or below, users may see a limited set of tips.
Also, this setting only applies to Enterprise and Education SKUs.</string>
<string id="DisableThirdPartySuggestions">Do not suggest third-party content in Windows spotlight</string>
<string id="DisableThirdPartySuggestions_Help">If you enable this policy, Windows spotlight features like lock screen spotlight, suggested apps in Start menu or Windows tips will no longer suggest apps and content from third-party software publishers. Users may still see suggestions and tips to make them more productive with Microsoft features and apps.
If you disable or do not configure this policy, Windows spotlight features may suggest apps and content from third-party software publishers in addition to Microsoft apps and content.</string>
<string id="DisableWindowsSpotlightWindowsWelcomeExperience">Turn off the Windows Welcome Experience</string>
<string id="DisableWindowsSpotlightWindowsWelcomeExperience_Help">This policy setting lets you turn off the Windows Spotlight Windows Welcome experience. This feature helps onboard users to Windows, for instance launching Microsoft Edge with a web page highlighting new features.
If you enable this policy, the Windows Welcome Experience will no longer display when there are updates and changes to Windows and its apps.
If you disable or do not configure this policy, the Windows Welcome Experience will be launched to help onboard users to Windows telling them about what's new, changed, and suggested.</string>
<string id="DisableCloudOptimizedContent">Turn off cloud optimized content</string>
<string id="DisableCloudOptimizedContent_Help">This policy setting lets you turn off cloud optimized content in all Windows experiences.
If you enable this policy, Windows experiences that use the cloud optimized content client component, will instead present the default fallback content.
If you disable or do not configure this policy, Windows experiences will be able to use cloud optimized content.</string>
<string id="DisableSpotlightCollectionOnDesktop">Turn off Spotlight collection on Desktop</string>
<string id="DisableSpotlightCollectionOnDesktop_Help">This policy setting removes the Spotlight collection setting in Personalization, rendering the user unable to select and subsequentyly download daily images from Microsoft to desktop.
If you enable this policy, "Spotlight collection" will not be available as an option in Personalization settings.
If you disable or do not configure this policy, "Spotlight collection" will appear as an option in Personalization settings, allowing the user to select "Spotlight collection" as the Desktop provider and display daily images from Microsoft on the desktop.</string>
<string id="DisableConsumerAccountStateContent">Turn off cloud consumer account state content</string>
<string id="DisableConsumerAccountStateContent_Help">This policy setting lets you turn off cloud consumer account state content in all Windows experiences.
If you enable this policy, Windows experiences that use the cloud consumer account state content client component, will instead present the default fallback content.
If you disable or do not configure this policy, Windows experiences will be able to use cloud consumer account state content.
</string>
<string id="EnableOrganizationalMessagesContent">Enable Organizational Messages</string>
<string id="EnableOrganizationalMessagesContent_Help">Organizational messages allow Administrators to deliver messages to their end users on selected Windows 11 experiences. Organizational messages are available to Administrators via services like Microsoft Endpoint Manager.
By default, this policy is disabled. If you enable this policy, these experiences will show content booked by Administrators.
Enabling this policy will have no impact on existing MDM policy settings governing delivery of content from Microsoft on Windows experiences.</string>
</stringTable>
<presentationTable>
<presentation id="ConfigureWindowsSpotlight">
<checkBox refId="ConfigureWindowsSpotlight_Checkbox">Include content from Enterprise spotlight</checkBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/Conf.adml
+124
View File
@@ -0,0 +1,124 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="AllowPersistAutoAcceptCalls">Allow persisting automatic acceptance of Calls</string>
<string id="AllowPersistAutoAcceptCalls_Help">Make the automatic acceptance of incoming calls persistent.</string>
<string id="AppSharing">Application Sharing</string>
<string id="AudioVideo">Audio &amp; Video</string>
<string id="DisableAdvCallingButton">Disable the Advanced Calling button</string>
<string id="DisableAdvCallingButton_Help">Disables the Advanced Calling button on the General Options page. Users will not then be able to change the call placement method and the servers used.</string>
<string id="DisableAppSharing">Disable application Sharing</string>
<string id="DisableAppSharing_Help">Disables the application sharing feature of NetMeeting completely. Users will not be able to host or view shared applications.</string>
<string id="DisableAudioPage">Hide the Audio page</string>
<string id="DisableAudioPage_Help">Hides the Audio page of the Tools Options dialog. Users will not then be able to change audio settings.</string>
<string id="DisableChat">Disable Chat</string>
<string id="DisableChat_Help">Disables the Chat feature of NetMeeting.</string>
<string id="DisableGeneralPage">Hide the General page</string>
<string id="DisableGeneralPage_Help">Hides the General page of the Tools Options dialog. Users will not then be able to change personal identification and bandwidth settings.</string>
<string id="DisableNewWhiteboard">Disable Whiteboard</string>
<string id="DisableNewWhiteboard_Help">Disables the T.126 whiteboard feature of NetMeeting.</string>
<string id="DisableOldWhiteboard">Disable NetMeeting 2.x Whiteboard</string>
<string id="DisableOldWhiteboard_Help">Disables the 2.x whiteboard feature of NetMeeting.
The 2.x whiteboard is available for compatibility with older versions of NetMeeting only.
Deployers who do not need it can save bandwidth by disabling it.</string>
<string id="DisableRDS">Disable remote Desktop Sharing</string>
<string id="DisableRDS_Help">Disables the remote desktop sharing feature of NetMeeting. Users will not be able to set it up or use it for controlling their computers remotely.</string>
<string id="DisableSecurityPage">Hide the Security page</string>
<string id="DisableSecurityPage_Help">Hides the Security page of the Tools Options dialog. Users will not then be able to change call security and authentication settings.</string>
<string id="DisableVideoPage">Hide the Video page</string>
<string id="DisableVideoPage_Help">Hides the Video page of the Tools Options dialog. Users will not then be able to change video settings.</string>
<string id="EnableAutoConfiguration">Enable Automatic Configuration</string>
<string id="EnableAutoConfiguration_Help">Configures NetMeeting to download settings for users each time it starts.
The settings are downloaded from the URL listed in the "Configuration URL:" text box.
Group Policy based settings have precedence over any conflicting settings set by downloading them from this URL.</string>
<string id="NetMeeting">NetMeeting</string>
<string id="OptionDialog">Options Page</string>
<string id="PreventAddingNewILS">Prevent adding Directory servers</string>
<string id="PreventAddingNewILS_Help">Prevents users from adding directory (ILS) servers to the list of those they can use for placing calls.</string>
<string id="PreventAudio">Disable Audio</string>
<string id="PreventAudio_Help">Disables the audio feature of NetMeeting. Users will not be able to send or receive audio.</string>
<string id="PreventAutoAccept">Prevent automatic acceptance of Calls</string>
<string id="PreventAutoAccept_Help">Prevents users from turning on automatic acceptance of incoming calls.
This ensures that others cannot call and connect to NetMeeting when the user is not present.
This policy is recommended when deploying NetMeeting to run always.</string>
<string id="PreventChangeDirectSound">Prevent changing DirectSound Audio setting</string>
<string id="PreventChangeDirectSound_Help">Prevents user from changing the DirectSound audio setting. DirectSound provides much better audio quality, but older audio hardware may not support it.</string>
<string id="PreventChangingCallMode">Prevent changing Call placement method</string>
<string id="PreventChangingCallMode_Help">Prevents users from changing the way calls are placed, either directly or via a gatekeeper server.</string>
<string id="PreventDirectoryServices">Disable Directory services</string>
<string id="PreventDirectoryServices_Help">Disables the directory feature of NetMeeting.
Users will not logon to a directory (ILS) server when NetMeeting starts. Users will also not be able to view or place calls via a NetMeeting directory.
This policy is for deployers who have their own location or calling schemes such as a Web site or an address book." </string>
<string id="PreventFullDuplex">Disable full duplex Audio</string>
<string id="PreventFullDuplex_Help">Disables full duplex mode audio. Users will not be able to listen to incoming audio while speaking into the microphone. Older audio hardware does not perform well when in full duplex mode.</string>
<string id="PreventGrantingControl">Prevent Control</string>
<string id="PreventGrantingControl_Help">Prevents users from allowing others in a conference to control what they have shared. This enforces a read-only mode; the other participants cannot change the data in the shared application.</string>
<string id="PreventReceivingFiles">Prevent receiving files</string>
<string id="PreventReceivingFiles_Help">Prevents users from receiving files from others in a conference.</string>
<string id="PreventReceivingVideo">Prevent receiving Video</string>
<string id="PreventReceivingVideo_Help">Prevents users from receiving video. Users will still be able to send video provided they have the hardware." </string>
<string id="PreventSendingFiles">Prevent sending files</string>
<string id="PreventSendingFiles_Help">Prevents users from sending files to others in a conference.</string>
<string id="PreventSendingVideo">Prevent sending Video</string>
<string id="PreventSendingVideo_Help">Prevents users from sending video if they have the hardware. Users will still be able to receive video from others.</string>
<string id="PreventSharing">Prevent Sharing</string>
<string id="PreventSharing_Help">Prevents users from sharing anything themselves. They will still be able to view shared applications/desktops from others.</string>
<string id="PreventSharingCMDPrompt">Prevent Sharing Command Prompts</string>
<string id="PreventSharingCMDPrompt_Help">Prevents users from sharing command prompts. This prevents users from inadvertently sharing out applications, since command prompts can be used to launch other applications.</string>
<string id="PreventSharingDesktop">Prevent Desktop Sharing</string>
<string id="PreventSharingDesktop_Help">Prevents users from sharing the whole desktop. They will still be able to share individual applications.</string>
<string id="PreventSharingExplorer">Prevent Sharing Explorer windows</string>
<string id="PreventSharingExplorer_Help">Prevents users from sharing Explorer windows. This prevents users from inadvertently sharing out applications, since Explorer windows can be used to launch other applications.</string>
<string id="PreventSharingTrueColor">Prevent Application Sharing in true color</string>
<string id="PreventSharingTrueColor_Help">Prevents users from sharing applications in true color. True color sharing uses more bandwidth in a conference.</string>
<string id="PreventWebDirectory">Prevent viewing Web directory</string>
<string id="PreventWebDirectory_Help">Prevents users from viewing directories as Web pages in a browser.</string>
<string id="RestrictFTSendSize">Limit the size of sent files</string>
<string id="RestrictFTSendSize_Help">Limits the size of files users can send to others in a conference.</string>
<string id="SecurityLevelDisabled">Disabled</string>
<string id="SecurityLevelRequired">Required</string>
<string id="SetAVThroughput">Limit the bandwidth of Audio and Video</string>
<string id="SetAVThroughput_Help">Limits the bandwidth audio and video will consume when in a conference. This setting will guide NetMeeting to choose the right formats and send rate so that the bandwidth is limited.</string>
<string id="SetIntranetSupport">Set the intranet support Web page</string>
<string id="SetIntranetSupport_Help">Sets the URL NetMeeting will display when the user chooses the Help Online Support command.</string>
<string id="SetSecurityOptions">Set Call Security options</string>
<string id="SetSecurityOptions_Help">Sets the level of security for both outgoing and incoming NetMeeting calls.</string>
<string id="SUPPORTED_NetMeeting3">at least Windows NetMeeting v3.0</string>
</stringTable>
<presentationTable>
<presentation id="EnableAutoConfiguration">
<textBox refId="AutoConfigFile">
<label>Configuration URL:</label>
</textBox>
</presentation>
<presentation id="RestrictFTSendSize">
<decimalTextBox refId="RestrictFTSize" defaultValue="500" spinStep="100">Maximum size in Kbytes</decimalTextBox>
<text>Value is size in Kbytes, only files smaller</text>
<text> than this size can be sent by the user.</text>
</presentation>
<presentation id="SetAVThroughput">
<decimalTextBox refId="AVThroughput" defaultValue="621700">Maximum bandwidth in Kilobytes per second:</decimalTextBox>
</presentation>
<presentation id="SetIntranetSupport">
<textBox refId="IntranetSupportURL">
<label>Support Web page URL</label>
</textBox>
</presentation>
<presentation id="SetSecurityOptions">
<dropdownList refId="SetSecurityLevel">Call security</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/ControlPanel.adml
+105
View File
@@ -0,0 +1,105 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="DisallowCpls">Hide specified Control Panel items</string>
<string id="DisallowCpls_Help">This setting allows you to display or hide specified Control Panel items, such as Mouse, System, or Personalization, from the Control Panel window and the Start screen. The setting affects the Start screen and Control Panel window, as well as other ways to access Control Panel items, such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings.
If you enable this setting, you can select specific items not to display on the Control Panel window and the Start screen.
To hide a Control Panel item, enable this policy setting and click Show to access the list of disallowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter Microsoft.Mouse, Microsoft.System, or Microsoft.Personalization.
Note: For Windows Vista, Windows Server 2008, and earlier versions of Windows, the module name should be entered, for example timedate.cpl or inetcpl.cpl. If a Control Panel item does not have a CPL file, or the CPL file contains multiple applets, then its module name and string resource identification number should be entered, for example @systemcpl.dll,-1 for System, or @themecpl.dll,-1 for Personalization. A complete list of canonical and module names can be found in MSDN by searching "Control Panel items".
If both the "Hide specified Control Panel items" setting and the "Show only specified Control Panel items" setting are enabled, the "Show only specified Control Panel items" setting is ignored.
Note: The Display Control Panel item cannot be hidden in the Desktop context menu by using this setting. To hide the Display Control Panel item and prevent users from modifying the computer's display settings use the "Disable Display Control Panel" setting instead.
Note: To hide pages in the System Settings app, use the "Settings Page Visibility" setting under Computer Configuration.</string>
<string id="ForceClassicControlPanel">Always open All Control Panel Items when opening Control Panel</string>
<string id="ForceClassicControlPanel_Help">This policy setting controls the default Control Panel view, whether by category or icons.
If this policy setting is enabled, the Control Panel opens to the icon view.
If this policy setting is disabled, the Control Panel opens to the category view.
If this policy setting is not configured, the Control Panel opens to the view used in the last Control Panel session.
Note: Icon size is dependent upon what the user has set it to in the previous session.</string>
<string id="NoControlPanel">Prohibit access to Control Panel and PC settings</string>
<string id="NoControlPanel_Help">Disables all Control Panel programs and the PC settings app.
This setting prevents Control.exe and SystemSettings.exe, the program files for Control Panel and PC settings, from starting. As a result, users cannot start Control Panel or PC settings, or run any of their items.
This setting removes Control Panel from:
The Start screen
File Explorer
This setting removes PC settings from:
The Start screen
Settings charm
Account picture
Search results
If users try to select a Control Panel item from the Properties item on a context menu, a message appears explaining that a setting prevents the action.</string>
<string id="RestrictCpls">Show only specified Control Panel items</string>
<string id="RestrictCpls_Help">This policy setting controls which Control Panel items such as Mouse, System, or Personalization, are displayed on the Control Panel window and the Start screen. The only items displayed in Control Panel are those you specify in this setting. This setting affects the Start screen and Control Panel, as well as other ways to access Control Panel items such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings.
To display a Control Panel item, enable this policy setting and click Show to access the list of allowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter Microsoft.Mouse, Microsoft.System, or Microsoft.Personalization.
Note: For Windows Vista, Windows Server 2008, and earlier versions of Windows, the module name, for example timedate.cpl or inetcpl.cpl, should be entered. If a Control Panel item does not have a CPL file, or the CPL file contains multiple applets, then its module name and string resource identification number should be entered. For example, enter @systemcpl.dll,-1 for System or @themecpl.dll,-1 for Personalization. A complete list of canonical and module names of Control Panel items can be found in MSDN by searching "Control Panel items".
If both the "Hide specified Control Panel items" setting and the "Show only specified Control Panel items" setting are enabled, the "Show only specified Control Panel items" setting is ignored.
Note: The Display Control Panel item cannot be hidden in the Desktop context menu by using this setting. To hide the Display Control Panel item and prevent users from modifying the computer's display settings use the "Disable Display Control Panel" setting instead.
Note: To hide pages in the System Settings app, use the "Settings Page Visibility" setting under Computer Configuration.</string>
<string id="SettingsPageVisibility">Settings Page Visibility</string>
<string id="SettingsPageVisibility_Help">Specifies the list of pages to show or hide from the System Settings app.
This policy allows an administrator to block a given set of pages from the System Settings app. Blocked pages will not be visible in the app, and if all pages in a category are blocked the category will be hidden as well. Direct navigation to a blocked page via URI, context menu in Explorer or other means will result in the front page of Settings being shown instead.
This policy has two modes: it can either specify a list of settings pages to show or a list of pages to hide. To specify a list of pages to show, the policy string must begin with "showonly:" (without quotes), and to specify a list of pages to hide, it must begin with "hide:". If a page in a showonly list would normally be hidden for other reasons (such as a missing hardware device), this policy will not force that page to appear. After this, the policy string must contain a semicolon-delimited list of settings page identifiers. The identifier for any given settings page is the published URI for that page, minus the "ms-settings:" protocol part.
Example: to specify that only the About and Bluetooth pages should be shown (their respective URIs are ms-settings:about and ms-settings:bluetooth) and all other pages hidden:
showonly:about;bluetooth
Example: to specify that only the Bluetooth page (which has URI ms-settings:bluetooth) should be hidden:
hide:bluetooth
The availability of per-user support is documented here: https://go.microsoft.com/fwlink/?linkid=2102995</string>
<string id="AllowOnlineTips">Allow Online Tips</string>
<string id="AllowOnlineTips_Help">Enables or disables the retrieval of online tips and help for the Settings app.
If disabled, Settings will not contact Microsoft content services to retrieve tips and help content.</string>
<string id="HideUnsupportedHardwareNotifications">Hide messages when Windows system requirements are not met</string>
<string id="HideUnsupportedHardwareNotificationsExplain">This policy controls messages which are shown when Windows is running on a device that does not meet the minimum system requirements for this OS version.
If you enable this policy setting, these messages will never appear on desktop or in the Settings app.
If you disable or do not configure this policy setting, these messages will appear on desktop and in the Settings app when Windows is running on a device that does not meet the minimum system requirements for this OS version.</string>
</stringTable>
<presentationTable>
<presentation id="DisallowCpls">
<listBox refId="DisallowCplsList">List of disallowed Control Panel items</listBox>
</presentation>
<presentation id="RestrictCpls">
<listBox refId="RestrictCplsList">List of allowed Control Panel items</listBox>
</presentation>
<presentation id="SettingsPageVisibility">
<textBox refId="SettingsPageVisibilityBox">
<label>Settings Page Visibility:</label>
</textBox>
</presentation>
<presentation id="AllowOnlineTips">
<checkBox refId="CheckBox_AllowOnlineTips">
Allow Settings to retrieve online tips.
</checkBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/ControlPanelDisplay.adml
+279
View File
@@ -0,0 +1,279 @@
<?xml version="1.0" encoding="utf-8"?>
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="Display">Display</string>
<string id="CPL_Display_Disable">Disable the Display Control Panel</string>
<string id="CPL_Display_Disable_Help">Disables the Display Control Panel.
If you enable this setting, the Display Control Panel does not run. When users try to start Display, a message appears explaining that a setting prevents the action.
Also, see the "Prohibit access to the Control Panel" (User Configuration\Administrative Templates\Control Panel) and "Remove programs on Settings menu" (User Configuration\Administrative Templates\Start Menu &amp; Taskbar) settings.</string>
<string id="CPL_Display_HideSettings">Hide Settings tab</string>
<string id="CPL_Display_HideSettings_Help">Removes the Settings tab from Display in Control Panel.
This setting prevents users from using Control Panel to add, configure, or change the display settings on the computer.</string>
<string id="Personalization">Personalization</string>
<string id="CPL_Personalization_NoColorAppearanceUI">Prevent changing color and appearance</string>
<string id="CPL_Personalization_NoColorAppearanceUI_Help">Disables the Color (or Window Color) page in the Personalization Control Panel, or the Color Scheme dialog in the Display Control Panel on systems where the Personalization feature is not available.
This setting prevents users from using Control Panel to change the window border and taskbar color (on Windows 8), glass color (on Windows Vista and Windows 7), system colors, or color scheme of the desktop and windows.
If this setting is disabled or not configured, the Color (or Window Color) page or Color Scheme dialog is available in the Personalization or Display Control Panel.
For systems prior to Windows Vista, this setting hides the Appearance and Themes tabs in the in Display in Control Panel.</string>
<string id="CPL_Personalization_NoScreenSaverUI">Prevent changing screen saver</string>
<string id="CPL_Personalization_NoScreenSaverUI_Help">Prevents the Screen Saver dialog from opening in the Personalization or Display Control Panel.
This setting prevents users from using Control Panel to add, configure, or change the screen saver on the computer. It does not prevent a screen saver from running.
</string>
<string id="CPL_Personalization_EnableScreenSaver">Enable screen saver</string>
<string id="CPL_Personalization_EnableScreenSaver_Help">Enables desktop screen savers.
If you disable this setting, screen savers do not run. Also, this setting disables the Screen Saver section of the Screen Saver dialog in the Personalization or Display Control Panel. As a result, users cannot change the screen saver options.
If you do not configure it, this setting has no effect on the system.
If you enable it, a screen saver runs, provided the following two conditions hold: First, a valid screen saver on the client is specified through the "Screen Saver executable name" setting or through Control Panel on the client computer. Second, the screen saver timeout is set to a nonzero value through the setting or Control Panel.
Also, see the "Prevent changing Screen Saver" setting.</string>
<string id="CPL_Personalization_SetScreenSaver">Force specific screen saver</string>
<string id="CPL_Personalization_SetScreenSaver_Help">Specifies the screen saver for the user's desktop.
If you enable this setting, the system displays the specified screen saver on the user's desktop. Also, this setting disables the drop-down list of screen savers in the Screen Saver dialog in the Personalization or Display Control Panel, which prevents users from changing the screen saver.
If you disable this setting or do not configure it, users can select any screen saver.
If you enable this setting, type the name of the file that contains the screen saver, including the .scr file name extension. If the screen saver file is not in the %Systemroot%\System32 directory, type the fully qualified path to the file.
If the specified screen saver is not installed on a computer to which this setting applies, the setting is ignored.
Note: This setting can be superseded by the "Enable Screen Saver" setting. If the "Enable Screen Saver" setting is disabled, this setting is ignored, and screen savers do not run.</string>
<string id="CPL_Personalization_ScreenSaverIsSecure">Password protect the screen saver</string>
<string id="CPL_Personalization_ScreenSaverIsSecure_Help">Determines whether screen savers used on the computer are password protected.
If you enable this setting, all screen savers are password protected. If you disable this setting, password protection cannot be set on any screen saver.
This setting also disables the "Password protected" checkbox on the Screen Saver dialog in the Personalization or Display Control Panel, preventing users from changing the password protection setting.
If you do not configure this setting, users can choose whether or not to set password protection on each screen saver.
To ensure that a computer will be password protected, enable the "Enable Screen Saver" setting and specify a timeout via the "Screen Saver timeout" setting.
Note: To remove the Screen Saver dialog, use the "Prevent changing Screen Saver" setting.</string>
<string id="CPL_Personalization_ScreenSaverTimeOut">Screen saver timeout</string>
<string id="CPL_Personalization_ScreenSaverTimeOut_Help">Specifies how much user idle time must elapse before the screen saver is launched.
When configured, this idle time can be set from a minimum of 1 second to a maximum of 86,400 seconds, or 24 hours. If set to zero, the screen saver will not be started.
This setting has no effect under any of the following circumstances:
- The setting is disabled or not configured.
- The wait time is set to zero.
- The "Enable Screen Saver" setting is disabled.
- Neither the "Screen saver executable name" setting nor the Screen Saver dialog of the client computer's Personalization or Display Control Panel specifies a valid existing screen saver program on the client.
When not configured, whatever wait time is set on the client through the Screen Saver dialog in the Personalization or Display Control Panel is used. The default is 15 minutes.</string>
<string id="CPL_Personalization_NoDesktopBackgroundUI">Prevent changing desktop background</string>
<string id="CPL_Personalization_NoDesktopBackgroundUI_Help">Prevents users from adding or changing the background design of the desktop.
By default, users can use the Desktop Background page in the Personalization or Display Control Panel to add a background design (wallpaper) to their desktop.
If you enable this setting, none of the Desktop Background settings can be changed by the user.
To specify wallpaper for a group, use the "Desktop Wallpaper" setting.
Note: You must also enable the "Desktop Wallpaper" setting to prevent users from changing the desktop wallpaper. Refer to KB article: Q327998 for more information.
Also, see the "Allow only bitmapped wallpaper" setting.</string>
<string id="CPL_Personalization_NoSoundSchemeUI">Prevent changing sounds</string>
<string id="CPL_Personalization_NoSoundSchemeUI_Help">Prevents users from changing the sound scheme.
By default, users can use the Sounds tab in the Sound Control Panel to add, remove, or change the system Sound Scheme.
If you enable this setting, none of the Sound Scheme settings can be changed by the user.</string>
<string id="CPL_Personalization_NoMousePointersUI">Prevent changing mouse pointers</string>
<string id="CPL_Personalization_NoMousePointersUI_Help">Prevents users from changing the mouse pointers.
By default, users can use the Pointers tab in the Mouse Control Panel to add, remove, or change the mouse pointers.
If you enable this setting, none of the mouse pointer scheme settings can be changed by the user.</string>
<string id="CPL_Personalization_NoDesktopIconsUI">Prevent changing desktop icons</string>
<string id="CPL_Personalization_NoDesktopIconsUI_Help">Prevents users from changing the desktop icons.
By default, users can use the Desktop Icon Settings dialog in the Personalization or Display Control Panel to show, hide, or change the desktop icons.
If you enable this setting, none of the desktop icons can be changed by the user.
For systems prior to Windows Vista, this setting also hides the Desktop tab in the Display Control Panel.</string>
<string id="CPL_Personalization_DisableColorSchemeChoice">Prevent changing color scheme</string>
<string id="CPL_Personalization_DisableColorSchemeChoice_Help">This setting forces the theme color scheme to be the default color scheme.
If you enable this setting, a user cannot change the color scheme of the current desktop theme.
If you disable or do not configure this setting, a user may change the color scheme of the current desktop theme.
For Windows 7 and later, use the "Prevent changing color and appearance" setting.</string>
<string id="CPL_Personalization_DisableThemeChange">Prevent changing theme</string>
<string id="CPL_Personalization_DisableThemeChange_Help">This setting disables the theme gallery in the Personalization Control Panel.
If you enable this setting, users cannot change or save a theme. Elements of a theme such as the desktop background, color, sounds, and screen saver can still be changed (unless policies are set to turn them off).
If you disable or do not configure this setting, there is no effect.
Note: If you enable this setting but do not specify a theme using the "load a specific theme" setting, the theme defaults to whatever the user previously set or the system default.</string>
<string id="CPL_Personalization_SetTheme">Load a specific theme</string>
<string id="CPL_Personalization_SetTheme_Help">Specifies which theme file is applied to the computer the first time a user logs on.
If you enable this setting, the theme that you specify will be applied when a new user logs on for the first time. This policy does not prevent the user from changing the theme or any of the theme elements such as the desktop background, color, sounds, or screen saver after the first logon.
If you disable or do not configure this setting, the default theme will be applied at the first logon.</string>
<string id="CPL_Personalization_DisableVisualStyle">Prevent changing visual style for windows and buttons</string>
<string id="CPL_Personalization_DisableVisualStyle_Help">Prevents users or applications from changing the visual style of the windows and buttons displayed on their screens.
When enabled on Windows XP, this setting disables the "Windows and buttons" drop-down list on the Appearance tab in Display Properties.
When enabled on Windows XP and later systems, this setting prevents users and applications from changing the visual style through the command line. Also, a user may not apply a different visual style when changing themes.</string>
<string id="CPL_Personalization_SetVisualStyle">Force a specific visual style file or force Windows Classic</string>
<string id="CPL_Personalization_SetVisualStyle_Help">This setting allows you to force a specific visual style file by entering the path (location) of the visual style file.
This can be a local computer visual style (aero.msstyles), or a file located on a remote server using a UNC path (\\Server\Share\aero.msstyles).
If you enable this setting, the visual style file that you specify will be used. Also, a user may not apply a different visual style when changing themes.
If you disable or do not configure this setting, the users can select the visual style that they want to use by changing themes (if the Personalization Control Panel is available).
Note: If this setting is enabled and the file is not available at user logon, the default visual style is loaded.
Note: When running Windows XP, you can select the Luna visual style by typing %windir%\resources\Themes\Luna\Luna.msstyles
Note: To select the Windows Classic visual style, leave the box blank beside "Path to Visual Style:" and enable this setting. When running Windows 8 or Windows RT, you cannot apply the Windows Classic visual style.</string>
<string id="CPL_Personalization_LockFontSize">Prohibit selection of visual style font size</string>
<string id="CPL_Personalization_LockFontSize_Help">Prevents users from changing the size of the font in the windows and buttons displayed on their screens.
If this setting is enabled, the "Font size" drop-down list on the Appearance tab in Display Properties is disabled.
If you disable or do not configure this setting, a user may change the font size using the "Font size" drop-down list on the Appearance tab.</string>
<string id="CPL_Personalization_NoLockScreen">Do not display the lock screen</string>
<string id="CPL_Personalization_NoLockScreen_Help">This policy setting controls whether the lock screen appears for users.
If you enable this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see their selected tile after locking their PC.
If you disable or do not configure this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see a lock screen after locking their PC. They must dismiss the lock screen using touch, the keyboard, or by dragging it with the mouse.</string>
<string id="CPL_Personalization_NoChangingLockScreen">Prevent changing lock screen and logon image</string>
<string id="CPL_Personalization_NoChangingLockScreen_Help">Prevents users from changing the background image shown when the machine is locked or when on the logon screen.
By default, users can change the background image shown when the machine is locked or displaying the logon screen.
If you enable this setting, the user will not be able to change their lock screen and logon image, and they will instead see the default image.</string>
<string id="CPL_Personalization_AnimateLockScreenBackground">Prevent lock screen background motion</string>
<string id="CPL_Personalization_AnimateLockScreenBackground_Help">This policy setting controls whether the lock screen image is static or has a subtle panning effect driven by the device's accelerometer output.
If you enable this setting, motion will be prevented and the user will see the traditional static lock screen background image.
If you disable this setting (and the device has an accelerometer), the user will see the lock screen background pan around a still image as they physically move their device.</string>
<string id="CPL_Personalization_ForceDefaultLockScreen">Force a specific default lock screen and logon image</string>
<string id="CPL_Personalization_ForceDefaultLockScreen_Help">This setting allows you to force a specific default lock screen and logon image by entering the path (location) of the image file. The same image will be used for both the lock and logon screens.
This setting lets you specify the default lock screen and logon image shown when no user is signed in, and also sets the specified image as the default for all users (it replaces the inbox default image).
To use this setting, type the fully qualified path and name of the file that stores the default lock screen and logon image. You can type a local path, such as C:\Windows\Web\Screen\img104.jpg or a UNC path, such as \\Server\Share\Corp.jpg.
This can be used in conjunction with the "Prevent changing lock screen and logon image" setting to always force the specified lock screen and logon image to be shown.
Note: This setting only applies to Enterprise, Education, and Server SKUs.</string>
<string id="CPL_Personalization_NoLockScreenCamera">Prevent enabling lock screen camera</string>
<string id="CPL_Personalization_NoLockScreenCamera_Help">Disables the lock screen camera toggle switch in PC Settings and prevents a camera from being invoked on the lock screen.
By default, users can enable invocation of an available camera on the lock screen.
If you enable this setting, users will no longer be able to enable or disable lock screen camera access in PC Settings, and the camera cannot be invoked on the lock screen.</string>
<string id="CPL_Personalization_NoLockScreenSlideshow">Prevent enabling lock screen slide show</string>
<string id="CPL_Personalization_NoLockScreenSlideshow_Help">Disables the lock screen slide show settings in PC Settings and prevents a slide show from playing on the lock screen.
By default, users can enable a slide show that will run after they lock the machine.
If you enable this setting, users will no longer be able to modify slide show settings in PC Settings, and no slide show will ever start.</string>
<string id="CPL_Personalization_PersonalColors">Force a specific background and accent color</string>
<string id="CPL_Personalization_PersonalColors_Help">Forces Windows to use the specified colors for the background and accent. The color values are specified in hex as #RGB.
By default, users can change the background and accent colors.
If this setting is enabled, the background and accent colors of Windows will be set to the specified colors and users cannot change those colors. This setting will not be applied if the specified colors do not meet a contrast ratio of 2:1 with white text.</string>
<string id="CPL_Personalization_StartBackground">Force a specific Start background</string>
<string id="CPL_Personalization_StartBackground_Help">Forces the Start screen to use one of the available backgrounds, 1 through 20, and prevents the user from changing it.
If this setting is set to zero or not configured, then Start uses the default background, and users can change it.
If this setting is set to a nonzero value, then Start uses the specified background, and users cannot change it. If the specified background is not supported, the default background is used.</string>
<string id="CPL_Personalization_NoChangingStartMenuBackground">Prevent changing start menu background</string>
<string id="CPL_Personalization_NoChangingStartMenuBackground_Help">Prevents users from changing the look of their start menu background, such as its color or accent.
By default, users can change the look of their start menu background, such as its color or accent.
If you enable this setting, the user will be assigned the default start menu background and colors and will not be allowed to change them.
If the "Force a specific background and accent color" policy is also set on a supported version of Windows, then those colors take precedence over this policy.
If the "Force a specific Start background" policy is also set on a supported version of Windows, then that background takes precedence over this policy.
</string>
</stringTable>
<presentationTable>
<presentation id="ScreenSaverFilename">
<textBox refId="ScreenSaverFilename">
<label>Screen saver executable name</label>
</textBox>
</presentation>
<presentation id="ScreenSaverTimeOut">
<text>Number of seconds to wait to enable the screen saver</text>
<text> </text>
<decimalTextBox refId="ScreenSaverTimeOutFreqSpin" defaultValue="900" spinStep="60">Seconds:</decimalTextBox>
</presentation>
<presentation id="Themes_Load_Theme">
<textBox refId="Themes_Name">
<label>Path to Visual Style:</label>
</textBox>
<text>To select Aero type:</text>
<text>%windir%\resources\Themes\Aero\aero.msstyles</text>
<text> </text>
<text>To select a different visual style, type:</text>
<text>ie: \\&lt;server&gt;\share\Corp.msstyles</text>
<text> </text>
<text>To select Windows Classic, leave the box</text>
<text>above blank and enable this setting</text>
</presentation>
<presentation id="ThemeFilename">
<textBox refId="ThemeFilename">
<label>Path to theme file:</label>
</textBox>
</presentation>
<presentation id="ForceDefaultLockScreen">
<textBox refId="LockScreenImage">
<label>Path to lock screen image:</label>
</textBox>
<text>Example: Using a local path: C:\windows\web\screen\lockscreen.jpg</text>
<text>Example: Using a UNC path: \\Server\Share\Corp.jpg</text>
<text> </text>
<checkBox refId="LockScreenOverlaysDisabled">Turn off fun facts, tips, tricks, and more on lock screen</checkBox>
</presentation>
<presentation id="PersonalColors">
<textBox refId="PersonalColors_Background">
<label>Start background color:</label>
</textBox>
<textBox refId="PersonalColors_Accent">
<label>Accent color:</label>
</textBox>
</presentation>
<presentation id="StartBackground">
<decimalTextBox refId="StartBackgroundSpin" defaultValue="0" spinStep="1">Background ID: </decimalTextBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/Cpls.adml
+21
View File
@@ -0,0 +1,21 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="Users">User Accounts</string>
<string id="Users_Help">Contains settings to control the behavior of User Accounts</string>
<string id="UseDefaultTile">Apply the default account picture to all users</string>
<string id="UseDefaultTile_Help">This policy setting allows an administrator to standardize the account pictures for all users on a system to the default account picture. One application for this policy setting is to standardize the account pictures to a company logo.
Note: The default account picture is stored at %PROGRAMDATA%\Microsoft\User Account Pictures\user.jpg. The default guest picture is stored at %PROGRAMDATA%\Microsoft\User Account Pictures\guest.jpg. If the default pictures do not exist, an empty frame is displayed.
If you enable this policy setting, the default user account picture will display for all users on the system with no customization allowed.
If you disable or do not configure this policy setting, users will be able to customize their account pictures.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/CredSsp.adml
+259
View File
@@ -0,0 +1,259 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="AllowDefaultCredentials">Allow delegating default credentials</string>
<string id="AllowDefaultCredentials_Explain">This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).
This policy setting applies when server authentication was achieved by using a trusted X509 certificate or Kerberos.
If you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you use when first logging on to Windows).
The policy becomes effective the next time the user signs on to a computer running Windows.
If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any computer. Applications depending upon this delegation behavior might fail authentication. For more information, see KB.
FWlink for KB:
http://go.microsoft.com/fwlink/?LinkId=301508
Note: The "Allow delegating default credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN.
For Example:
TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine
TERMSRV/* Remote Desktop Session Host running on all machines.
TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com</string>
<string id="AllowDefCredentialsWhenNTLMOnly">Allow delegating default credentials with NTLM-only server authentication</string>
<string id="AllowDefCredentialsWhenNTLMOnly_Explain">This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).
This policy setting applies when server authentication was achieved via NTLM.
If you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you use when first logging on to Windows).
If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any machine.
Note: The "Allow delegating default credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN.
For Example:
TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine
TERMSRV/* Remote Desktop Session Host running on all machines.
TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com</string>
<string id="AllowFreshCredentials">Allow delegating fresh credentials</string>
<string id="AllowFreshCredentials_Explain">This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).
This policy setting applies when server authentication was achieved via a trusted X509 certificate or Kerberos.
If you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application).
If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*).
If you disable this policy setting, delegation of fresh credentials is not permitted to any machine.
Note: The "Allow delegating fresh credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard is permitted when specifying the SPN.
For Example:
TERMSRV/host.humanresources.fabrikam.com
Remote Desktop Session Host running on host.humanresources.fabrikam.com machine
TERMSRV/* Remote Desktop Session Host running on all machines.
TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com</string>
<string id="AllowFreshCredentialsWhenNTLMOnly">Allow delegating fresh credentials with NTLM-only server authentication</string>
<string id="AllowFreshCredentialsWhenNTLMOnly_Explain">This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).
This policy setting applies when server authentication was achieved via NTLM.
If you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application).
If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*).
If you disable this policy setting, delegation of fresh credentials is not permitted to any machine.
Note: The "Allow delegating fresh credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN.
For Example:
TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine
TERMSRV/* Remote Desktop Session Host running on all machines.
TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com</string>
<string id="AllowSavedCredentials">Allow delegating saved credentials</string>
<string id="AllowSavedCredentials_Explain">This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).
This policy setting applies when server authentication was achieved via a trusted X509 certificate or Kerberos.
If you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager).
If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*).
If you disable this policy setting, delegation of saved credentials is not permitted to any machine.
Note: The "Allow delegating saved credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN.
For Example:
TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine
TERMSRV/* Remote Desktop Session Host running on all machines.
TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com</string>
<string id="AllowSavedCredentialsWhenNTLMOnly">Allow delegating saved credentials with NTLM-only server authentication</string>
<string id="AllowSavedCredentialsWhenNTLMOnly_Explain">This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).
This policy setting applies when server authentication was achieved via NTLM.
If you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager).
If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*) if the client machine is not a member of any domain. If the client is domain-joined, by default the delegation of saved credentials is not permitted to any machine.
If you disable this policy setting, delegation of saved credentials is not permitted to any machine.
Note: The "Allow delegating saved credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN.
For Example:
TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine
TERMSRV/* Remote Desktop Session Host running on all machines.
TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com</string>
<string id="CredentialsDelegation">Credentials Delegation</string>
<string id="DenyDefaultCredentials">Deny delegating default credentials</string>
<string id="DenyDefaultCredentials_Explain">This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).
If you enable this policy setting, you can specify the servers to which the user's default credentials cannot be delegated (default credentials are those that you use when first logging on to Windows).
If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server.
Note: The "Deny delegating default credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN.
For Example:
TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine
TERMSRV/* Remote Desktop Session Host running on all machines.
TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com
This policy setting can be used in combination with the "Allow delegating default credentials" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the "Allow delegating default credentials" server list.</string>
<string id="DenyFreshCredentials">Deny delegating fresh credentials</string>
<string id="DenyFreshCredentials_Explain">This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).
If you enable this policy setting, you can specify the servers to which the user's fresh credentials cannot be delegated (fresh credentials are those that you are prompted for when executing the application).
If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server.
Note: The "Deny delegating fresh credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN.
For Example:
TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine
TERMSRV/* Remote Desktop Session Host running on all machines.
TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com
This policy setting can be used in combination with the "Allow delegating fresh credentials" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the "Allow delegating fresh credentials" server list.</string>
<string id="DenySavedCredentials">Deny delegating saved credentials</string>
<string id="DenySavedCredentials_Explain">This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).
If you enable this policy setting, you can specify the servers to which the user's saved credentials cannot be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager).
If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server.
Note: The "Deny delegating saved credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN.
For Example:
TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine
TERMSRV/* Remote Desktop Session Host running on all machines.
TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com
This policy setting can be used in combination with the "Allow delegating saved credentials" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the "Allow delegating saved credentials" server list.</string>
<string id="RestrictedRemoteAdministration">Restrict delegation of credentials to remote servers</string>
<string id="RestrictedRemoteAdministration_Explain">When running in Restricted Admin or Remote Credential Guard mode, participating apps do not expose signed in or supplied credentials to a remote host. Restricted Admin limits access to resources located on other servers or networks from the remote host because credentials are not delegated. Remote Credential Guard does not limit access to resources because it redirects all requests back to the client device.
Participating apps:
Remote Desktop Client
If you enable this policy setting, the following options are supported:
 
Restrict credential delegation: Participating applications must use Restricted Admin or Remote Credential Guard to connect to remote hosts.
 
Require Remote Credential Guard: Participating applications must use Remote Credential Guard to connect to remote hosts.
 
Require Restricted Admin: Participating applications must use Restricted Admin to connect to remote hosts.
If you disable or do not configure this policy setting, Restricted Admin and Remote Credential Guard mode are not enforced and participating apps can delegate credentials to remote devices.
Note: To disable most credential delegation, it may be sufficient to deny delegation in Credential Security Support Provider (CredSSP) by modifying Administrative template settings (located at Computer Configuration\Administrative Templates\System\Credentials Delegation).
Note: On Windows 8.1 and Windows Server 2012 R2, enabling this policy will enforce Restricted Administration mode, regardless of the mode chosen. These versions do not support Remote Credential Guard.
</string>
<string id="SUPPORTED_VISTA">Windows Vista</string>
<string id="PreferRemoteCredentialGuard">Restrict Credential Delegation</string>
<string id="RequireRemoteCredentialGuard">Require Remote Credential Guard</string>
<string id="RequireRestrictedAdmin">Require Restricted Admin</string>
<string id="AllowProtectedCreds">Remote host allows delegation of non-exportable credentials</string>
<string id="AllowProtectedCreds_Explain">Remote host allows delegation of non-exportable credentials
When using credential delegation, devices provide an exportable version of credentials to the remote host. This exposes users to the risk of credential theft from attackers on the remote host.
If you enable this policy setting, the host supports Restricted Admin or Remote Credential Guard mode.
If you disable or do not configure this policy setting, Restricted Administration and Remote Credential Guard mode are not supported. User will always need to pass their credentials to the host.</string>
<string id="AllowEncryptionOracle">Encryption Oracle Remediation</string>
<string id="AllowEncryptionOracle_Explain">Encryption Oracle Remediation
This policy setting applies to applications using the CredSSP component (for example: Remote Desktop Connection).
Some versions of the CredSSP protocol are vulnerable to an encryption oracle attack against the client. This policy controls compatibility with vulnerable clients and servers. This policy allows you to set the level of protection desired for the encryption oracle vulnerability.
If you enable this policy setting, CredSSP version support will be selected based on the following options:
Force Updated Clients: Client applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. Note: this setting should not be deployed until all remote hosts support the newest version.
Mitigated: Client applications which use CredSSP will not be able to fall back to the insecure version but services using CredSSP will accept unpatched clients. See the link below for important information about the risk posed by remaining unpatched clients.
Vulnerable: Client applications which use CredSSP will expose the remote servers to attacks by supporting fall back to the insecure versions and services using CredSSP will accept unpatched clients.
For more information about the vulnerability and servicing requirements for protection, see https://go.microsoft.com/fwlink/?linkid=866660</string>
<string id="AllowEncryptionOracle_Force">Force Updated Clients</string>
<string id="AllowEncryptionOracle_Secure">Mitigated</string>
<string id="AllowEncryptionOracle_Allow">Vulnerable</string>
</stringTable>
<presentationTable>
<presentation id="AllowDefaultCredentials">
<listBox refId="AllowDefaultCredentials_Name">Add servers to the list:</listBox>
<checkBox refId="ConcatenateDefaults_ADC" defaultChecked="true">Concatenate OS defaults with input above</checkBox>
</presentation>
<presentation id="AllowDefCredentialsWhenNTLMOnly">
<listBox refId="AllowDefCredentialsWhenNTLMOnly_Name">Add servers to the list:</listBox>
<checkBox refId="ConcatenateDefaults_ADCN" defaultChecked="true">Concatenate OS defaults with input above</checkBox>
</presentation>
<presentation id="AllowFreshCredentials">
<listBox refId="AllowFreshCredentials_Name">Add servers to the list:</listBox>
<checkBox refId="ConcatenateDefaults_AFC" defaultChecked="true">Concatenate OS defaults with input above</checkBox>
</presentation>
<presentation id="AllowFreshCredentialsWhenNTLMOnly">
<listBox refId="AllowFreshCredentialsWhenNTLMOnly_Name">Add servers to the list:</listBox>
<checkBox refId="ConcatenateDefaults_AFCN" defaultChecked="true">Concatenate OS defaults with input above</checkBox>
</presentation>
<presentation id="AllowSavedCredentials">
<listBox refId="AllowSavedCredentials_Name">Add servers to the list:</listBox>
<checkBox refId="ConcatenateDefaults_ASC" defaultChecked="true">Concatenate OS defaults with input above</checkBox>
</presentation>
<presentation id="AllowSavedCredentialsWhenNTLMOnly">
<listBox refId="AllowSavedCredentialsWhenNTLMOnly_Name">Add servers to the list:</listBox>
<checkBox refId="ConcatenateDefaults_ASCN" defaultChecked="true">Concatenate OS defaults with input above</checkBox>
</presentation>
<presentation id="DenyDefaultCredentials">
<listBox refId="DenyDefaultCredentials_Name">Add servers to the list:</listBox>
<checkBox refId="ConcatenateDefaults_DDC" defaultChecked="true">Concatenate OS defaults with input above</checkBox>
</presentation>
<presentation id="DenyFreshCredentials">
<listBox refId="DenyFreshCredentials_Name">Add servers to the list:</listBox>
<checkBox refId="ConcatenateDefaults_DFC" defaultChecked="true">Concatenate OS defaults with input above</checkBox>
</presentation>
<presentation id="DenySavedCredentials">
<listBox refId="DenySavedCredentials_Name">Add servers to the list:</listBox>
<checkBox refId="ConcatenateDefaults_DSC" defaultChecked="true">Concatenate OS defaults with input above</checkBox>
</presentation>
<presentation id="RestrictedRemoteAdministration">
<dropdownList refId="RestrictedRemoteAdministrationDrop" defaultItem="0">Use the following restricted mode:</dropdownList>
</presentation>
<presentation id="AllowProtectedCreds">
</presentation>
<presentation id="AllowEncryptionOracle">
<dropdownList refId="AllowEncryptionOracleDrop" defaultItem="1">Protection Level:</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/CredUI.adml
+38
View File
@@ -0,0 +1,38 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="CredUI">Credential User Interface</string>
<string id="CredUI_Help">Contains settings to control the behavior of credential collection.</string>
<string id="EnumerateAdministrators">Enumerate administrator accounts on elevation</string>
<string id="EnumerateAdministrators_Help">This policy setting controls whether administrator accounts are displayed when a user attempts to elevate a running application. By default, administrator accounts are not displayed when the user attempts to elevate a running application.
If you enable this policy setting, all local administrator accounts on the PC will be displayed so the user can choose one and enter the correct password.
If you disable this policy setting, users will always be required to type a user name and password to elevate.</string>
<string id="EnableSecureCredentialPrompting">Require trusted path for credential entry</string>
<string id="EnableSecureCredentialPrompting_Help">This policy setting requires the user to enter Microsoft Windows credentials using a trusted path, to prevent a Trojan horse or other types of malicious code from stealing the user’s Windows credentials.
Note: This policy affects nonlogon authentication tasks only. As a security best practice, this policy should be enabled.
If you enable this policy setting, users will be required to enter Windows credentials on the Secure Desktop by means of the trusted path mechanism.
If you disable or do not configure this policy setting, users will enter Windows credentials within the user’s desktop session, potentially allowing malicious code access to the user’s Windows credentials.</string>
<string id="DisablePasswordReveal">Do not display the password reveal button</string>
<string id="DisablePasswordReveal_Help">This policy setting allows you to configure the display of the password reveal button in password entry user experiences.
If you enable this policy setting, the password reveal button will not be displayed after a user types a password in the password entry text box.
If you disable or do not configure this policy setting, the password reveal button will be displayed after a user types a password in the password entry text box.
By default, the password reveal button is displayed after a user types a password in the password entry text box. To display the password, click the password reveal button.
The policy applies to all Windows components and applications that use the Windows system controls, including Internet Explorer.</string>
<string id="NoLocalPasswordResetQuestions">Prevent the use of security questions for local accounts</string>
<string id="NoLocalPasswordResetQuestions_Help">If you turn this policy setting on, local users won’t be able to set up and use security questions to reset their passwords.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/CredentialProviders.adml
+100
View File
@@ -0,0 +1,100 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="DefaultLogonDomain">Assign a default domain for logon</string>
<string id="DefaultLogonDomain_Help">This policy setting specifies a default logon domain, which might be a different domain than the domain to which the computer is joined. Without this policy setting, at logon, if a user does not specify a domain for logon, the domain to which the computer belongs is assumed as the default domain. For example if the computer belongs to the Fabrikam domain, the default domain for user logon is Fabrikam.
If you enable this policy setting, the default logon domain is set to the specified domain, which might be different than the domain to which the computer is joined.
If you disable or do not configure this policy setting, the default logon domain is always set to the domain to which the computer is joined.</string>
<string id="ExcludedCredentialProviders">Exclude credential providers</string>
<string id="ExcludedCredentialProviders_Help">This policy setting allows the administrator to exclude the specified
credential providers from use during authentication.
Note: credential providers are used to process and validate user
credentials during logon or when authentication is required.
Windows Vista provides two default credential providers:
Password and Smart Card. An administrator can install additional
credential providers for different sets of credentials
(for example, to support biometric authentication).
If you enable this policy, an administrator can specify the CLSIDs
of the credential providers to exclude from the set of installed
credential providers available for authentication purposes.
If you disable or do not configure this policy, all installed and otherwise enabled credential providers are available for authentication purposes.</string>
<string id="Logon">Logon</string>
<string id="AllowDomainPINLogon">Turn on convenience PIN sign-in</string>
<string id="AllowDomainPINLogon_Help">This policy setting allows you to control whether a domain user can sign in using a convenience PIN.
If you enable this policy setting, a domain user can set up and sign in with a convenience PIN.
If you disable or don't configure this policy setting, a domain user can't set up and use a convenience PIN.
Note: The user's domain password will be cached in the system vault when using this feature.
To configure Windows Hello for Business, use the Administrative Template policies under Windows Hello for Business.</string>
<string id="BlockDomainPicturePassword">Turn off picture password sign-in</string>
<string id="BlockDomainPicturePassword_Help">This policy setting allows you to control whether a domain user can sign in using a picture password.
If you enable this policy setting, a domain user can't set up or sign in with a picture password.
If you disable or don't configure this policy setting, a domain user can set up and use a picture password.
Note that the user's domain password will be cached in the system vault when using this feature.</string>
<string id="AllowDomainDelayLock">Allow users to select when a password is required when resuming from connected standby</string>
<string id="AllowDomainDelayLock_Help">This policy setting allows you to control whether a user can change the time before a password is required when a Connected Standby device screen turns off.
If you enable this policy setting, a user on a Connected Standby device can change the amount of time after the device's screen turns off before a password is required when waking the device. The time is limited by any EAS settings or Group Policies that affect the maximum idle time before a device locks. Additionally, if a password is required when a screensaver turns on, the screensaver timeout will limit the options the user may choose.
If you disable this policy setting, a user cannot change the amount of time after the device's screen turns off before a password is required when waking the device. Instead, a password is required immediately after the screen turns off.
If you don't configure this policy setting on a domain-joined device, a user cannot change the amount of time after the device's screen turns off before a password is required when waking the device. Instead, a password is required immediately after the screen turns off.
If you don't configure this policy setting on a workgroup device, a user on a Connected Standby device can change the amount of time after the device's screen turns off before a password is required when waking the device. The time is limited by any EAS settings or Group Policies that affect the maximum idle time before a device locks. Additionally, if a password is required when a screensaver turns on, the screensaver timeout will limit the options the user may choose.</string>
<string id="DefaultCredentialProvider">Assign a default credential provider</string>
<string id="DefaultCredentialProvider_Help">This policy setting allows the administrator to assign a specified credential provider as the default credential provider.
If you enable this policy setting, the specified credential provider is selected on other user tile.
If you disable or do not configure this policy setting, the system picks the default credential provider on other user tile.
Note: A list of registered credential providers and their GUIDs can be found in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers.</string>
<string id="AllowSecurityKeySignIn">Turn on security key sign-in</string>
<string id="AllowSecurityKeySignIn_Help">This policy setting allows you to control whether users can sign in using external security keys.
If you enable this policy setting, users can sign in with external security keys.
If you disable or don't configure this policy setting, users can't sign in with external security keys.</string>
</stringTable>
<presentationTable>
<presentation id="DefaultLogonDomain">
<textBox refId="DefaultLogonDomain_Message">
<label>Default Logon domain:</label>
</textBox>
<text>Enter the name of the domain</text>
</presentation>
<presentation id="ExcludedCredentialProviders">
<textBox refId="ExcludedCredentialProviders_Message">
<label>Exclude the following credential providers:</label>
</textBox>
<text>Enter the comma-separated CLSIDs for multiple credential providers
to be excluded from use during authentication.
For example: {ba0dd1d5-9754-4ba3-973c-40dce7901283},{383f1aa4-65dd-45bc-9f5a-ddd2f222f07d}</text>
</presentation>
<presentation id="DefaultCredentialProvider">
<textBox refId="DefaultCredentialProvider_Message">
<label>Assign the following credential provider as the default credential provider:</label>
</textBox>
<text>Enter the CLSID of a credential provider to be the default credential provider.
For example: {ba0dd1d5-9754-4ba3-973c-40dce7901283}</text>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/CtrlAltDel.adml
+43
View File
@@ -0,0 +1,43 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="CADOptions">Ctrl+Alt+Del Options</string>
<string id="DisableChangePassword">Remove Change Password</string>
<string id="DisableChangePassword_Help">This policy setting prevents users from changing their Windows password on demand.
If you enable this policy setting, the 'Change Password' button on the Windows Security dialog box will not appear when you press Ctrl+Alt+Del.
However, users are still able to change their password when prompted by the system. The system prompts users for a new password when an administrator requires a new password or their password is expiring.</string>
<string id="DisableLockComputer">Remove Lock Computer</string>
<string id="DisableLockComputer_Help">This policy setting prevents users from locking the system.
While locked, the desktop is hidden and the system cannot be used. Only the user who locked the system or the system administrator can unlock it.
If you enable this policy setting, users cannot lock the computer from the keyboard using Ctrl+Alt+Del.
If you disable or do not configure this policy setting, users will be able to lock the computer from the keyboard using Ctrl+Alt+Del.
Tip:To lock a computer without configuring a setting, press Ctrl+Alt+Delete, and then click Lock this computer.</string>
<string id="DisableTaskMgr">Remove Task Manager</string>
<string id="DisableTaskMgr_Help">This policy setting prevents users from starting Task Manager.
Task Manager (taskmgr.exe) lets users start and stop programs; monitor the performance of their computers; view and monitor all programs running on their computers, including system services; find the executable names of programs; and change the priority of the process in which programs run.
If you enable this policy setting, users will not be able to access Task Manager. If users try to start Task Manager, a message appears explaining that a policy prevents the action.
If you disable or do not configure this policy setting, users can access Task Manager to start and stop programs, monitor the performance of their computers, view and monitor all programs running on their computers, including system services, find the executable names of programs, and change the priority of the process in which programs run.</string>
<string id="NoLogoff">Remove Logoff</string>
<string id="NoLogOff_Help">This policy setting disables or removes all menu items and buttons that log the user off the system.
If you enable this policy setting, users will not see the Log off menu item when they press Ctrl+Alt+Del. This will prevent them from logging off unless they restart or shutdown the computer, or clicking Log off from the Start menu.
Also, see the 'Remove Logoff on the Start Menu' policy setting.
If you disable or do not configure this policy setting, users can see and select the Log off menu item when they press Ctrl+Alt+Del.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DCOM.adml
+51
View File
@@ -0,0 +1,51 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="DCOM">Distributed COM</string>
<string id="DCOMActivationSecurityCheckAllowLocalList">Allow local activation security check exemptions</string>
<string id="DCOMActivationSecurityCheckAllowLocalList_Explain">Allows you to specify that local computer administrators can supplement the "Define Activation Security Check exemptions" list.
If you enable this policy setting, and DCOM does not find an explicit entry for a DCOM server application id (appid) in the "Define Activation Security Check exemptions" policy (if enabled), DCOM will look for an entry in the locally configured list.
If you disable this policy setting, DCOM will not look in the locally configured DCOM activation security check exemption list.
If you do not configure this policy setting, DCOM will only look in the locally configured exemption list if the "Define Activation Security Check exemptions" policy is not configured.
</string>
<string id="DCOMActivationSecurityCheckExemptionList">Define Activation Security Check exemptions</string>
<string id="DCOMActivationSecurityCheckExemptionList_Explain">Allows you to view and change a list of DCOM server application ids (appids) which are exempted from the DCOM Activation security check. DCOM uses two such lists, one configured via Group Policy through this policy setting, and the other via the actions of local computer administrators. DCOM ignores the second list when this policy setting is configured, unless the "Allow local activation security check exemptions" policy is enabled.
DCOM server appids added to this policy must be listed in curly-brace format. For example: {b5dcb061-cefb-42e0-a1be-e6a6438133fe}. If you enter a non-existent or improperly formatted appid DCOM will add it to the list without checking for errors.
If you enable this policy setting, you can view and change the list of DCOM activation security check exemptions defined by Group Policy settings. If you add an appid to this list and set its value to 1, DCOM will not enforce the Activation security check for that DCOM server. If you add an appid to this list and set its value to 0 DCOM will always enforce the Activation security check for that DCOM server regardless of local settings.
If you disable this policy setting, the appid exemption list defined by Group Policy is deleted, and the one defined by local computer administrators is used.
If you do not configure this policy setting, the appid exemption list defined by local computer administrators is used.
Notes:
The DCOM Activation security check is done after a DCOM server process is started, but before an object activation request is dispatched to the server process. This access check is done against the DCOM server's custom launch permission security descriptor if it exists, or otherwise against the configured defaults.
If the DCOM server's custom launch permission contains explicit DENY entries this may mean that object activations that would have previously succeeded for such specified users, once the DCOM server process was up and running, might now fail instead. The proper action in this situation is to re-configure the DCOM server's custom launch permission settings for correct security settings, but this policy setting may be used in the short-term as an application compatibility deployment aid.
DCOM servers added to this exemption list are only exempted if their custom launch permissions do not contain specific LocalLaunch, RemoteLaunch, LocalActivate, or RemoteActivate grant or deny entries for any users or groups. Also note, exemptions for DCOM Server Appids added to this list will apply to both 32-bit and 64-bit versions of the server if present.</string>
<string id="DCOMAppCompatPolicies">Application Compatibility Settings</string>
</stringTable>
<presentationTable>
<presentation id="DCOMActivationSecurityCheckExemptionList">
<text>Enter DCOM server appids paired with an action value listed below.</text>
<text>The appid should include the opening and closing curly braces.</text>
<text> </text>
<listBox refId="DCOM_Lbl_ActSecCheckExemptionList">Add\remove DCOM servers to the exemption list: </listBox>
<text> </text>
<text>Values:</text>
<text>0 = The specified appid is not exempt from the Activation security check</text>
<text>1 = The specified appid is exempt from the Activation security check</text>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DFS.adml
+23
View File
@@ -0,0 +1,23 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="DFSDiscoverDC">Configure how often a DFS client discovers domain controllers</string>
<string id="DFSDiscoverDC_Help">This policy setting allows you to configure how often a Distributed File System (DFS) client attempts to discover domain controllers on a network. By default, a DFS client attempts to discover domain controllers every 15 minutes.
If you enable this policy setting, you can configure how often a DFS client attempts to discover domain controllers. This value is specified in minutes.
If you disable or do not configure this policy setting, the default value of 15 minutes applies.
Note: The minimum value you can select is 15 minutes. If you try to set this setting to a value less than 15 minutes, the default value of 15 minutes is applied.</string>
</stringTable>
<presentationTable>
<presentation id="DFSDiscoverDC">
<decimalTextBox refId="DFSDiscoverDialog" defaultValue="15">Time in minutes:</decimalTextBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DWM.adml
+66
View File
@@ -0,0 +1,66 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="CAT_DesktopWindowManager">Desktop Window Manager</string>
<string id="CAT_DesktopWindowManagerColorization">Window Frame Coloring</string>
<string id="DwmDefaultColorizationColor">Specify a default color</string>
<string id="DwmDefaultColorizationColorExplain">This policy setting controls the default color for window frames when the user does not specify a color.
If you enable this policy setting and specify a default color, this color is used in glass window frames, if the user does not specify a color.
If you disable or do not configure this policy setting, the default internal color is used, if the user does not specify a color.
Note: This policy setting can be used in conjunction with the "Prevent color changes of window frames" setting, to enforce a specific color for window frames that cannot be changed by users.</string>
<string id="DwmDisallowAnimations">Do not allow window animations</string>
<string id="DwmDisallowAnimationsExplain">This policy setting controls the appearance of window animations such as those found when restoring, minimizing, and maximizing windows.
If you enable this policy setting, window animations are turned off.
If you disable or do not configure this policy setting, window animations are turned on.
Changing this policy setting requires a logoff for it to be applied.</string>
<string id="DwmDisallowColorizationColorChanges">Do not allow color changes</string>
<string id="DwmDisallowColorizationColorChangesExplain">This policy setting controls the ability to change the color of window frames.
If you enable this policy setting, you prevent users from changing the default window frame color.
If you disable or do not configure this policy setting, you allow users to change the default window frame color.
Note: This policy setting can be used in conjunction with the "Specify a default color for window frames" policy setting, to enforce a specific color for window frames that cannot be changed by users.</string>
<string id="DwmDisallowFlip3D">Do not allow Flip3D invocation</string>
<string id="DwmDisallowFlip3DExplain">This policy setting allows you to configure the accessibility of the Flip 3D feature. Flip 3D allows the user to view items on the Windows desktop as they are being flipped through in three dimensions.
If you enable this policy setting, Flip 3D is inaccessible.
If you disable or do not configure this policy setting, Flip 3D is accessible, if desktop composition is turned on. When Windows Flip 3D is activated with the Windows+Tab keys, a visual version of the desktop is presented and items can be flipped through to select.
Changing this policy setting requires a logoff for it to be applied.</string>
<string id="DwmDisableAccentAndGradient">Use solid color for Start background</string>
<string id="DwmDisableAccentAndGradientExplain">This policy setting controls the Start background visuals.
If you enable this policy setting, the Start background will use a solid color.
If you disable or do not configure this policy setting, the Start background will use the default visuals.
Note: If this policy setting is enabled, users can continue to select a color in Start Personalization. However, setting the accent will have no effect.</string>
</stringTable>
<presentationTable>
<presentation id="DwmDefaultColorizationColor_1">
<decimalTextBox refId="DwmDefaultColorizationColorAlpha">Alpha</decimalTextBox>
<decimalTextBox refId="DwmDefaultColorizationColorRed">Red</decimalTextBox>
<decimalTextBox refId="DwmDefaultColorizationColorGreen">Green</decimalTextBox>
<decimalTextBox refId="DwmDefaultColorizationColorBlue">Blue</decimalTextBox>
</presentation>
<presentation id="DwmDefaultColorizationColor_2">
<decimalTextBox refId="DwmDefaultColorizationColorAlpha">Alpha</decimalTextBox>
<decimalTextBox refId="DwmDefaultColorizationColorRed">Red</decimalTextBox>
<decimalTextBox refId="DwmDefaultColorizationColorGreen">Green</decimalTextBox>
<decimalTextBox refId="DwmDefaultColorizationColorBlue">Blue</decimalTextBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DataCollection.adml
+234
View File
@@ -0,0 +1,234 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2015 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="AllowTelemetry">Allow Diagnostic Data</string>
<string id="AllowTelemetry_0">Diagnostic data off (not recommended)</string>
<string id="AllowTelemetry_1">Send required diagnostic data</string>
<string id="AllowTelemetry_3">Send optional diagnostic data</string>
<string id="AllowTelemetry_Explain">By configuring this policy setting you can adjust what diagnostic data is collected from Windows. This policy setting also restricts the user from increasing the amount of diagnostic data collection via the Settings app. The diagnostic data collected under this policy impacts the operating system and apps that are considered part of Windows and does not apply to any additional apps installed by your organization.
- Diagnostic data off (not recommended). Using this value, no diagnostic data is sent from the device. This value is only supported on Enterprise, Education, and Server editions.
- Send required diagnostic data. This is the minimum diagnostic data necessary to keep Windows secure, up to date, and performing as expected. Using this value disables the "Optional diagnostic data" control in the Settings app.
- Send optional diagnostic data. Additional diagnostic data is collected that helps us to detect, diagnose and fix issues, as well as make product improvements. Required diagnostic data will always be included when you choose to send optional diagnostic data. Optional diagnostic data can also include diagnostic log files and crash dumps. Use the "Limit Dump Collection" and the "Limit Diagnostic Log Collection" policies for more granular control of what optional diagnostic data is sent.
If you disable or do not configure this policy setting, the device will send required diagnostic data and the end user can choose whether to send optional diagnostic data from the Settings app.
Note:
The "Configure diagnostic data opt-in settings user interface" group policy can be used to prevent end users from changing their data collection settings.
</string>
<string id="TelemetryProxy">Configure Connected User Experiences and Telemetry</string>
<string id="TelemetryProxy_Explain">With this policy setting, you can forward Connected User Experience and Telemetry requests to a proxy server.
If you enable this policy setting, you can specify the FQDN or IP address of the destination device within your organization's network (and optionally a port number, if desired). The connection will be made over a Secure Sockets Layer (SSL) connection. If the named proxy fails, or if you disable or do not configure this policy setting, Connected User Experience and Telemetry data will be sent to Microsoft using the default proxy configuration.
The format for this setting is &lt;server&gt;:&lt;port&gt;
</string>
<string id="CommercialId">Configure the Commercial ID</string>
<string id="CommercialId_Explain">This policy setting defines the identifier used to uniquely associate this device’s diagnostic data data as belonging to a given organization. If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program.
If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its diagnostic data data with your organization.
</string>
<string id="DisableEnterpriseAuthProxy">Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service</string>
<string id="DisableEnterpriseAuthProxy_1">Enable Authenticated Proxy usage</string>
<string id="DisableEnterpriseAuthProxy_2">Disable Authenticated Proxy usage</string>
<string id="DisableEnterpriseAuthProxy_Explain">This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy.</string>
<string id="LimitEnhancedDiagnosticDataWindowsAnalytics">Limit optional diagnostic data for Desktop Analytics</string>
<string id="LimitEnhancedDiagnosticDataWindowsAnalytics_1">Enable Desktop Analytics collection</string>
<string id="LimitEnhancedDiagnosticDataWindowsAnalytics_2">Disable Desktop Analytics collection</string>
<string id="LimitEnhancedDiagnosticDataWindowsAnalytics_Explain">This policy setting, in combination with the "Allow Diagnostic Data" policy setting, enables organizations to send the minimum data required by Desktop Analytics.
To enable the behavior described above, complete the following steps:
1. Enable this policy setting
2. Set the "Allow Diagnostic Data" policy to "Send optional diagnostic data"
3. Enable the "Limit Dump Collection" policy
4. Enable the "Limit Diagnostic Log Collection" policy
When these policies are configured, Microsoft will collect only required diagnostic data and the events required by Desktop Analytics, which can be viewed at https://go.microsoft.com/fwlink/?linkid=2116020.
If you disable or do not configure this policy setting, diagnostic data collection is determined by the "Allow Diagnostic Data" policy setting or by the end user from the Settings app.
</string>
<string id="AllowDeviceNameInDiagnosticData">Allow device name to be sent in Windows diagnostic data</string>
<string id="AllowDeviceNameInDiagnosticData_Explain">This policy allows the device name to be sent to Microsoft as part of Windows diagnostic data.
If you disable or do not configure this policy setting, then device name will not be sent to Microsoft as part of Windows diagnostic data.
</string>
<string id="ConfigureTelemetryOptInSettingsUx">Configure diagnostic data opt-in settings user interface</string>
<string id="ConfigureTelemetryOptInSettingsUx_1">Disable diagnostic data opt-in settings</string>
<string id="ConfigureTelemetryOptInSettingsUx_2">Enable diagnostic data opt-in setings</string>
<string id="ConfigureTelemetryOptInSettingsUx_Explain">This policy setting determines whether an end user can change diagnostic data settings in the Settings app.
If you set this policy setting to "Disable diagnostic data opt-in settings", diagnostic data settings are disabled in the Settings app.
If you don't configure this policy setting, or you set it to "Enable diagnostic data opt-in settings", end users can change the device diagnostic settings in the Settings app.
Note:
To set a limit on the amount of diagnostic data that is sent to Microsoft by your organization, use the "Allow Diagnostic Data" policy setting.
</string>
<string id="ConfigureTelemetryOptInChangeNotification">Configure diagnostic data opt-in change notifications</string>
<string id="ConfigureTelemetryOptInChangeNotification_1">Disable diagnostic data change notifications</string>
<string id="ConfigureTelemetryOptInChangeNotification_2">Enable diagnostic data change notifications</string>
<string id="ConfigureTelemetryOptInChangeNotification_Explain">This policy setting controls whether notifications are shown, following a change to diagnostic data opt-in settings, on first logon and when the changes occur in settings.
If you set this policy setting to "Disable diagnostic data change notifications", diagnostic data opt-in change notifications will not appear.
If you set this policy setting to "Enable diagnostic data change notifications" or don't configure this policy setting, diagnostic data opt-in change notifications appear at first logon and when the changes occur in Settings.
</string>
<string id="DisableDeviceDelete">Disable deleting diagnostic data</string>
<string id="DisableDeviceDelete_Explain">This policy setting controls whether the Delete diagnostic data button is enabled in Diagnostic &amp; feedback Settings page.
If you enable this policy setting, the Delete diagnostic data button will be disabled in Settings page, preventing the deletion of diagnostic data collected by Microsoft from the device.
If you disable or don't configure this policy setting, the Delete diagnostic data button will be enabled in Settings page, which allows people to erase all diagnostic data collected by Microsoft from that device.
</string>
<string id="DisableDiagnosticDataViewer">Disable diagnostic data viewer</string>
<string id="DisableDiagnosticDataViewer_Explain">This policy setting controls whether users can enable and launch the Diagnostic Data Viewer from the Diagnostic &amp; feedback Settings page.
If you enable this policy setting, the Diagnostic Data Viewer will not be enabled in Settings page, and it will prevent the viewer from showing diagnostic data collected by Microsoft from the device.
If you disable or don't configure this policy setting, the Diagnostic Data Viewer will be enabled in Settings page.
</string>
<string id="ConfigureMicrosoft365UploadEndpoint">Configure diagnostic data upload endpoint for Desktop Analytics</string>
<string id="ConfigureMicrosoft365UploadEndpoint_Explain">This policy sets the upload endpoint for this device’s diagnostic data as part of the Desktop Analytics program.
If your organization is participating in the program and has been instructed to configure a custom upload endpoint, then use this setting to define that endpoint.
The value for this setting will be provided by Microsoft as part of the onboarding process for the program.
</string>
<string id="AllowUpdateComplianceProcessing">Allow Update Compliance Processing</string>
<string id="AllowUpdateComplianceProcessing_Explain">
This policy is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows.
This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at https://go.microsoft.com/fwlink/?linkid=2185086.
To enable this behavior:
1. Enable this policy setting
2. Join an Azure Active Directory account to the device
3. Set Allow Telemetry to value 1 - Required, or higher
4. Set the Configure the Commercial ID setting for your Update Compliance workspace
When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments.
If you disable or do not configure this policy setting, devices will not appear in Update Compliance.
</string>
<string id="AllowDesktopAnalyticsProcessing">Allow Desktop Analytics Processing</string>
<string id="AllowDesktopAnalyticsProcessing_Explain">
This policy is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows.
This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor for Windows diagnostic data collected from the device, subject to the Product Terms at https://go.microsoft.com/fwlink/?linkid=2185086.
To enable this behavior:
1. Enable this policy setting
2. Join an Azure Active Directory account to the device
3. Set Allow Telemetry to value 1 - Required, or higher
4. Set the Configure the Commercial ID setting for your Desktop Analytics workspace
When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments.
This setting has no effect on devices unless they are properly enrolled in Desktop Analytics. If you disable this policy setting, devices will not appear in Desktop Analytics.
</string>
<string id="AllowWUfBCloudProcessing">Allow WUfB Cloud Processing</string>
<string id="AllowWUfBCloudProcessing_Explain">
This policy is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows.
This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at https://go.microsoft.com/fwlink/?linkid=2185086.
To enable this behavior:
1. Enable this policy setting
2. Join an Azure Active Directory account to the device
3. Set Allow Telemetry to value 1 - Required, or higher
When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments.
If you disable or do not configure this policy setting, devices enrolled to the Windows Update for Business deployment service will not be able to take advantage of some deployment service features.
</string>
<string id="AllowCommercialDataPipeline">Allow commercial data pipeline</string>
<string id="AllowCommercialDataPipeline_Explain">
This policy is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows.
AllowCommercialDataPipeline configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at https://go.microsoft.com/fwlink/?linkid=2185086.
To enable this behavior:
1. Enable this policy setting
2. Join an Azure Active Directory account to the device
Windows diagnostic data is collected when the Allow Telemetry policy setting is set to value 1 - Required or above. Configuring this setting does not change the Windows diagnostic data collection level set for the device.
If you disable or do not configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft's privacy statement at https://go.microsoft.com/fwlink/?LinkId=521839 unless you have enabled policies like 'Allow Update Compliance Processing' or 'Allow Desktop Analytics Processing'.
See the documentation at https://go.microsoft.com/fwlink/?linkid=2011107 for information on this and other policies that will result in Microsoft being the processor of Windows diagnostic data.
</string>
<string id="LimitDiagnosticLogCollection">Limit Diagnostic Log Collection</string>
<string id="LimitDiagnosticLogCollection_Explain">This policy setting controls whether additional diagnostic logs are collected when more information is needed to troubleshoot a problem on the device. Diagnostic logs are only sent when the device has been configured to send optional diagnostic data.
By enabling this policy setting, diagnostic logs will not be collected.
If you disable or do not configure this policy setting, we may occasionally collect diagnostic logs if the device has been configured to send optional diagnostic data.
</string>
<string id="LimitDumpCollection">Limit Dump Collection</string>
<string id="LimitDumpCollection_Explain">This policy setting limits the type of dumps that can be collected when more information is needed to troubleshoot a problem. Dumps are only sent when the device has been configured to send optional diagnostic data.
By enabling this setting, Windows Error Reporting is limited to sending kernel mini dumps and user mode triage dumps.
If you disable or do not configure this policy setting, we may occasionally collect full or heap dumps if the user has opted to send optional diagnostic data.
</string>
<string id="EnableOneSettingsAuditing">Enable OneSettings Auditing</string>
<string id="EnableOneSettingsAuditing_Explain">This policy setting controls whether Windows records attempts to connect with the OneSettings service to the EventLog.
If you enable this policy, Windows will record attempts to connect with the OneSettings service to the Microsoft\Windows\Privacy-Auditing\Operational EventLog channel.
If you disable or don't configure this policy setting, Windows will not record attempts to connect with the OneSettings service to the EventLog.
</string>
<string id="DisableOneSettingsDownloads">Disable OneSettings Downloads</string>
<string id="DisableOneSettingsDownloads_Explain">This policy setting controls whether Windows attempts to connect with the OneSettings service.
If you enable this policy, Windows will not attempt to connect with the OneSettings Service.
If you disable or don't configure this policy setting, Windows will periodically attempt to connect with the OneSettings service to download configuration settings.
</string>
</stringTable>
<presentationTable>
<presentation id="AllowTelemetry">
<dropdownList refId="AllowTelemetry" noSort="true" defaultItem="1"></dropdownList>
</presentation>
<presentation id="TelemetryProxy">
<textBox refId="TelemetryProxyName">
<label>Proxy Server Name:</label>
</textBox>
</presentation>
<presentation id="CommercialID">
<textBox refId="CommercialIdValue">
<label>Commercial Id:</label>
</textBox>
</presentation>
<presentation id="DisableEnterpriseAuthProxy">
<dropdownList refId="DisableEnterpriseAuthProxy" noSort="true" defaultItem="1"></dropdownList>
</presentation>
<presentation id="LimitEnhancedDiagnosticDataWindowsAnalytics">
<dropdownList refId="LimitEnhancedDiagnosticDataWindowsAnalytics" noSort="true" defaultItem="0"></dropdownList>
</presentation>
<presentation id="ConfigureTelemetryOptInSettingsUx">
<dropdownList refId="ConfigureTelemetryOptInSettingsUx" noSort="true" defaultItem="0"></dropdownList>
</presentation>
<presentation id="ConfigureTelemetryOptInChangeNotification">
<dropdownList refId="ConfigureTelemetryOptInChangeNotification" noSort="true" defaultItem="0"></dropdownList>
</presentation>
<presentation id="ConfigureMicrosoft365UploadEndpoint">
<textBox refId="ConfigureMicrosoft365UploadEndpointValue">
<label>Desktop Analytics Custom Upload Endpoint:</label>
</textBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DeliveryOptimization.adml
+345
View File
@@ -0,0 +1,345 @@
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0">
<displayName>Delivery Optimization GP</displayName>
<description>This file describes the Delivery Optimization GP settings</description>
<resources>
<stringTable>
<string id="DeliveryOptimizationCat">Delivery Optimization</string>
<string id="DownloadMode">Download Mode</string>
<string id="DownloadMode_Help">Specifies the download method that Delivery Optimization can use in downloads of Windows Updates, Apps and App updates.
The following list shows the supported values:
0 = HTTP only, no peering.
1 = HTTP blended with peering behind the same NAT.
2 = HTTP blended with peering across a private group. Peering occurs on devices in the same Active Directory Site (if exist) or the same domain by default. When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2.
3 = HTTP blended with Internet Peering.
99 = Simple download mode with no peering. Delivery Optimization downloads using HTTP only and does not attempt to contact the Delivery Optimization cloud services.
100 = Bypass mode. Windows 10: Do not use Delivery Optimization and use BITS instead. Windows 11: Deprecated, use Simple mode instead.</string>
<string id="DownloadMode_CdnOnly">HTTP only (0)</string>
<string id="DownloadMode_Lan">LAN (1)</string>
<string id="DownloadMode_Group">Group (2)</string>
<string id="DownloadMode_Internet">Internet (3)</string>
<string id="DownloadMode_Simple">Simple (99)</string>
<string id="DownloadMode_Bypass">Bypass (100)</string>
<string id="GroupId">Group ID</string>
<string id="GroupId_Help">Group ID must be set as a GUID. This Policy specifies an arbitrary group ID that the device belongs to.
Use this if you need to create a single group for Local Network Peering for branches that are on different domains or are not on the same LAN.
Note: this is a best effort optimization and should not be relied on for an authentication of identity.</string>
<string id="MaxCacheSize">Max Cache Size (percentage)</string>
<string id="MaxCacheSize_Help">Specifies the maximum cache size that Delivery Optimization uses as a percentage of available disk size (1-100).</string>
<string id="AbsoluteMaxCacheSize">Absolute Max Cache Size (in GB)</string>
<string id="AbsoluteMaxCacheSize_Help">Specifies the maximum size in GB of Delivery Optimization cache.
This policy overrides the DOMaxCacheSize policy.
The value 0 (zero) means "unlimited" cache; Delivery Optimization will clear the cache when the device runs low on disk space.</string>
<string id="MaxCacheAge">Max Cache Age (in seconds)</string>
<string id="MaxCacheAge_Help">Specifies the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully.
The value 0 (zero) means "unlimited"; Delivery Optimization will hold the files in the cache longer and make the files available for uploads to other devices, as long as the cache size has not exceeded.</string>
<string id="MonthlyUploadDataCap">Monthly Upload Data Cap (in GB)</string>
<string id="MonthlyUploadDataCap_Help">Specifies the maximum total bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month.
The value 0 (zero) means "unlimited"; No monthly upload limit is applied if 0 is set.</string>
<string id="MinBackgroundQos">Minimum Background QoS (in KB/s)</string>
<string id="MinBackgroundQos_Help">Specifies the minimum download QoS (Quality of Service or speed) for background downloads in KiloBytes/second.
This policy affects the blending of peer and HTTP sources. Delivery Optimization complements the download from HTTP source to achieve the specified minimum QoS value.</string>
<string id="ModifyCacheDrive">Modify Cache Drive</string>
<string id="ModifyCacheDrive_Help">Specifies the drive Delivery Optimization shall use for its cache.
By default, %SystemDrive% is used to store the cache. The drive location can be specified using environment variables, drive letter or using a full path.</string>
<string id="MaxBackgroundDownloadBandwidth">Maximum Background Download Bandwidth (in KB/s)</string>
<string id="MaxBackgroundDownloadBandwidth_Help">Specifies the maximum background download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization.
The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads.
</string>
<string id="MaxForegroundDownloadBandwidth">Maximum Foreground Download Bandwidth (in KB/s)</string>
<string id="MaxForegroundDownloadBandwidth_Help">Specifies the maximum foreground download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization.
The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads.
</string>
<string id="PercentageMaxBackgroundBandwidth">Maximum Background Download Bandwidth (percentage)</string>
<string id="PercentageMaxBackgroundBandwidth_Help">Specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth.
The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for background downloads.</string>
<string id="PercentageMaxForegroundBandwidth">Maximum Foreground Download Bandwidth (percentage)</string>
<string id="PercentageMaxForegroundBandwidth_Help">Specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth.
The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads.</string>
<string id="MinFileSizeToCache">Minimum Peer Caching Content File Size (in MB)</string>
<string id="MinFileSizeToCache_Help">Specifies the minimum content file size in MB enabled to use Peer Caching.
Recommended values: 1 MB to 100000 MB.</string>
<string id="AllowVPNPeerCaching">Enable Peer Caching while the device connects via VPN</string>
<string id="AllowVPNPeerCaching_Help">Specify "true" to allow the device to participate in Peer Caching while connected via VPN to the domain network.
This means the device can download from or upload to other domain network devices, either on VPN or on the corporate domain network.</string>
<string id="MinRAMAllowedToPeer">Minimum RAM capacity (inclusive) required to enable use of Peer Caching (in GB)</string>
<string id="MinRAMAllowedToPeer_Help">Specifies the minimum RAM size in GB required to use Peer Caching.
For example if the minimum set is 1 GB, then devices with 1 GB or higher available RAM will be allowed to use Peer caching.
Recommended values: 1 GB to 4 GB.</string>
<string id="MinDiskSizeAllowedToPeer">Minimum disk size allowed to use Peer Caching (in GB)</string>
<string id="MinDiskSizeAllowedToPeer_Help">Specifies the required minimum disk size (capacity in GB) for the device to use Peer Caching. The cloud service set default value will be used.
Recommended values: 64 GB to 256 GB.
Note: If the DOModifyCacheDrive policy is set, the disk size check will apply to the new working directory specified by this policy.</string>
<string id="MinBatteryPercentageAllowedToUpload">Allow uploads while the device is on battery while under set Battery level (percentage)</string>
<string id="MinBatteryPercentageAllowedToUpload_Help">Specify any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and Group peers while on DC power (Battery).
The recommended value to set if you allow uploads on battery is 40 (for 40%). The device can download from peers while on battery regardless of this policy.
The value 0 means "not-limited"; The cloud service set default value will be used.</string>
<string id="CacheHost">Cache Server Hostname</string>
<string id="CacheHost_Help">This policy allows you to set one or more Microsoft Connected Cache servers that will be used by your client(s).
One or more values can be added as either fully qualified domain names (FQDN) or IP addresses. To add multiple values, separate each FQDN or IP address by commas.
</string>
<string id="CacheHostSource">Cache Server Hostname Source</string>
<string id="CacheHostSource_Help">This policy allows you to specify how your client(s) can discover Microsoft Connected Cache servers dynamically.
Options available are:
0 = Disable DNS-SD.
1 = DHCP Option 235.
2 = DHCP Option 235 Force.
If this policy is not configured, the client will attempt to automatically find a cache server using DNS-SD. If set to 0, the client will not use DNS-SD to automatically find a cache server. If set to 1 or 2, the client will query DHCP Option ID 235 and use the returned value as the Cache Server Hostname. Option 2 overrides the Cache Server Hostname policy, if configured.</string>
<string id="CacheHostSource_DHCP">DHCP Option 235</string>
<string id="CacheHostSource_DHCP_Force">DHCP Option 235 Force</string>
<string id="GroupIdSource">Select the source of Group IDs</string>
<string id="GroupIdSource_Help">Set this policy to restrict peer selection to a specific source.
Options available are:
1 = AD Site.
2 = Authenticated domain SID.
3 = DHCP Option ID.
4 = DNS Suffix.
5 = AAD Tenant ID.
When set, the Group ID will be assigned automatically from the selected source. This policy is ignored if the GroupID policy is also set.
The options set in this policy only apply to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored.
For option 3 - DHCP Option ID, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID.</string>
<string id="GroupIdSource_Unset">Unset (0)</string>
<string id="GroupIdSource_AD">AD Site (1)</string>
<string id="GroupIdSource_SID">Authenticated domain SID (2)</string>
<string id="GroupIdSource_DHCP">DHCP Option ID (3)</string>
<string id="GroupIdSource_DNS">DNS Suffix (4)</string>
<string id="GroupIdSource_AAD">AAD Tenant ID (5)</string>
<string id="DelayBackgroundDownloadFromHttp">Delay background download from http (in secs)</string>
<string id="DelayBackgroundDownloadFromHttp_Help">This policy allows you to delay the use of an HTTP source in a background download that is allowed to use P2P.
After the max delay has reached, the download will resume using HTTP, either downloading the entire payload or complementing the bytes that could not be downloaded from Peers.
Note that a download that is waiting for peer sources, will appear to be stuck for the end user.
The recommended value is 1 hour (3600).</string>
<string id="DelayForegroundDownloadFromHttp">Delay Foreground download from http (in secs)</string>
<string id="DelayForegroundDownloadFromHttp_Help">This policy allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use P2P.
After the max delay has reached, the download will resume using HTTP, either downloading the entire payload or complementing the bytes that could not be downloaded from Peers.
Note that a download that is waiting for peer sources, will appear to be stuck for the end user.
The recommended value is 1 minute (60).</string>
<string id="DelayCacheServerFallbackBackground">Delay Background download Cache Server fallback (in seconds)</string>
<string id="DelayCacheServerFallbackBackground_Help">Set this policy to delay the fallback from Cache Server to the HTTP source for a background content download by X seconds.
Note: if you set the policy to delay background download from http, it will apply first (to allow downloads from peers first).</string>
<string id="DelayCacheServerFallbackForeground">Delay Foreground download Cache Server fallback (in seconds)</string>
<string id="DelayCacheServerFallbackForeground_Help">Set this policy to delay the fallback from Cache Server to the HTTP source for a foreground content download by X seconds.
Note: if you set the policy to delay foreground download from http, it will apply first (to allow downloads from peers first).</string>
<string id="RestrictPeerSelectionBy">Select a method to restrict Peer Selection</string>
<string id="RestrictPeerSelectionBy_Help">Set this policy to restrict peer selection via selected option.
Options available are:
0 = NAT.
1 = Subnet mask.
2 = Local discovery (DNS-SD).
The default value has changed from 0 (no restriction) to 1 (restrict to the subnet).
These options apply to both Download Mode LAN (1) and Group (2).</string>
<string id="RestrictPeerSelectionBy_None">NAT</string>
<string id="RestrictPeerSelectionBy_Subnet">Subnet</string>
<string id="RestrictPeerSelectionBy_LinkLocal">Local discovery</string>
<string id="SetHoursToLimitBackgroundDownloadBandwidth">Set Business Hours to Limit Background Download Bandwidth</string>
<string id="SetHoursToLimitBackgroundDownloadBandwidth_Help">Specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.</string>
<string id="SetHoursToLimitForegroundDownloadBandwidth">Set Business Hours to Limit Foreground Download Bandwidth</string>
<string id="SetHoursToLimitForegroundDownloadBandwidth_Help">Specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.</string>
<string id="Time1AM">1 AM</string>
<string id="Time1PM">1 PM</string>
<string id="Time2AM">2 AM</string>
<string id="Time2PM">2 PM</string>
<string id="Time3AM">3 AM</string>
<string id="Time3PM">3 PM</string>
<string id="Time4AM">4 AM</string>
<string id="Time4PM">4 PM</string>
<string id="Time5AM">5 AM</string>
<string id="Time5PM">5 PM</string>
<string id="Time6AM">6 AM</string>
<string id="Time6PM">6 PM</string>
<string id="Time7AM">7 AM</string>
<string id="Time7PM">7 PM</string>
<string id="Time8AM">8 AM</string>
<string id="Time8PM">8 PM</string>
<string id="Time9AM">9 AM</string>
<string id="Time9PM">9 PM</string>
<string id="Time10AM">10 AM</string>
<string id="Time10PM">10 PM</string>
<string id="Time11AM">11 AM</string>
<string id="Time11PM">11 PM</string>
<string id="Time12AM">12 AM</string>
<string id="Time12PM">12 PM</string>
</stringTable>
<presentationTable>
<presentation id="DownloadMode">
<dropdownList defaultItem="1" noSort="true" refId="DownloadMode">Download Mode:</dropdownList>
</presentation>
<presentation id="GroupId">
<textBox refId="GroupId">
<label>Group ID:</label>
</textBox>
</presentation>
<presentation id="MaxCacheSize">
<decimalTextBox defaultValue="20" refId="MaxCacheSize">Max Cache Size (Percentage):</decimalTextBox>
<text>The default value is 20%</text>
</presentation>
<presentation id="AbsoluteMaxCacheSize">
<decimalTextBox defaultValue="10" refId="AbsoluteMaxCacheSize">Absolute Max Cache Size (in GB):</decimalTextBox>
<text>The default value is 10GB</text>
</presentation>
<presentation id="MaxCacheAge">
<decimalTextBox defaultValue="604800" refId="MaxCacheAge">Max Cache Age (in seconds):</decimalTextBox>
<text>The default value is 7 days</text>
</presentation>
<presentation id="MonthlyUploadDataCap">
<decimalTextBox defaultValue="5120" refId="MonthlyUploadDataCap">Monthly Upload Data Cap (in GB):</decimalTextBox>
<text>The default value is 5 TB</text>
</presentation>
<presentation id="MinBackgroundQos">
<decimalTextBox defaultValue="20480" refId="MinBackgroundQos">Minimum Background QoS (in KB/s):</decimalTextBox>
<text>The default value is 20 MB/s</text>
</presentation>
<presentation id="ModifyCacheDrive">
<textBox refId="ModifyCacheDrive">
<label>Modify Cache Drive:</label>
</textBox>
</presentation>
<presentation id="MaxBackgroundDownloadBandwidth">
<decimalTextBox defaultValue="0" refId="MaxBackgroundDownloadBandwidth">Maximum Background Download Bandwidth (in KB/s):</decimalTextBox>
<text>The default value is 0 (unlimited)</text>
</presentation>
<presentation id="MaxForegroundDownloadBandwidth">
<decimalTextBox defaultValue="0" refId="MaxForegroundDownloadBandwidth">Maximum Foreground Download Bandwidth (in KB/s):</decimalTextBox>
<text>The default value is 0 (unlimited)</text>
</presentation>
<presentation id="PercentageMaxBackgroundBandwidth">
<decimalTextBox defaultValue="0" refId="PercentageMaxBackgroundBandwidth">Maximum Background Download Bandwidth (Percentage):</decimalTextBox>
<text>The default value is 0 (unlimited)</text>
</presentation>
<presentation id="PercentageMaxForegroundBandwidth">
<decimalTextBox defaultValue="0" refId="PercentageMaxForegroundBandwidth">Maximum Foreground Download Bandwidth (Percentage):</decimalTextBox>
<text>The default value is 0 (unlimited)</text>
</presentation>
<presentation id="MinFileSizeToCache">
<decimalTextBox defaultValue="100" refId="MinFileSizeToCache">Minimum Peer Caching Content File Size (in MB):</decimalTextBox>
<text>The default value is 100MB</text>
</presentation>
<presentation id="AllowVPNPeerCaching">
<checkBox defaultChecked="false" refId="AllowVPNPeerCaching">Enable Peer Caching while the device connects via VPN</checkBox>
</presentation>
<presentation id="MinRAMAllowedToPeer">
<decimalTextBox defaultValue="4" refId="MinRAMAllowedToPeer">Minimum RAM capacity (inclusive) required to enable use of Peer Caching (in GB):</decimalTextBox>
<text>The default value is 4GB</text>
</presentation>
<presentation id="MinDiskSizeAllowedToPeer">
<decimalTextBox defaultValue="32" refId="MinDiskSizeAllowedToPeer">Minimum disk size allowed to use Peer Caching (in GB):</decimalTextBox>
<text>The default value is 32GB</text>
</presentation>
<presentation id="MinBatteryPercentageAllowedToUpload">
<decimalTextBox defaultValue="0" refId="MinBatteryPercentageAllowedToUpload">Minimum battery level (Percentage):</decimalTextBox>
<text>The default value is 0 (unlimited)</text>
</presentation>
<presentation id="CacheHost">
<textBox refId="CacheHost">
<label>Cache Server:</label>
</textBox>
</presentation>
<presentation id="CacheHostSource">
<dropdownList defaultItem="0" noSort="true" refId="CacheHostSource">Cache Server Hostname Source:</dropdownList>
</presentation>
<presentation id="GroupIdSource">
<dropdownList defaultItem="0" noSort="true" refId="GroupIdSource">Source of Group IDs:</dropdownList>
</presentation>
<presentation id="DelayBackgroundDownloadFromHttp">
<decimalTextBox defaultValue="0" refId="DelayBackgroundDownloadFromHttp">Delay background download from http (in secs):</decimalTextBox>
<text>The default value is 0 (no delay)</text>
</presentation>
<presentation id="DelayForegroundDownloadFromHttp">
<decimalTextBox defaultValue="0" refId="DelayForegroundDownloadFromHttp">Delay Foreground download from http (in secs):</decimalTextBox>
<text>The default value is 0 (no delay)</text>
</presentation>
<presentation id="DelayCacheServerFallbackBackground">
<decimalTextBox defaultValue="0" refId="DelayCacheServerFallbackBackground">Delay Background download Cache Server fallback (in secs):</decimalTextBox>
<text>The default value is 0 (no delay)</text>
</presentation>
<presentation id="DelayCacheServerFallbackForeground">
<decimalTextBox defaultValue="0" refId="DelayCacheServerFallbackForeground">Delay Foreground download Cache Server fallback (in secs):</decimalTextBox>
<text>The default value is 0 (no delay)</text>
</presentation>
<presentation id="RestrictPeerSelectionBy">
<dropdownList defaultItem="1" noSort="true" refId="RestrictPeerSelectionBy">Restrict Peer Selection By:</dropdownList>
</presentation>
<presentation id="SetHoursToLimitBackgroundDownloadBandwidth">
<text/>
<text>Set Business Hours to Limit Background Download Bandwidth:</text>
<dropdownList defaultItem="8" noSort="true" refId="SetHoursToLimitBackgroundDownloadBandwidthFrom">From:</dropdownList>
<dropdownList defaultItem="17" noSort="true" refId="SetHoursToLimitBackgroundDownloadBandwidthTo">To:</dropdownList>
<text/>
<text>Maximum Background Download Bandwidth (percentage) during Business Hours:</text>
<decimalTextBox defaultValue="0" refId="SetHoursToLimitBackgroundDownloadBandwidthIn"/>
<text>The default value is 0 (unlimited)</text>
<text/>
<text>Maximum Background Download Bandwidth (percentage) outside of Business Hours:</text>
<decimalTextBox defaultValue="0" refId="SetHoursToLimitBackgroundDownloadBandwidthOut"/>
<text>The default value is 0 (unlimited)</text>
</presentation>
<presentation id="SetHoursToLimitForegroundDownloadBandwidth">
<text/>
<text>Set Business Hours to Limit Foreground Download Bandwidth:</text>
<dropdownList defaultItem="8" noSort="true" refId="SetHoursToLimitForegroundDownloadBandwidthFrom">From:</dropdownList>
<dropdownList defaultItem="17" noSort="true" refId="SetHoursToLimitForegroundDownloadBandwidthTo">To:</dropdownList>
<text/>
<text>Maximum Foreground Download Bandwidth (percentage) during Business Hours:</text>
<decimalTextBox defaultValue="0" refId="SetHoursToLimitForegroundDownloadBandwidthIn"/>
<text>The default value is 0 (unlimited)</text>
<text/>
<text>Maximum Foreground Download Bandwidth (percentage) outside of Business Hours:</text>
<decimalTextBox defaultValue="0" refId="SetHoursToLimitForegroundDownloadBandwidthOut"/>
<text>The default value is 0 (unlimited)</text>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/Desktop.adml
+264
View File
@@ -0,0 +1,264 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="ActiveDesktop">Desktop</string>
<string id="ActiveDirectory">Active Directory</string>
<string id="AD_EnableFilter">Enable filter in Find dialog box</string>
<string id="AD_EnableFilter_Help">Displays the filter bar above the results of an Active Directory search. The filter bar consists of buttons for applying additional filters to search results.
If you enable this setting, the filter bar appears when the Active Directory Find dialog box opens, but users can hide it.
If you disable this setting or do not configure it, the filter bar does not appear, but users can display it by selecting "Filter" on the "View" menu.
To see the filter bar, open Network Locations, click Entire Network, and then click Directory. Right-click the name of a Windows domain, and click Find. Type the name of an object in the directory, such as "Administrator." If the filter bar does not appear above the resulting display, on the View menu, click Filter.</string>
<string id="AD_HideDirectoryFolder">Hide Active Directory folder</string>
<string id="AD_HideDirectoryFolder_Help">Hides the Active Directory folder in Network Locations.
The Active Directory folder displays Active Directory objects in a browse window.
If you enable this setting, the Active Directory folder does not appear in the Network Locations folder.
If you disable this setting or do not configure it, the Active Directory folder appears in the Network Locations folder.
This setting is designed to let users search Active Directory but not tempt them to casually browse Active Directory.
</string>
<string id="AD_QueryLimit">Maximum size of Active Directory searches</string>
<string id="AD_QueryLimit_Help">Specifies the maximum number of objects the system displays in response to a command to browse or search Active Directory. This setting affects all browse displays associated with Active Directory, such as those in Local Users and Groups, Active Directory Users and Computers, and dialog boxes used to set permissions for user or group objects in Active Directory.
If you enable this setting, you can use the "Number of objects returned" box to limit returns from an Active Directory search.
If you disable this setting or do not configure it, the system displays up to 10,000 objects. This consumes approximately 2 MB of memory or disk space.
This setting is designed to protect the network and the domain controller from the effect of expansive searches.</string>
<string id="AdminComponents_Help">Adds and deletes specified Web content items.
You can use the "Add" box in this setting to add particular Web-based items or shortcuts to users' desktops. Users can close or delete the items (if settings allow), but the items are added again each time the setting is refreshed.
You can also use this setting to delete particular Web-based items from users' desktops. Users can add the item again (if settings allow), but the item is deleted each time the setting is refreshed.
Note: Removing an item from the "Add" list for this setting is not the same as deleting it. Items that are removed from the "Add" list are not removed from the desktop. They are simply not added again.
Note: For this setting to take affect, you must log off and log on to the system.</string>
<string id="ATC_NoComponents_Help">Removes Active Desktop content and prevents users from adding Active Desktop content.
This setting removes all Active Desktop items from the desktop. It also removes the Web tab from Display in Control Panel. As a result, users cannot add Web pages or pictures from the Internet or an intranet to the desktop.
Note: This setting does not disable Active Desktop. Users can still use image formats, such as JPEG and GIF, for their desktop wallpaper.</string>
<string id="DisablePersonalDirChange">Prohibit User from manually redirecting Profile Folders</string>
<string id="DisablePersonalDirChange_Help">Prevents users from changing the path to their profile folders.
By default, a user can change the location of their individual profile folders like Documents, Music etc. by typing a new path in the Locations tab of the folder's Properties dialog box.
If you enable this setting, users are unable to type a new location in the Target box.</string>
<string id="ForceActiveDesktopOn">Enable Active Desktop</string>
<string id="ForceActiveDesktopOn_Help">Enables Active Desktop and prevents users from disabling it.
This setting prevents users from trying to enable or disable Active Desktop while a policy controls it.
If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it.
Note: If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored. If the "Turn on Classic Shell" setting ( in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both of these policies are ignored.</string>
<string id="NoActiveDesktop">Disable Active Desktop</string>
<string id="NoActiveDesktop_Help">Disables Active Desktop and prevents users from enabling it.
This setting prevents users from trying to enable or disable Active Desktop while a policy controls it.
If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it.
Note: If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored. If the "Turn on Classic Shell" setting (in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both these policies are ignored.</string>
<string id="NoActiveDesktopChanges">Prohibit changes</string>
<string id="NoActiveDesktopChanges_Help">Prevents the user from enabling or disabling Active Desktop or changing the Active Desktop configuration.
This is a comprehensive setting that locks down the configuration you establish by using other policies in this folder. This setting removes the Web tab from Display in Control Panel. As a result, users cannot enable or disable Active Desktop. If Active Desktop is already enabled, users cannot add, remove, or edit Web content or disable, lock, or synchronize Active Desktop components.</string>
<string id="NoAddingComponents_Help">Prevents users from adding Web content to their Active Desktop.
This setting removes the "New" button from Web tab in Display in Control Panel. As a result, users cannot add Web pages or pictures from the Internet or an intranet to the desktop. This setting does not remove existing Web content from their Active Desktop, or prevent users from removing existing Web content.
Also, see the "Disable all items" setting.</string>
<string id="NoCloseDragDropBands_Help">Prevents users from manipulating desktop toolbars.
If you enable this setting, users cannot add or remove toolbars from the desktop. Also, users cannot drag toolbars on to or off of docked toolbars.
Note: If users have added or removed toolbars, this setting prevents them from restoring the default configuration.
Tip: To view the toolbars that can be added to the desktop, right-click a docked toolbar (such as the taskbar beside the Start button), and point to "Toolbars."
Also, see the "Prohibit adjusting desktop toolbars" setting.</string>
<string id="NoClosingComponents_Help">Prevents users from removing Web content from their Active Desktop.
In Active Desktop, you can add items to the desktop but close them so they are not displayed.
If you enable this setting, items added to the desktop cannot be closed; they always appear on the desktop. This setting removes the check boxes from items on the Web tab in Display in Control Panel.
Note: This setting does not prevent users from deleting items from their Active Desktop.</string>
<string id="NoDeletingComponents_Help">Prevents users from deleting Web content from their Active Desktop.
This setting removes the Delete button from the Web tab in Display in Control Panel. As a result, users can temporarily remove, but not delete, Web content from their Active Desktop.
This setting does not prevent users from adding Web content to their Active Desktop.
Also, see the "Prohibit closing items" and "Disable all items" settings.</string>
<string id="NoDesktop">Hide and disable all items on the desktop</string>
<string id="NoDesktop_Help">Removes icons, shortcuts, and other default and user-defined items from the desktop, including Briefcase, Recycle Bin, Computer, and Network Locations.
Removing icons and shortcuts does not prevent the user from using another method to start the programs or opening the items they represent.
Also, see "Items displayed in Places Bar" in User Configuration\Administrative Templates\Windows Components\Common Open File Dialog to remove the Desktop icon from the Places Bar. This will help prevent users from saving data to the Desktop.</string>
<string id="NoDesktopCleanupWizard">Remove the Desktop Cleanup Wizard</string>
<string id="NoDesktopCleanupWizard_Help">Prevents users from using the Desktop Cleanup Wizard.
If you enable this setting, the Desktop Cleanup wizard does not automatically run on a users workstation every 60 days. The user will also not be able to access the Desktop Cleanup Wizard.
If you disable this setting or do not configure it, the default behavior of the Desktop Clean Wizard running every 60 days occurs.
Note: When this setting is not enabled, users can run the Desktop Cleanup Wizard, or have it run automatically every 60 days from Display, by clicking the Desktop tab and then clicking the Customize Desktop button.</string>
<string id="NoEditingComponents_Help">Prevents users from changing the properties of Web content items on their Active Desktop.
This setting disables the Properties button on the Web tab in Display in Control Panel. Also, it removes the Properties item from the menu for each item on the Active Desktop. As a result, users cannot change the properties of an item, such as its synchronization schedule, password, or display characteristics.</string>
<string id="NoHTMLWallPaper_Help">Permits only bitmap images for wallpaper. This setting limits the desktop background ("wallpaper") to bitmap (.bmp) files. If users select files with other image formats, such as JPEG, GIF, PNG, or HTML, through the Browse button on the Desktop tab, the wallpaper does not load. Files that are autoconverted to a .bmp format, such as JPEG, GIF, and PNG, can be set as Wallpaper by right-clicking the image and selecting "Set as Wallpaper".
Also, see the "Desktop Wallpaper" and the "Prevent changing wallpaper" (in User Configuration\Administrative Templates\Control Panel\Display) settings.</string>
<string id="NoInternetIcon">Hide Internet Explorer icon on desktop</string>
<string id="NoInternetIcon_Help">Removes the Internet Explorer icon from the desktop and from the Quick Launch bar on the taskbar.
This setting does not prevent the user from starting Internet Explorer by using other methods.</string>
<string id="NoMovingBands_Help">Prevents users from adjusting the length of desktop toolbars. Also, users cannot reposition items or toolbars on docked toolbars.
This setting does not prevent users from adding or removing toolbars on the desktop.
Note: If users have adjusted their toolbars, this setting prevents them from restoring the default configuration.
Also, see the "Prevent adding, dragging, dropping and closing the Taskbar's toolbars" setting.</string>
<string id="NoMyComputerIcon">Remove Computer icon on the desktop</string>
<string id="NoMyComputerIcon_Help">This setting hides Computer from the desktop and from the new Start menu. It also hides links to Computer in the Web view of all Explorer windows, and it hides Computer in the Explorer folder tree pane. If the user navigates into Computer via the "Up" button while this setting is enabled, they view an empty Computer folder. This setting allows administrators to restrict their users from seeing Computer in the shell namespace, allowing them to present their users with a simpler desktop environment.
If you enable this setting, Computer is hidden on the desktop, the new Start menu, the Explorer folder tree pane, and the Explorer Web views. If the user manages to navigate to Computer, the folder will be empty.
If you disable this setting, Computer is displayed as usual, appearing as normal on the desktop, Start menu, folder tree pane, and Web views, unless restricted by another setting.
If you do not configure this setting, the default is to display Computer as usual.
Note: In operating systems earlier than Microsoft Windows Vista, this policy applies to the My Computer icon. Hiding Computer and its contents does not hide the contents of the child folders of Computer. For example, if the users navigate into one of their hard drives, they see all of their folders and files there, even if this setting is enabled.</string>
<string id="NoMyDocumentsIcon">Remove My Documents icon on the desktop</string>
<string id="NoMyDocumentsIcon_Help">Removes most occurrences of the My Documents icon.
This setting removes the My Documents icon from the desktop, from File Explorer, from programs that use the File Explorer windows, and from the standard Open dialog box.
This setting does not prevent the user from using other methods to gain access to the contents of the My Documents folder.
This setting does not remove the My Documents icon from the Start menu. To do so, use the "Remove My Documents icon from Start Menu" setting.
Note: To make changes to this setting effective, you must log off from and log back on to Windows 2000 Professional.</string>
<string id="NoNetHood">Hide Network Locations icon on desktop</string>
<string id="NoNetHood_Help">Removes the Network Locations icon from the desktop.
This setting only affects the desktop icon. It does not prevent users from connecting to the network or browsing for shared computers on the network.
Note: In operating systems earlier than Microsoft Windows Vista, this policy applies to the My Network Places icon.</string>
<string id="NoPropertiesMyComputer">Remove Properties from the Computer icon context menu</string>
<string id="NoPropertiesMyComputer_Help">This setting hides Properties on the context menu for Computer.
If you enable this setting, the Properties option will not be present when the user right-clicks My Computer or clicks Computer and then goes to the File menu. Likewise, Alt-Enter does nothing when Computer is selected.
If you disable or do not configure this setting, the Properties option is displayed as usual.</string>
<string id="NoPropertiesMyDocuments">Remove Properties from the Documents icon context menu</string>
<string id="NoPropertiesMyDocuments_Help">This policy setting hides the Properties menu command on the shortcut menu for the My Documents icon.
If you enable this policy setting, the Properties menu command will not be displayed when the user does any of the following:
Right-clicks the My Documents icon.
Clicks the My Documents icon, and then opens the File menu.
Clicks the My Documents icon, and then presses ALT+ENTER.
If you disable or do not configure this policy setting, the Properties menu command is displayed.</string>
<string id="NoRecentDocsNetHood">Do not add shares of recently opened documents to Network Locations</string>
<string id="NoRecentDocsNetHood_Help">Remote shared folders are not added to Network Locations whenever you open a document in the shared folder.
If you disable this setting or do not configure it, when you open a document in a remote shared folder, the system adds a connection to the shared folder to Network Locations.
If you enable this setting, shared folders are not added to Network Locations automatically when you open a document in the shared folder.</string>
<string id="NoRecycleBinIcon">Remove Recycle Bin icon from desktop</string>
<string id="NoRecycleBinIcon_Help">Removes most occurrences of the Recycle Bin icon.
This setting removes the Recycle Bin icon from the desktop, from File Explorer, from programs that use the File Explorer windows, and from the standard Open dialog box.
This setting does not prevent the user from using other methods to gain access to the contents of the Recycle Bin folder.
Note: To make changes to this setting effective, you must log off and then log back on.</string>
<string id="NoRecycleBinProperties">Remove Properties from the Recycle Bin context menu</string>
<string id="NoRecycleBinProperties_Help">Removes the Properties option from the Recycle Bin context menu.
If you enable this setting, the Properties option will not be present when the user right-clicks on Recycle Bin or opens Recycle Bin and then clicks File. Likewise, Alt-Enter does nothing when Recycle Bin is selected.
If you disable or do not configure this setting, the Properties option is displayed as usual.</string>
<string id="NoSaveSettings">Don't save settings at exit</string>
<string id="NoSaveSettings_Help">Prevents users from saving certain changes to the desktop.
If you enable this setting, users can change the desktop, but some changes, such as the position of open windows or the size and position of the taskbar, are not saved when users log off. However, shortcuts placed on the desktop are always saved.</string>
<string id="sz_AdminComponents_Title">Add/Delete items</string>
<string id="sz_ATC_DisableAdd">Prohibit adding items</string>
<string id="sz_ATC_DisableClose">Prohibit closing items</string>
<string id="sz_ATC_DisableDel">Prohibit deleting items</string>
<string id="sz_ATC_DisableEdit">Prohibit editing items</string>
<string id="sz_ATC_NoComponents">Disable all items</string>
<string id="sz_DB_DragDropClose">Prevent adding, dragging, dropping and closing the Taskbar's toolbars</string>
<string id="sz_DB_Moving">Prohibit adjusting desktop toolbars</string>
<string id="sz_DWP_NoHTMLPaper">Allow only bitmapped wallpaper</string>
<string id="Wallpaper">Desktop Wallpaper</string>
<string id="Wallpaper_Help">Specifies the desktop background ("wallpaper") displayed on all users' desktops.
This setting lets you specify the wallpaper on users' desktops and prevents users from changing the image or its presentation. The wallpaper you specify can be stored in a bitmap (*.bmp) or JPEG (*.jpg) file.
To use this setting, type the fully qualified path and name of the file that stores the wallpaper image. You can type a local path, such as C:\Windows\web\wallpaper\home.jpg or a UNC path, such as \\Server\Share\Corp.jpg. If the specified file is not available when the user logs on, no wallpaper is displayed. Users cannot specify alternative wallpaper. You can also use this setting to specify that the wallpaper image be centered, tiled, or stretched. Users cannot change this specification.
If you disable this setting or do not configure it, no wallpaper is displayed. However, users can select the wallpaper of their choice.
Also, see the "Allow only bitmapped wallpaper" in the same location, and the "Prevent changing wallpaper" setting in User Configuration\Administrative Templates\Control Panel.
Note: This setting does not apply to remote desktop server sessions.</string>
<string id="WallpaperStyle_Center">Center</string>
<string id="WallpaperStyle_Stretch">Stretch</string>
<string id="WallpaperStyle_Tile">Tile</string>
<string id="WallpaperStyle_KeepAspect">Fit</string>
<string id="WallpaperStyle_CropToFit">Fill</string>
<string id="WallpaperStyle_Span">Span</string>
<string id="NoWindowMinimizingShortcuts">Turn off Aero Shake window minimizing mouse gesture</string>
<string id="NoWindowMinimizingShortcuts_Help">Prevents windows from being minimized or restored when the active window is shaken back and forth with the mouse.
If you enable this policy, application windows will not be minimized or restored when the active window is shaken back and forth with the mouse.
If you disable or do not configure this policy, this window minimizing and restoring gesture will apply.</string>
</stringTable>
<presentationTable>
<presentation id="AD_QueryLimit">
<decimalTextBox refId="AD_QueryLimit_Box" defaultValue="10000" spinStep="100">Number of objects returned: </decimalTextBox>
</presentation>
<presentation id="ForceActiveDesktopOn">
<text>Allows HTML and JPEG Wallpaper</text>
</presentation>
<presentation id="NoActiveDesktop">
<text>Disallows HTML and Jpg Wallpaper</text>
</presentation>
<presentation id="sz_AdminComponents_Title">
<textBox refId="sz_ATC_AdminAddItem">
<label>Enter URL(s) of desktop item(s) to Add (space separated): </label>
</textBox>
<textBox refId="sz_ATC_AdminDeleteItem">
<label>Enter URL(s) of desktop item(s) to Delete (space separated): </label>
</textBox>
</presentation>
<presentation id="Wallpaper">
<textBox refId="WallpaperName">
<label>Wallpaper Name:</label>
</textBox>
<text>Example: Using a local path: C:\windows\web\wallpaper\home.jpg</text>
<text>Example: Using a UNC path: \\Server\Share\Corp.jpg</text>
<dropdownList refId="WallpaperStyle" defaultItem="0">Wallpaper Style:</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DesktopAppInstaller.adml
+97
View File
@@ -0,0 +1,97 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Copyright (c) Microsoft Corporation.
Licensed under the MIT License. -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>App Installer</displayName>
<description>App Installer</description>
<resources>
<stringTable>
<string id="AppInstaller">Desktop App Installer</string>
<string id="EnableAppInstaller">Enable App Installer</string>
<string id="EnableAppInstallerExplanation">This policy controls whether the Windows Package Manager can be used by users.
If you enable or do not configure this setting, users will be able to use the Windows Package Manager.
If you disable this setting, users will not be able to use the Windows Package Manager.</string>
<string id="EnableSettings">Enable App Installer Settings</string>
<string id="EnableSettingsExplanation">This policy controls whether users can change their settings.
If you enable or do not configure this setting, users will be able to change settings for the Windows Package Manager.
If you disable this setting, users will not be able to change settings for the Windows Package Manager.</string>
<string id="EnableExperimentalFeatures">Enable App Installer Experimental Features</string>
<string id="EnableExperimentalFeaturesExplanation">This policy controls whether users can enable experimental features in the Windows Package Manager.
If you enable or do not configure this setting, users will be able to enable experimental features for the Windows Package Manager.
If you disable this setting, users will not be able to enable experimental features for the Windows Package Manager.</string>
<string id="EnableLocalManifestFiles">Enable App Installer Local Manifest Files</string>
<string id="EnableLocalManifestFilesExplanation">This policy controls whether users can install packages with local manifest files.
If you enable or do not configure this setting, users will be able to install packages with local manifests using the Windows Package Manager.
If you disable this setting, users will not be able to install packages with local manifests using the Windows Package Manager.</string>
<string id="EnableHashOverride">Enable App Installer Hash Override</string>
<string id="EnableHashOverrideExplanation">This policy controls whether or not the Windows Package Manager can be configured to enable the ability override the SHA256 security validation in settings.
If you enable or do not configure this policy, users will be able to enable the ability override the SHA256 security validation in the Windows Package Manager settings.
If you disable this policy, users will not be able to enable the ability override the SHA256 security validation in the Windows Package Manager settings.</string>
<string id="EnableDefaultSource">Enable App Installer Default Source</string>
<string id="EnableDefaultSourceExplanation">This policy controls the default source included with the Windows Package Manager.
If you do not configure this setting, the default source for the Windows Package Manager will be available and can be removed.
If you enable this setting, the default source for the Windows Package Manager will be available and cannot be removed.
If you disable this setting the default source for the Windows Package Manager will not be available.</string>
<string id="EnableMicrosoftStoreSource">Enable App Installer Microsoft Store Source</string>
<string id="EnableMicrosoftStoreSourceExplanation">This policy controls the Microsoft Store source included with the Windows Package Manager.
If you do not configure this setting, the Microsoft Store source for the Windows Package manager will be available and can be removed.
If you enable this setting, the Microsoft Store source for the Windows Package Manager will be available and cannot be removed.
If you disable this setting the Microsoft Store source for the Windows Package Manager will not be available.</string>
<string id="SourceAutoUpdateInterval">Set App Installer Source Auto Update Interval In Minutes</string>
<string id="SourceAutoUpdateIntervalExplanation">This policy controls the auto update interval for package-based sources.
If you disable or do not configure this setting, the default interval or the value specified in settings will be used by the Windows Package Manager.
If you enable this setting, the number of minutes specified will be used by the Windows Package Manager.</string>
<string id="EnableAdditionalSources">Enable App Installer Additional Sources</string>
<string id="EnableAdditionalSourcesExplanation">This policy controls additional sources provided by the enterprise IT administrator.
If you do not configure this policy, no additional sources will be configured for the Windows Package Manager.
If you enable this policy, the additional sources will be added to the Windows Package Manager and cannot be removed. The representation for each additional source can be obtained from installed sources using 'winget source export'.
If you disable this policy, no additional sources can be configured for the Windows Package Manager.</string>
<string id="EnableAllowedSources">Enable App Installer Allowed Sources</string>
<string id="EnableAllowedSourcesExplanation">This policy controls additional sources allowed by the enterprise IT administrator.
If you do not configure this policy, users will be able to add or remove additional sources other than those configured by policy.
If you enable this policy, only the sources specified can be added or removed from the Windows Package Manager. The representation for each allowed source can be obtained from installed sources using 'winget source export'.
If you disable this policy, no additional sources can be configured for the Windows Package Manager.</string>
<string id="EnableMSAppInstallerProtocol">Enable App Installer ms-appinstaller protocol</string>
<string id="EnableMSAppInstallerProtocolExplanation">This policy controls whether users can install packages from a website that is using the ms-appinstaller protocol.
If you enable or do not configure this setting, users will be able to install packages from websites that use this protocol.
If you disable this setting, users will not be able to install packages from websites that use this protocol.</string>
</stringTable>
<presentationTable>
<presentation id="SourceAutoUpdateInterval">
<decimalTextBox refId="SourceAutoUpdateInterval" defaultValue="5">Source Auto Update Interval In Minutes</decimalTextBox>
</presentation>
<presentation id="AdditionalSources">
<listBox refId="AdditionalSources" required="false">Additional Sources: </listBox>
</presentation>
<presentation id="AllowedSources">
<listBox refId="AllowedSources" required="false">Allowed Sources: </listBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DeviceCompat.adml
+15
View File
@@ -0,0 +1,15 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="DeviceCompat">Device and Driver Compatibility</string>
<string id="DeviceFlags">Device compatibility settings</string>
<string id="DriverShims">Driver compatibility settings</string>
<string id="DeviceFlags_Help">Changes behavior of Microsoft bus drivers to work with specific devices.</string>
<string id="DriverShims_Help">Changes behavior of 3rd-party drivers to work around incompatibilities introduced between OS versions.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DeviceCredential.adml
+17
View File
@@ -0,0 +1,17 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Microsoft Secondary Authentication Factor</displayName>
<description>Configuration for Microsoft Microsoft Secondary Authentication Factor</description>
<resources>
<stringTable>
<string id="MSSecondaryAuthFactorCategory">Microsoft Secondary Authentication Factor</string>
<string id="MSSecondaryAuthFactor_AllowSecondaryAuthenticationDevice">Allow companion device for secondary authentication</string>
<string id="MSSecondaryAuthFactor_AllowSecondaryAuthenticationDeviceExplain">This policy allows users to use a companion device, such as a phone, fitness band, or IoT device, to sign on to a desktop computer running Windows 10. The companion device provides a second factor of authentication with Windows Hello.
If you enable or do not configure this policy setting, users can authenticate to Windows Hello using a companion device.
If you disable this policy, users cannot use a companion device to authenticate with Windows Hello.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DeviceGuard.adml
+114
View File
@@ -0,0 +1,114 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2015 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Microsoft Windows Device Guard</displayName>
<description>Windows Device Guard Security</description>
<resources>
<stringTable>
<string id="DeviceGuard">Device Guard</string>
<string id="VirtualizationBasedSecurity">Turn On Virtualization Based Security</string>
<string id="VirtualizationBasedSecurityHelp">Specifies whether Virtualization Based Security is enabled.
Virtualization Based Security uses the Windows Hypervisor to provide support for security services. Virtualization Based Security requires Secure Boot, and can optionally be enabled with the use of DMA Protections. DMA protections require hardware support and will only be enabled on correctly configured devices.
Virtualization Based Protection of Code Integrity
This setting enables virtualization based protection of Kernel Mode Code Integrity. When this is enabled, kernel mode memory protections are enforced and the Code Integrity validation path is protected by the Virtualization Based Security feature.
The "Disabled" option turns off Virtualization Based Protection of Code Integrity remotely if it was previously turned on with the "Enabled without lock" option.
The "Enabled with UEFI lock" option ensures that Virtualization Based Protection of Code Integrity cannot be disabled remotely. In order to disable the feature, you must set the Group Policy to "Disabled" as well as remove the security functionality from each computer, with a physically present user, in order to clear configuration persisted in UEFI.
The "Enabled without lock" option allows Virtualization Based Protection of Code Integrity to be disabled remotely by using Group Policy.
The "Not Configured" option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified.
The "Require UEFI Memory Attributes Table" option will only enable Virtualization Based Protection of Code Integrity on devices with UEFI firmware support for the Memory Attributes Table. Devices without the UEFI Memory Attributes Table may have firmware that is incompatible with Virtualization Based Protection of Code Integrity which in some cases can lead to crashes or data loss or incompatibility with certain plug-in cards. If not setting this option the targeted devices should be tested to ensure compatibility.
Warning: All drivers on the system must be compatible with this feature or the system may crash. Ensure that this policy setting is only deployed to computers which are known to be compatible.
Credential Guard
This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials.
For Windows 11 21H2 and earlier, the "Disabled" option turns off Credential Guard remotely if it was previously turned on with the "Enabled without lock" option. For later versions, the "Disabled" option turns off Credential Guard remotely if it was previously turned on with the "Enabled without lock" option or was "Not Configured".
The "Enabled with UEFI lock" option ensures that Credential Guard cannot be disabled remotely. In order to disable the feature, you must set the Group Policy to "Disabled" as well as remove the security functionality from each computer, with a physically present user, in order to clear configuration persisted in UEFI.
The "Enabled without lock" option allows Credential Guard to be disabled remotely by using Group Policy. The devices that use this setting must be running at least Windows 10 (Version 1511).
For Windows 11 21H2 and earlier, the "Not Configured" option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified. For later versions, if there is no current setting in the registry, the "Not Configured" option will enable Credential Guard without UEFI lock.
Secure Launch
This setting sets the configuration of Secure Launch to secure the boot chain.
The "Not Configured" setting is the default, and allows configuration of the feature by Administrative users.
The "Enabled" option turns on Secure Launch on supported hardware.
The "Disabled" option turns off Secure Launch, regardless of hardware support.
Kernel-mode Hardware-enforced Stack Protection
This setting enables Hardware-enforced Stack Protection for kernel-mode code. When this security feature is enabled, kernel-mode data stacks are hardened with hardware-based shadow stacks, which store intended return address targets to ensure that program control flow is not tampered.
This security feature has the following prerequisites:
1) The CPU hardware supports hardware-based shadow stacks.
2) Virtualization Based Protection of Code Integrity is enabled.
If either prerequisite is not met, this feature will not be enabled, even if an "Enabled" option is selected for this feature. Note that selecting an "Enabled" option for this feature will not automatically enable Virtualization Based Protection of Code Integrity, that needs to be done separately.
Devices that enable this security feature must be running at least Windows 11 (Version 22H2).
The "Disabled" option turns off kernel-mode Hardware-enforced Stack Protection.
The "Enabled in audit mode" option enables kernel-mode Hardware-enforced Stack Protection in audit mode, where shadow stack violations are not fatal and will be logged to the system event log.
The "Enabled in enforcement mode" option enables kernel-mode Hardware-enforced Stack Protection in enforcement mode, where shadow stack violations are fatal.
The "Not Configured" option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified.
Warning: All drivers on the system must be compatible with this security feature or the system may crash in enforcement mode. Audit mode can be used to discover incompatible drivers. For more information, refer to https://go.microsoft.com/fwlink/?LinkId=2162953.
</string>
<string id="SecureBoot">Secure Boot</string>
<string id="SecureBootAndDmaProtection">Secure Boot and DMA Protection</string>
<string id="Disabled">Disabled</string>
<string id="Enabled">Enabled</string>
<string id="EnabledWithoutLock">Enabled without lock</string>
<string id="EnabledWithUefiLock">Enabled with UEFI lock</string>
<string id="EnabledAudit">Enabled in audit mode</string>
<string id="EnabledEnforcement">Enabled in enforcement mode</string>
<string id="NotConfigured">Not Configured</string>
<string id="ConfigCIPolicy">Deploy Windows Defender Application Control</string>
<string id="ConfigCIPolicyHelp">Deploy Windows Defender Application Control
This policy setting lets you deploy a Code Integrity Policy to a machine to control what is allowed to run on that machine.
If you deploy a Code Integrity Policy, Windows will restrict what can run in both kernel mode and on the Windows Desktop based on the policy. To enable this policy the machine must be rebooted.
The file path must be either a UNC path (for example, \\ServerName\ShareName\SIPolicy.p7b), or a locally valid path (for example, C:\FolderName\SIPolicy.p7b). The local machine account (LOCAL SYSTEM) must have access permission to the policy file.
If using a signed and protected policy then disabling this policy setting doesn't remove the feature from the computer. Instead, you must either:
1) first update the policy to a non-protected policy and then disable the setting, or
2) disable the setting and then remove the policy from each computer, with a physically present user.
</string>
</stringTable>
<presentationTable>
<presentation id="VirtualizationBasedSecurity">
<dropdownList refId="RequirePlatformSecurityFeaturesDrop" defaultItem="1">Select Platform Security Level:</dropdownList>
<dropdownList refId="HypervisorEnforcedCodeIntegrityDrop" defaultItem="3">Virtualization Based Protection of Code Integrity:</dropdownList>
<checkBox refId="CheckboxMAT">Require UEFI Memory Attributes Table</checkBox>
<dropdownList refId="CredentialIsolationDrop" defaultItem="3">Credential Guard Configuration:</dropdownList>
<dropdownList refId="SystemGuardDrop" defaultItem="2">Secure Launch Configuration:</dropdownList>
<dropdownList refId="KernelShadowStacksDrop" defaultItem="3">Kernel-mode Hardware-enforced Stack Protection:</dropdownList>
</presentation>
<presentation id="ConfigCIPolicy">
<textBox refId="ConfigCIPolicyFilePathText">
<label>Code Integrity Policy file path:</label>
</textBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DeviceInstallation.adml
+263
View File
@@ -0,0 +1,263 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="DeviceInstall_AllowAdminInstall">Allow administrators to override Device Installation Restriction policies</string>
<string id="DeviceInstall_AllowAdminInstall_Help">This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings.
If you enable this policy setting, members of the Administrators group can use the Add Hardware wizard or the Update Driver wizard to install and update the drivers for any device. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, members of the Administrators group are subject to all policy settings that restrict device installation.</string>
<string id="DeviceInstall_AllSigningEqual">Prioritize all digitally signed drivers equally during the driver ranking and selection process</string>
<string id="DeviceInstall_AllSigningEqual_Help">This policy setting allows you to determine how drivers signed by a Microsoft Windows Publisher certificate are ranked with drivers signed by other valid Authenticode signatures during the driver selection and installation process. Regardless of this policy setting, a signed driver is still preferred over a driver that is not signed at all.
If you enable or do not configure this policy setting, drivers that are signed by a Microsoft Windows Publisher certificate and drivers that are signed by other Authenticode certificates are prioritized equally during the driver selection process. Selection is based on other criteria, such as version number or when the driver was created.
If you disable this policy setting, drivers that are signed by a Microsoft Windows Publisher certificate are selected for installation over drivers that are signed by other Authenticode certificates.</string>
<string id="DeviceInstall_Category">Device Installation</string>
<string id="DeviceInstall_Classes_Allow">Allow installation of devices using drivers that match these device setup classes</string>
<string id="DeviceInstall_Classes_Allow_Help">This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for driver packages that Windows is allowed to install. This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions.
When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update driver packages whose device setup class GUIDs appear in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings:
- Prevent installation of devices for these device classes
- Prevent installation of devices that match these device IDs
- Prevent installation of devices that match any of these device instance IDs
If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence.
NOTE: The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible.
Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update driver packages whose device setup class GUIDs appear in the list you create, unless another policy setting specifically prevents installation (for example, the "Prevent installation of devices that match these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting).
If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed.</string>
<string id="DeviceInstall_Classes_Deny">Prevent installation of devices using drivers that match these device setup classes</string>
<string id="DeviceInstall_Classes_Deny_Help">This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for driver packages that Windows is prevented from installing. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device.
NOTE: To enable the "Allow installation of devices that match any of these device IDs" and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting.
If you enable this policy setting, Windows is prevented from installing or updating driver packages whose device setup class GUIDs appear in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings.</string>
<string id="DeviceInstall_Help">Policy settings that control the installation of devices.</string>
<string id="DeviceInstall_IDs_Allow">Allow installation of devices that match any of these device IDs</string>
<string id="DeviceInstall_IDs_Allow_Help">This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is allowed to install. This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions.
When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update any device whose Plug and Play hardware ID or compatible ID appears in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings:
- Prevent installation of devices that match these device IDs
- Prevent installation of devices that match any of these device instance IDs
If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence.
NOTE: The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible.
Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update any device whose Plug and Play hardware ID or compatible ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting).
If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed.</string>
<string id="DeviceInstall_IDs_Deny">Prevent installation of devices that match any of these device IDs</string>
<string id="DeviceInstall_IDs_Deny_Help">This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is prevented from installing. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device.
NOTE: To enable the "Allow installation of devices that match any of these device instance IDs" policy setting to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting.
If you enable this policy setting, Windows is prevented from installing a device whose hardware ID or compatible ID appears in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings.</string>
<string id="DeviceInstall_Instance_IDs_Allow">Allow installation of devices that match any of these device instance IDs</string>
<string id="DeviceInstall_Instance_IDs_Allow_Help">This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is allowed to install. This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions.
When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings:
- Prevent installation of devices that match any of these device instance IDs
If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence.
NOTE: The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible.
Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting).
If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed.</string>
<string id="DeviceInstall_Instance_IDs_Deny">Prevent installation of devices that match any of these device instance IDs</string>
<string id="DeviceInstall_Instance_IDs_Deny_Help">This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device.
If you enable this policy setting, Windows is prevented from installing a device whose device instance ID appears in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings.</string>
<string id="DeviceInstall_InstallTimeout">Configure device installation time-out</string>
<string id="DeviceInstall_InstallTimeout_Help">This policy setting allows you to configure the number of seconds Windows waits for a device installation task to complete.
If you enable this policy setting, Windows waits for the number of seconds you specify before terminating the installation.
If you disable or do not configure this policy setting, Windows waits 240 seconds for a device installation task to complete before terminating the installation.</string>
<string id="DeviceInstall_Removable_Deny">Prevent installation of removable devices</string>
<string id="DeviceInstall_Removable_Deny_Help">This policy setting allows you to prevent Windows from installing removable devices. A device is considered removable when the driver for the device to which it is connected indicates that the device is removable. For example, a Universal Serial Bus (USB) device is reported to be removable by the drivers for the USB hub to which the device is connected. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device.
NOTE: To enable the "Allow installation of devices using drivers that match these device setup classes", "Allow installation of devices that match any of these device IDs", and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting.
If you enable this policy setting, Windows is prevented from installing removable devices and existing removable devices cannot have their drivers updated. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of removable devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, Windows can install and update driver packages for removable devices as allowed or prevented by other policy settings.</string>
<string id="DeviceInstall_Restrictions_Category">Device Installation Restrictions</string>
<string id="DeviceInstall_Restrictions_Help">Policy settings that describe which devices can or cannot be installed.</string>
<string id="DeviceInstall_SystemRestore">Prevent creation of a system restore point during device activity that would normally prompt creation of a restore point</string>
<string id="DeviceInstall_SystemRestore_Help">This policy setting allows you to prevent Windows from creating a system restore point during device activity that would normally prompt Windows to create a system restore point. Windows normally creates restore points for certain driver activity, such as the installation of an unsigned driver. A system restore point enables you to more easily restore your system to its state before the activity.
If you enable this policy setting, Windows does not create a system restore point when one would normally be created.
If you disable or do not configure this policy setting, Windows creates a system restore point as it normally would.</string>
<string id="DeviceManagement_RPCInterface_Allow">Allow remote access to the Plug and Play interface</string>
<string id="DeviceManagement_RPCInterface_Allow_Help">This policy setting allows you to allow or deny remote access to the Plug and Play interface.
If you enable this policy setting, remote connections to the Plug and Play interface are allowed.
If you disable or do not configure this policy setting, remote connections to the Plug and Play interface are not allowed.</string>
<string id="DeviceInstall_Unspecified_Deny">Prevent installation of devices not described by other policy settings</string>
<string id="DeviceInstall_Unspecified_Deny_Help">This policy setting allows you to prevent the installation of devices that are not specifically described by any other policy setting.
NOTE: This policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting to provide more granular control. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting instead of this policy setting.
If you enable this policy setting, Windows is prevented from installing or updating the driver package for any device that is not described by either the "Allow installation of devices that match any of these device IDs", the "Allow installation of devices for these device classes", or the "Allow installation of devices that match any of these device instance IDs" policy setting.
If you disable or do not configure this policy setting, Windows is allowed to install or update the driver package for any device that is not described by the "Prevent installation of devices that match any of these device IDs", "Prevent installation of devices for these device classes" policy setting, "Prevent installation of devices that match any of these device instance IDs", or "Prevent installation of removable devices" policy setting.</string>
<string id="DeviceInstall_Allow_Deny_Layered">Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria</string>
<string id="DeviceInstall_Allow_Deny_Layered_Help">This policy setting will change the evaluation order in which Allow and Prevent policy settings are applied when more than one install policy setting is applicable for a given device. Enable this policy setting to ensure that overlapping device match criteria is applied based on an established hierarchy where more specific match criteria supersedes less specific match criteria. The hierarchical order of evaluation for policy settings that specify device match criteria is as follows:
Device instance IDs &gt; Device IDs &gt; Device setup class &gt; Removable devices
Device instance IDs
1. Prevent installation of devices using drivers that match these device instance IDs
2. Allow installation of devices using drivers that match these device instance IDs
Device IDs
3. Prevent installation of devices using drivers that match these device IDs
4. Allow installation of devices using drivers that match these device IDs
Device setup class
5. Prevent installation of devices using drivers that match these device setup classes
6. Allow installation of devices using drivers that match these device setup classes
Removable devices
7. Prevent installation of removable devices
NOTE: This policy setting provides more granular control than the "Prevent installation of devices not described by other policy settings" policy setting. If these conflicting policy settings are enabled at the same time, the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting will be enabled and the other policy setting will be ignored.
If you disable or do not configure this policy setting, the default evaluation is used. By default, all "Prevent installation..." policy settings have precedence over any other policy setting that allows Windows to install a device.</string>
<string id="DeviceInstall_DeniedPolicy_SimpleText">Display a custom message title when device installation is prevented by a policy setting</string>
<string id="DeviceInstall_DeniedPolicy_SimpleText_Help">This policy setting allows you to display a custom message title in a notification when a device installation is attempted and a policy setting prevents the installation.
If you enable this policy setting, Windows displays the text you type in the Main Text box as the title text of a notification when a policy setting prevents device installation.
If you disable or do not configure this policy setting, Windows displays a default title in a notification when a policy setting prevents device installation.</string>
<string id="DeviceInstall_DeniedPolicy_DetailText">Display a custom message when installation is prevented by a policy setting</string>
<string id="DeviceInstall_DeniedPolicy_DetailText_Help">This policy setting allows you to display a custom message to users in a notification when a device installation is attempted and a policy setting prevents the installation.
If you enable this policy setting, Windows displays the text you type in the Detail Text box when a policy setting prevents device installation.
If you disable or do not configure this policy setting, Windows displays a default message when a policy setting prevents device installation.</string>
<string id="DriverInstall_Category">Driver Installation</string>
<string id="DriverInstall_Classes_AllowUser">Allow non-administrators to install drivers for these device setup classes</string>
<string id="DriverInstall_Classes_AllowUser_Help">This policy setting specifies a list of device setup class GUIDs describing driver packages that non-administrator members of the built-in Users group may install on the system.
If you enable this policy setting, members of the Users group may install new drivers for the specified device setup classes. The drivers must be signed according to Windows Driver Signing Policy, or be signed by publishers already in the TrustedPublisher store.
If you disable or do not configure this policy setting, only members of the Administrators group are allowed to install new driver packages on the system.</string>
<string id="DriverInstall_Help">Policy settings controlling the installation of driver packages on the system.</string>
<string id="DriverSign_Block">Block</string>
<string id="DriverSign_None">Ignore</string>
<string id="DriverSign_Warn">Warn</string>
<string id="DriverSigning">Code signing for driver packages</string>
<string id="DriverSigning_Help">Determines how the system responds when a user tries to install driver package files that are not digitally signed.
This setting establishes the least secure response permitted on the systems of users in the group. Users can use System in Control Panel to select a more secure setting, but when this setting is enabled, the system does not implement any setting less secure than the one the setting established.
When you enable this setting, use the drop-down box to specify the desired response.
-- "Ignore" directs the system to proceed with the installation even if it includes unsigned files.
-- "Warn" notifies the user that files are not digitally signed and lets the user decide whether to stop or to proceed with the installation and whether to permit unsigned files to be installed. "Warn" is the default.
-- "Block" directs the system to refuse to install unsigned files. As a result, the installation stops, and none of the files in the driver package are installed.
To change driver file security without specifying a setting, use System in Control Panel. Right-click My Computer, click Properties, click the Hardware tab, and then click the Driver Signing button.</string>
<string id="DeviceInstall_Policy_RebootTime">Time (in seconds) to force reboot when required for policy changes to take effect</string>
<string id="DeviceInstall_Policy_RebootTime_Help">This policy setting establishes the amount of time (in seconds) that the system will wait to reboot in order to enforce a change in device installation restriction policies.
If you enable this policy setting, set the amount of seconds you want the system to wait until a reboot.
If you disable or do not configure this policy setting, the system does not force a reboot.
Note: If no reboot is forced, the device installation restriction right will not take effect until the system is restarted.</string>
</stringTable>
<presentationTable>
<presentation id="DeviceInstall_Classes_Allow">
<listBox refId="DeviceInstall_Classes_Allow_List">Allow installation of devices using drivers for these device classes:</listBox>
<text>To create a list of device classes, click Show. In the Show Contents dialog box, in the Value column,</text>
<text>type a GUID that represents a device setup class</text>
<text>(for example, {25DBCE51-6C8F-4A72-8A6D-B54C2B4FC835}).</text>
</presentation>
<presentation id="DeviceInstall_Classes_Deny">
<listBox refId="DeviceInstall_Classes_Deny_List">Prevent installation of devices using drivers for these device setup classes:</listBox>
<text>To create a list of device classes, click Show. In the Show Contents dialog box, in the Value column,</text>
<text>type a GUID that represents a device setup class</text>
<text>(for example, {25DBCE51-6C8F-4A72-8A6D-B54C2B4FC835}).</text>
<checkBox refId="DeviceInstall_Classes_Deny_Retroactive">Also apply to matching devices that are already installed.</checkBox>
</presentation>
<presentation id="DeviceInstall_IDs_Allow">
<listBox refId="DeviceInstall_IDs_Allow_List">Allow installation of devices that match any of these Device IDs:</listBox>
<text>To create a list of devices, click Show. In the Show Contents dialog box, in the Value column,</text>
<text>type a Plug and Play hardware ID or compatible ID</text>
<text>(for example, gendisk, USB\COMPOSITE, USB\Class_ff).</text>
</presentation>
<presentation id="DeviceInstall_IDs_Deny">
<listBox refId="DeviceInstall_IDs_Deny_List">Prevent installation of devices that match any of these Device IDs:</listBox>
<text>To create a list of devices, click Show. In the Show Contents dialog box, in the Value column,</text>
<text>type a Plug and Play hardware ID or compatible ID</text>
<text>(for example, gendisk, USB\COMPOSITE, USB\Class_ff).</text>
<checkBox refId="DeviceInstall_IDs_Deny_Retroactive">Also apply to matching devices that are already installed.</checkBox>
</presentation>
<presentation id="DeviceInstall_Instance_IDs_Allow">
<listBox refId="DeviceInstall_Instance_IDs_Allow_List">Allow installation of devices that match any of these device instance IDs:</listBox>
<text>To create a list of devices, click Show. In the Show Contents dialog box, in the Value column,</text>
<text>type a Plug and Play device instance ID</text>
<text>(for example, USB\VID_045E&amp;&amp;PID_0123\01234567890123456789).</text>
</presentation>
<presentation id="DeviceInstall_Instance_IDs_Deny">
<listBox refId="DeviceInstall_Instance_IDs_Deny_List">Prevent installation of devices that match any of these device instance IDs:</listBox>
<text>To create a list of devices, click Show. In the Show Contents dialog box, in the Value column,</text>
<text>type a Plug and Play device instance ID</text>
<text>(for example, USB\VID_045E&amp;&amp;PID_0123\01234567890123456789).</text>
<checkBox refId="DeviceInstall_Instance_IDs_Deny_Retroactive">Also apply to matching devices that are already installed.</checkBox>
</presentation>
<presentation id="DeviceInstall_InstallTimeout">
<decimalTextBox refId="DeviceInstall_InstallTimeout_Time" defaultValue="300" spinStep="15">Device Installation Timeout (in seconds)</decimalTextBox>
</presentation>
<presentation id="DeviceInstall_Policy_RebootTime">
<decimalTextBox refId="DeviceInstall_Policy_RebootTime_Time" defaultValue="120" spinStep="10">Reboot Timeout (in seconds)</decimalTextBox>
</presentation>
<presentation id="DeviceInstall_DeniedPolicy_SimpleText">
<text>Enter the text you wish users to see (Max 63 chars)</text>
<textBox refId="DeviceInstall_DeniedPolicy_SimpleText_Text">
<label>Main Text</label>
</textBox>
</presentation>
<presentation id="DeviceInstall_DeniedPolicy_DetailText">
<text>Enter the text you wish users to see (Max 128 chars)</text>
<textBox refId="DeviceInstall_DeniedPolicy_DetailText_Text">
<label>Detail Text</label>
</textBox>
</presentation>
<presentation id="DriverInstall_Classes_AllowUser">
<listBox refId="DriverInstall_Classes_AllowUser_List">Allow Users to install driver packages for these classes:</listBox>
<text>To create a list of device classes, click Show. In the Show Contents dialog box, in the Value column,</text>
<text>type a GUID that represents a device setup class</text>
<text>(for example, {25DBCE51-6C8F-4A72-8A6D-B54C2B4FC835}).</text>
</presentation>
<presentation id="DriverSigning">
<dropdownList refId="DriverSigningOp" noSort="true" defaultItem="1">When Windows detects a driver file without a digital signature:</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DeviceSetup.adml
+94
View File
@@ -0,0 +1,94 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="DeviceInstall_BalloonTips">Turn off "Found New Hardware" balloons during device installation</string>
<string id="DeviceInstall_BalloonTips_Help">This policy setting allows you to turn off "Found New Hardware" balloons during device installation.
If you enable this policy setting, "Found New Hardware" balloons do not appear while a device is being installed.
If you disable or do not configure this policy setting, "Found New Hardware" balloons appear while a device is being installed, unless the driver for the device suppresses the balloons.</string>
<string id="DeviceInstall_GenericDriverSendToWER">Do not send a Windows error report when a generic driver is installed on a device</string>
<string id="DeviceInstall_GenericDriverSendToWER_Help">Windows has a feature that sends "generic-driver-installed" reports through the Windows Error Reporting infrastructure. This policy allows you to disable the feature.
If you enable this policy setting, an error report is not sent when a generic driver is installed.
If you disable or do not configure this policy setting, an error report is sent when a generic driver is installed.</string>
<string id="DeviceInstall_RequestAdditionalSoftwareSendToWER">Prevent Windows from sending an error report when a device driver requests additional software during installation</string>
<string id="DeviceInstall_RequestAdditionalSoftwareSendToWER_Help">Windows has a feature that allows a device driver to request additional software through the Windows Error Reporting infrastructure. This policy allows you to disable the feature.
If you enable this policy setting, Windows will not send an error report to request additional software even if this is specified by the device driver.
If you disable or do not configure this policy setting, Windows sends an error report when a device driver that requests additional software is installed.</string>
<string id="DriverSearchPlaces">Configure driver search locations</string>
<string id="DriverSearchPlaces_Help">This setting configures the location that Windows searches for drivers when a new piece of hardware is found.
By default, Windows searches the following places for drivers: local installation, floppy drives, CD-ROM drives, Windows Update.
Using this setting, you may remove the floppy and CD-ROM drives from the search algorithm.
If you enable this setting, you can remove the locations by selecting the associated check box beside the location name.
If you disable or do not configure this setting, Windows searches the installation location, floppy drives, and CD-ROM drives.
Note: To prevent searching Windows Update for drivers also see "Turn off Windows Update device driver searching" in Administrative Templates/System/Internet Communication Management/Internet Communication settings.</string>
<string id="DriverSearchPlaces_DontPromptForWindowsUpdate">Turn off Windows Update device driver search prompt</string>
<string id="DriverSearchPlaces_DontPromptForWindowsUpdate_Help">Specifies whether the administrator will be prompted about going to Windows Update to search for device drivers using the Internet.
Note: This setting only has effect if "Turn off Windows Update device driver searching" in "Administrative Templates/System/Internet Communication Management/Internet Communication settings" is disabled or not configured.
If you enable this setting, administrators will not be prompted to search Windows Update.
If you disable or do not configure this setting, and "Turn off Windows Update device driver searching" is disabled or not configured, the administrator will be prompted for consent before going to Windows Update to search for device drivers.</string>
<string id="DriverSearchPlaces_SearchOrderConfiguration">Specify search order for device driver source locations</string>
<string id="DriverSearchPlaces_SearchOrderConfiguration_Help">This policy setting allows you to specify the order in which Windows searches source locations for device drivers.
If you enable this policy setting, you can select whether Windows searches for drivers on Windows Update unconditionally, only if necessary, or not at all.
Note that searching always implies that Windows will attempt to search Windows Update exactly one time. With this setting, Windows will not continually search for updates. This setting is used to ensure that the best software will be found for the device, even if the network is temporarily available.
If the setting for searching only if needed is specified, then Windows will search for a driver only if a driver is not locally available on the system.
If you disable or do not configure this policy setting, members of the Administrators group can determine the priority order in which Windows searches source locations for device drivers.</string>
<string id="DriverSearchPlaces_SearchOrderConfiguration_AlwaysCheckWU">Always search Windows Update</string>
<string id="DriverSearchPlaces_SearchOrderConfiguration_CheckWUIfNeeded">Search Windows Update only if needed</string>
<string id="DriverSearchPlaces_SearchOrderConfiguration_NeverCheckWu">Do not search Windows Update</string>
<string id="DriverSearchPlaces_SearchServerConfiguration">Specify the search server for device driver updates</string>
<string id="DriverSearchPlaces_SearchServerConfiguration_Help">This policy setting allows you to specify the search server that Windows uses to find updates for device drivers.
If you enable this policy setting, you can select whether Windows searches Windows Update (WU), searches a Managed Server, or a combination of both.
Note that if both are specified, then Windows will first search the Managed Server, such as a Windows Server Update Services (WSUS) server. Only if no update is found will Windows then also search Windows Update.
If you disable or do not configure this policy setting, members of the Administrators group can determine the server used in the search for device drivers.
</string>
<string id="DriverSearchPlaces_SearchServerConfiguration_WU">Search Windows Update</string>
<string id="DriverSearchPlaces_SearchServerConfiguration_WSUS">Search Managed Server</string>
<string id="DriverSearchPlaces_SearchServerConfiguration_Both">Search Managed Server, then WU</string>
<string id="DeviceMetadata_PreventDeviceMetadataFromNetwork">Prevent device metadata retrieval from the Internet</string>
<string id="DeviceMetadata_PreventDeviceMetadataFromNetwork_Help">This policy setting allows you to prevent Windows from retrieving device metadata from the Internet.
If you enable this policy setting, Windows does not retrieve device metadata for installed devices from the Internet. This policy setting overrides the setting in the Device Installation Settings dialog box (Control Panel &gt; System and Security &gt; System &gt; Advanced System Settings &gt; Hardware tab).
If you disable or do not configure this policy setting, the setting in the Device Installation Settings dialog box controls whether Windows retrieves device metadata from the Internet.</string>
</stringTable>
<presentationTable>
<presentation id="DriverSearchPlaces">
<checkBox refId="DriverSearchPlaces_Floppies">Do not search floppy disk drives</checkBox>
<checkBox refId="DriverSearchPlaces_CD">Do not search CD-ROM drives</checkBox>
<checkBox refId="DriverSearchPlaces_WindowsUpdate">Do not search Windows Update</checkBox>
</presentation>
<presentation id="DriverSearchPlaces_SearchOrderConfiguration">
<dropdownList refId="DriverSearchPlaces_SearchOrderConfiguration_dropdown" noSort="true" defaultItem="1">Select search order:</dropdownList>
</presentation>
<presentation id="DriverSearchPlaces_SearchServerConfiguration">
<dropdownList refId="DriverSearchPlaces_SearchServerConfiguration_dropdown" noSort="true" defaultItem="0">Select update server:</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DigitalLocker.adml
+19
View File
@@ -0,0 +1,19 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="Digitalx_DiableApplication_TitleText">Do not allow Digital Locker to run</string>
<string id="Digitalx_DisableApplication_DescriptionText">Specifies whether Digital Locker can run.
Digital Locker is a dedicated download manager associated with Windows Marketplace and a feature of Windows that can be used to manage and download products acquired and stored in the user's Windows Marketplace Digital Locker.
If you enable this setting, Digital Locker will not run.
If you disable or do not configure this setting, Digital Locker can be run.</string>
<string id="Digitalx_GroupPolicyCategory">Digital Locker</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DiskDiagnostic.adml
+56
View File
@@ -0,0 +1,56 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<!-- BEGIN: Custom supportedOn strings -->
<string id="SUPPORTED_WindowsLonghornServerDesktopExperienceOrVista">
Windows Server 2008 with Desktop Experience installed or Windows Vista
</string>
<!-- END: Custom supportedOn strings -->
<string id="DfdAlertPolicy">Disk Diagnostic: Configure custom alert text</string>
<string id="DfdAlertPolicyExplain">This policy setting substitutes custom alert text in the disk diagnostic message shown to users when a disk reports a S.M.A.R.T. fault.
If you enable this policy setting, Windows displays custom alert text in the disk diagnostic message. The custom text may not exceed 512 characters.
If you disable or do not configure this policy setting, Windows displays the default alert text in the disk diagnostic message.
No reboots or service restarts are required for this policy setting to take effect: changes take effect immediately.
This policy setting only takes effect if the Disk Diagnostic scenario policy setting is enabled or not configured and the Diagnostic Policy Service (DPS) is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console.
Note: For Windows Server systems, this policy setting applies only if the Desktop Experience optional component is installed and the Remote Desktop Services role is not installed.
</string>
<string id="WdiScenarioCategory">Disk Diagnostic</string>
<string id="WdiScenarioExecutionPolicy">Disk Diagnostic: Configure execution level</string>
<string id="WdiScenarioExecutionPolicyExplain">This policy setting determines the execution level for S.M.A.R.T.-based disk diagnostics.
Self-Monitoring And Reporting Technology (S.M.A.R.T.) is a standard mechanism for storage devices to report faults to Windows. A disk that reports a S.M.A.R.T. fault may need to be repaired or replaced. The Diagnostic Policy Service (DPS) detects and logs S.M.A.R.T. faults to the event log when they occur.
If you enable this policy setting, the DPS also warns users of S.M.A.R.T. faults and guides them through backup and recovery to minimize potential data loss.
If you disable this policy, S.M.A.R.T. faults are still detected and logged, but no corrective action is taken.
If you do not configure this policy setting, the DPS enables S.M.A.R.T. fault resolution by default.
This policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.
No reboots or service restarts are required for this policy setting to take effect: changes take effect immediately.
This policy setting takes effect only when the DPS is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console.
Note: For Windows Server systems, this policy setting applies only if the Desktop Experience optional component is installed and the Remote Desktop Services role is not installed.
</string>
</stringTable>
<presentationTable>
<presentation id="DfdAlertPolicy">
<textBox refId="DfdAlertPolicyTitle">
<label>Custom alert text</label>
<defaultValue>Enter custom alert text here</defaultValue>
</textBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DiskNVCache.adml
+51
View File
@@ -0,0 +1,51 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="BootResumePolicy">Turn off boot and resume optimizations</string>
<string id="BootResumePolicyHelp">This policy setting turns off the boot and resume optimizations for the hybrid hard disks in the system.
If you enable this policy setting, the system does not use the non-volatile (NV) cache to optimize boot and resume.
If you disable this policy setting, the system uses the NV cache to achieve faster boot and resume. The system determines the data that will be stored in the NV cache to optimize boot and resume. The required data is stored in the NV cache during shutdown and hibernate, respectively. This might cause a slight increase in the time taken for shutdown and hibernate.
If you do not configure this policy setting, the default behavior is observed and the NV cache is used for boot and resume optimizations.
Note: This policy setting is applicable only if the NV cache feature is on.</string>
<string id="CachePowerModePolicy">Turn off cache power mode</string>
<string id="CachePowerModePolicyHelp">This policy setting turns off power save mode on the hybrid hard disks in the system.
If you enable this policy setting, the hard disks are not put into NV cache power save mode and no power savings are achieved.
If you disable this policy setting, the hard disks are put into an NV cache power saving mode. In this mode, the system tries to save power by aggressively spinning down the disk.
If you do not configure this policy setting, the default behavior is to allow the hybrid hard disks to be in power save mode.
Note: This policy setting is applicable only if the NV cache feature is on.</string>
<string id="FeatureOffPolicy">Turn off non-volatile cache feature</string>
<string id="FeatureOffPolicyHelp">This policy setting turns off all support for the non-volatile (NV) cache on all hybrid hard disks in the system. To check if you have hybrid hard disks in the system, from Device Manager, right-click the disk drive and select Properties. The NV cache can be used to optimize boot and resume by reading data from the cache while the disks are spinning up. The NV cache can also be used to reduce the power consumption of the system by keeping the disks spun down while satisfying reads and writes from the cache.
If you enable this policy setting, the system will not manage the NV cache and will not enable NV cache power saving mode.
If you disable this policy setting, the system will manage the NV cache on the disks if the other policy settings for the NV cache are appropriately configured.
Note: This policy setting will take effect on next boot.
If you do not configure this policy setting, the default behavior is to turn on support for the NV cache.</string>
<string id="NvCacheCat">Disk NV Cache</string>
<string id="SolidStatePolicy">Turn off solid state mode</string>
<string id="SolidStatePolicyHelp">This policy setting turns off the solid state mode for the hybrid hard disks.
If you enable this policy setting, frequently written files such as the file system metadata and registry may not be stored in the NV cache.
If you disable this policy setting, the system will store frequently written data into the non-volatile (NV) cache. This allows the system to exclusively run out of the NV cache and power down the disk for longer periods to save power. Note that this can cause increased wear of the NV cache.
If you do not configure this policy setting, the default behavior of the system is observed and frequently written files will be stored in the NV cache.
Note: This policy setting is applicable only if the NV cache feature is on.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DiskQuota.adml
+99
View File
@@ -0,0 +1,99 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="DiskQuota">Disk Quotas</string>
<string id="DQ_Enable">Enable disk quotas</string>
<string id="DQ_Enable_Help">This policy setting turns on and turns off disk quota management on all NTFS volumes of the computer, and prevents users from changing the setting.
If you enable this policy setting, disk quota management is turned on, and users cannot turn it off.
If you disable the policy setting, disk quota management is turned off, and users cannot turn it on.
If this policy setting is not configured, disk quota management is turned off by default, but administrators can turn it on.
To prevent users from changing the setting while a setting is in effect, the system disables the "Enable quota management" option on the Quota tab of NTFS volumes.
Note: This policy setting turns on disk quota management but does not establish or enforce a particular disk quota limit. To specify a disk quota limit, use the "Default quota limit and warning level" policy setting. Otherwise, the system uses the physical space on the volume as the quota limit.
Note: To turn on or turn off disk quota management without specifying a setting, in My Computer, right-click the name of an NTFS volume, click Properties, click the Quota tab, and then click "Enable quota management."</string>
<string id="DQ_Enforce">Enforce disk quota limit</string>
<string id="DQ_Enforce_Help">This policy setting determines whether disk quota limits are enforced and prevents users from changing the setting.
If you enable this policy setting, disk quota limits are enforced. If you disable this policy setting, disk quota limits are not enforced. When you enable or disable this policy setting, the system disables the "Deny disk space to users exceeding quota limit" option on the Quota tab so administrators cannot make changes while the setting is in effect.
If you do not configure this policy setting, the disk quota limit is not enforced by default, but administrators can change the setting.
Enforcement is optional. When users reach an enforced disk quota limit, the system responds as though the physical space on the volume were exhausted. When users reach an unenforced limit, their status in the Quota Entries window changes, but they can continue to write to the volume as long as physical space is available.
Note: This policy setting overrides user settings that enable or disable quota enforcement on their volumes.
Note: To specify a disk quota limit, use the "Default quota limit and warning level" policy setting. Otherwise, the system uses the physical space on the volume as the quota limit.</string>
<string id="DQ_Limit">Specify default quota limit and warning level</string>
<string id="DQ_Limit_Help">This policy setting specifies the default disk quota limit and warning level for new users of the volume.
This policy setting determines how much disk space can be used by each user on each of the NTFS file system volumes on a computer. It also specifies the warning level, the point at which the user's status in the Quota Entries window changes to indicate that the user is approaching the disk quota limit.
This setting overrides new users’ settings for the disk quota limit and warning level on their volumes, and it disables the corresponding options in the "Select the default quota limit for new users of this volume" section on the Quota tab.
This policy setting applies to all new users as soon as they write to the volume. It does not affect disk quota limits for current users, or affect customized limits and warning levels set for particular users (on the Quota tab in Volume Properties).
If you disable or do not configure this policy setting, the disk space available to users is not limited. The disk quota management feature uses the physical space on each volume as its quota limit and warning level.
When you select a limit, remember that the same limit applies to all users on all volumes, regardless of actual volume size. Be sure to set the limit and warning level so that it is reasonable for the range of volumes in the group.
This policy setting is effective only when disk quota management is enabled on the volume. Also, if disk quotas are not enforced, users can exceed the quota limit you set. When users reach the quota limit, their status in the Quota Entries window changes, but users can continue to write to the volume.</string>
<string id="DQ_LogEventOverLimit">Log event when quota limit is exceeded</string>
<string id="DQ_LogEventOverLimit_Help">This policy setting determines whether the system records an event in the local Application log when users reach their disk quota limit on a volume, and prevents users from changing the logging setting.
If you enable this policy setting, the system records an event when the user reaches their limit. If you disable this policy setting, no event is recorded. Also, when you enable or disable this policy setting, the system disables the "Log event when a user exceeds their quota limit" option on the Quota tab, so administrators cannot change the setting while a setting is in effect.
If you do not configure this policy setting, no events are recorded, but administrators can use the Quota tab option to change the setting.
This policy setting is independent of the enforcement policy settings for disk quotas. As a result, you can direct the system to log an event, regardless of whether or not you choose to enforce the disk quota limit.
Also, this policy setting does not affect the Quota Entries window on the Quota tab. Even without the logged event, users can detect that they have reached their limit, because their status in the Quota Entries window changes.
Note: To find the logging option, in My Computer, right-click the name of an NTFS file system volume, click Properties, and then click the Quota tab.</string>
<string id="DQ_LogEventOverThreshold">Log event when quota warning level is exceeded</string>
<string id="DQ_LogEventOverThreshold_Help">This policy setting determines whether the system records an event in the Application log when users reach their disk quota warning level on a volume.
If you enable this policy setting, the system records an event. If you disable this policy setting, no event is recorded. When you enable or disable this policy setting, the system disables the corresponding "Log event when a user exceeds their warning level" option on the Quota tab so that administrators cannot change logging while a policy setting is in effect.
If you do not configure this policy setting, no event is recorded, but administrators can use the Quota tab option to change the logging setting.
This policy setting does not affect the Quota Entries window on the Quota tab. Even without the logged event, users can detect that they have reached their warning level because their status in the Quota Entries window changes.
Note: To find the logging option, in My Computer, right-click the name of an NTFS file system volume, click Properties, and then click the Quota tab.</string>
<string id="DQ_RemovableMedia">Apply policy to removable media</string>
<string id="DQ_RemovableMedia_Help">This policy setting extends the disk quota policies in this folder to NTFS file system volumes on removable media.
If you disable or do not configure this policy setting, the disk quota policies established in this folder apply to fixed-media NTFS volumes only. Note: When this policy setting is applied, the computer will apply the disk quota to both fixed and removable media.</string>
<string id="DQ_UnitsEB">EB</string>
<string id="DQ_UnitsGB">GB</string>
<string id="DQ_UnitsKB">KB</string>
<string id="DQ_UnitsMB">MB</string>
<string id="DQ_UnitsPB">PB</string>
<string id="DQ_UnitsTB">TB</string>
</stringTable>
<presentationTable>
<presentation id="DQ_Limit">
<text>Specify a quota limit and warning level applied to users when</text>
<text>they first write to a quota-enabled volume.</text>
<text> </text>
<text>Default quota limit:</text>
<text> </text>
<decimalTextBox refId="DQ_LimitValue" defaultValue="100" spinStep="10">Value</decimalTextBox>
<dropdownList refId="DQ_LimitUnits" noSort="true" defaultItem="1">Units</dropdownList>
<text> </text>
<text>Default warning level:</text>
<text> </text>
<decimalTextBox refId="DQ_ThresholdValue" defaultValue="100" spinStep="10">Value</decimalTextBox>
<dropdownList refId="DQ_ThresholdUnits" noSort="true" defaultItem="1">Units</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/Display.adml
+72
View File
@@ -0,0 +1,72 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="DisplayCat">Display</string>
<string id="Display_TurnOnGdiDPIScaling_Help">GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware.
This policy setting lets you specify legacy applications that have GDI DPI Scaling turned on.
If you enable this policy setting, GDI DPI Scaling is turned on for all legacy applications in the list.
If you disable or do not configure this policy setting, GDI DPI Scaling will not be enabled for an application except when an application is enabled by using ApplicationCompatibility database, ApplicationCompatibility UI System (Enhanced) setting, or an application manifest.
If GDI DPI Scaling is configured to both turn off and turn on an application, the application will be turned off.</string>
<string id="Display_TurnOffGdiDPIScaling_Help">GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware.
This policy setting lets you specify legacy applications that have GDI DPI Scaling turned off.
If you enable this policy setting, GDI DPI Scaling is turned off for all applications in the list, even if they are enabled by using ApplicationCompatibility database, ApplicationCompatibility UI System (Enhanced) setting, or an application manifest.
If you disable or do not configure this policy setting, GDI DPI Scaling might still be turned on for legacy applications.
If GDI DPI Scaling is configured to both turn off and turn on an application, the application will be turned off.</string>
<string id="DisplayTurnOnGdiDPIScaling">Turn on GdiDPIScaling for applications</string>
<string id="DisplayTurnOffGdiDPIScaling">Turn off GdiDPIScaling for applications</string>
<string id="DisplayPerProcessSystemDpiSettingsHelp">Per Process System DPI is an application compatibility feature for desktop applications that do not render properly after a display-scale factor (DPI) change. When the display scale factor of the primary display changes (which can happen when you connect or disconnect a display that has a different display scale factor (DPI), connect remotely from a device with a different display scale factor, or manually change the display scale factor), many desktop applications can display blurry. Desktop applications that have not been updated to display properly in this scenario will be blurry until the user logs out and back in to Windows.
When you enable this policy some blurry applications will be crisp after they are restarted, without requiring the user to log out and back in to Windows.
Be aware of the following:
Per Process System DPI will only improve the rendering of desktop applications that are positioned on the primary display. Some desktop applications can still be blurry on secondary displays that have different display scale factors.
Per Process System DPI will not work for all applications as some older desktop applications will always be blurry on high DPI displays.
In some cases, you may see some odd behavior in some desktop applications. If that happens, Per Process System DPI should be disabled.
Enabling this setting lets you specify the system-wide default for desktop applications as well as per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system.
</string>
<string id="DisplayPerProcessSystemDpiSettings">Configure Per-Process System DPI settings</string>
<string id="DisplayGlobalPerProcessSystemDpiEnable">Enable</string>
<string id="DisplayGlobalPerProcessSystemDpiDisable">Disable</string>
<string id="DisplayEnablePerProcessSystemDpiSettings">Enable Per-Process System DPI for applications</string>
<string id="DisplayDisablePerProcessSystemDpiSettings">Disable Per-Process System DPI for applications</string>
</stringTable>
<presentationTable>
<presentation id="DisplayTurnOnGdiDPIScaling">
<textBox refId="DisplayTurnOnGdiDPIScalingPrompt">
<label>Enable GDI DPI Scaling for the following applications. Use either the full application path or the application filename and extension. Separate applications with a semicolon.</label>
</textBox>
</presentation>
<presentation id="DisplayTurnOffGdiDPIScaling">
<textBox refId="DisplayTurnOffGdiDPIScalingPrompt">
<label>Disable GDI DPI Scaling for the following applications. Use either the full application path or the application filename and extension. Separate applications with a semicolon.</label>
</textBox>
</presentation>
<presentation id="DisplayPerProcessSystemDpiSettings">
<dropdownList refId="DisplayGlobalPerProcessSystemDpiSettings" noSort="true" defaultItem="0">Enable or disable Per-Process System DPI for all applications.</dropdownList>
<textBox refId="DisplayEnablePerProcessSystemDpiSettings">
<label>Enable Per-Process System DPI for the following applications. Use either the full application path or the application filename and extension. Separate applications with a semicolon.</label>
</textBox>
<textBox refId="DisplayDisablePerProcessSystemDpiSettings">
<label>Disable Per-Process System DPI for the following applications. Use either the full application path or the application filename and extension. Separate applications with a semicolon.</label>
</textBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DistributedLinkTracking.adml
+12
View File
@@ -0,0 +1,12 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="DLT_AllowDomainMode">Allow Distributed Link Tracking clients to use domain resources</string>
<string id="DLT_AllowDomainMode_Explain">Specifies that Distributed Link Tracking clients in this domain may use the Distributed Link Tracking (DLT) server, which runs on domain controllers. The DLT client enables programs to track linked files that are moved within an NTFS volume, to another NTFS volume on the same computer, or to an NTFS volume on another computer. The DLT client can more reliably track links when allowed to use the DLT server. This policy should not be set unless the DLT server is running on all domain controllers in the domain.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DmaGuard.adml
+25
View File
@@ -0,0 +1,25 @@
<?xml version="1.0" encoding="utf-8"?>
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/PolicyDefinitions">
<displayName>Kernel DMA Protection</displayName>
<description>This file contains the configuration options for Kernel DMA Protection</description>
<resources>
<stringTable>
<string id="DmaGuard">Kernel DMA Protection</string>
<string id="DmaGuard_Explain">Policies for configuring Kernel DMA Protection</string>
<string id="DmaGuardEnumerationPolicy">Enumeration policy for external devices incompatible with Kernel DMA Protection</string>
<string id="DmaGuardEnumerationPolicy_Explain">Enumeration policy for external DMA-capable devices incompatible with DMA remapping. This policy only takes effect when Kernel DMA Protection is enabled and supported by the system. Note: this policy does not apply to 1394, PCMCIA or ExpressCard devices.</string>
<string id="DmaGuardEnumerationPolicy_Options_1">Allow all</string>
<string id="DmaGuardEnumerationPolicy_Options_2">Only while logged in (default)</string>
<string id="DmaGuardEnumerationPolicy_Options_3">Block all</string>
</stringTable>
<presentationTable>
<presentation id="DmaGuardEnumerationPolicy">
<dropdownList refId="DmaGuardEnumerationPolicy_Options" noSort="true" defaultItem="1">Enumeration policy</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/DnsClient.adml
+342
View File
@@ -0,0 +1,342 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="DNS_Client">DNS Client</string>
<string id="DNS_Domain">Connection-specific DNS suffix</string>
<string id="DNS_Domain_Help">Specifies a connection-specific DNS suffix. This policy setting supersedes local connection-specific DNS suffixes, and those configured using DHCP.
To use this policy setting, click Enabled, and then enter a string value representing the DNS suffix.
If you enable this policy setting, the DNS suffix that you enter will be applied to all network connections used by computers that receive this policy setting.
If you disable this policy setting, or if you do not configure this policy setting, computers will use the local or DHCP supplied connection specific DNS suffix, if configured.</string>
<string id="DNS_NameServer">DNS servers</string>
<string id="DNS_NameServer_Help">Defines the DNS servers to which a computer sends queries when it attempts to resolve names. This policy setting supersedes the list of DNS servers configured locally and those configured using DHCP.
To use this policy setting, click Enabled, and then enter a space-delimited list of IP addresses in the available field. To use this policy setting, you must enter at least one IP address.
If you enable this policy setting, the list of DNS servers is applied to all network connections used by computers that receive this policy setting.
If you disable this policy setting, or if you do not configure this policy setting, computers will use the local or DHCP supplied list of DNS servers, if configured.</string>
<string id="DNS_PrimaryDnsSuffix">Primary DNS suffix</string>
<string id="DNS_PrimaryDnsSuffix_Help">Specifies the primary DNS suffix used by computers in DNS name registration and DNS name resolution.
To use this policy setting, click Enabled and enter the entire primary DNS suffix you want to assign. For example: microsoft.com.
Important: In order for changes to this policy setting to be applied on computers that receive it, you must restart Windows.
If you enable this policy setting, it supersedes the primary DNS suffix configured in the DNS Suffix and NetBIOS Computer Name dialog box using the System control panel.
You can use this policy setting to prevent users, including local administrators, from changing the primary DNS suffix.
If you disable this policy setting, or if you do not configure this policy setting, each computer uses its local primary DNS suffix, which is usually the DNS name of Active Directory domain to which it is joined.</string>
<string id="DNS_RegisterAdapterName">Register DNS records with connection-specific DNS suffix</string>
<string id="DNS_RegisterAdapterName_Help">Specifies if a computer performing dynamic DNS registration will register A and PTR resource records with a concatenation of its computer name and a connection-specific DNS suffix, in addition to registering these records with a concatenation of its computer name and the primary DNS suffix.
By default, a DNS client performing dynamic DNS registration registers A and PTR resource records with a concatenation of its computer name and the primary DNS suffix. For example, a computer name of mycomputer and a primary DNS suffix of microsoft.com will be registered as: mycomputer.microsoft.com.
If you enable this policy setting, a computer will register A and PTR resource records with its connection-specific DNS suffix, in addition to the primary DNS suffix. This applies to all network connections used by computers that receive this policy setting.
For example, with a computer name of mycomputer, a primary DNS suffix of microsoft.com, and a connection specific DNS suffix of VPNconnection, a computer will register A and PTR resource records for mycomputer.VPNconnection and mycomputer.microsoft.com when this policy setting is enabled.
Important: This policy setting is ignored on a DNS client computer if dynamic DNS registration is disabled.
If you disable this policy setting, or if you do not configure this policy setting, a DNS client computer will not register any A and PTR resource records using a connection-specific DNS suffix.</string>
<string id="DNS_RegisterReverseLookup">Register PTR records</string>
<string id="DNS_RegisterReverseLookup_DoNotRegister">Do not register</string>
<string id="DNS_RegisterReverseLookup_Help">Specifies if DNS client computers will register PTR resource records.
By default, DNS clients configured to perform dynamic DNS registration will attempt to register PTR resource record only if they successfully registered the corresponding A resource record.
If you enable this policy setting, registration of PTR records will be determined by the option that you choose under Register PTR records.
To use this policy setting, click Enabled, and then select one of the following options from the drop-down list:
Do not register: Computers will not attempt to register PTR resource records.
Register: Computers will attempt to register PTR resource records even if registration of the corresponding A records was not successful.
Register only if A record registration succeeds: Computers will attempt to register PTR resource records only if registration of the corresponding A records was successful.
If you disable this policy setting, or if you do not configure this policy setting, computers will use locally configured settings.</string>
<string id="DNS_RegisterReverseLookup_Register">Register</string>
<string id="DNS_RegisterReverseLookup_RegisterOnlyIfASucceeds">Register only if A record registration succeeds</string>
<string id="DNS_RegistrationEnabled">Dynamic update</string>
<string id="DNS_RegistrationEnabled_Help">Specifies if DNS dynamic update is enabled. Computers configured for DNS dynamic update automatically register and update their DNS resource records with a DNS server.
If you enable this policy setting, or you do not configure this policy setting, computers will attempt to use dynamic DNS registration on all network connections that have connection-specific dynamic DNS registration enabled. For a dynamic DNS registration to be enabled on a network connection, the connection-specific configuration must allow dynamic DNS registration, and this policy setting must not be disabled.
If you disable this policy setting, computers may not use dynamic DNS registration for any of their network connections, regardless of the configuration for individual network connections.</string>
<string id="DNS_RegistrationOverwritesInConflict">Replace addresses in conflicts</string>
<string id="DNS_RegistrationOverwritesInConflict_Help">Specifies whether dynamic updates should overwrite existing resource records that contain conflicting IP addresses.
This policy setting is designed for computers that register address (A) resource records in DNS zones that do not use Secure Dynamic Updates. Secure Dynamic Update preserves ownership of resource records and does not allow a DNS client to overwrite records that are registered by other computers.
During dynamic update of resource records in a zone that does not use Secure Dynamic Updates, an A resource record might exist that associates the client's host name with an IP address different than the one currently in use by the client. By default, the DNS client attempts to replace the existing A resource record with an A resource record that has the client's current IP address.
If you enable this policy setting or if you do not configure this policy setting, DNS clients maintain their default behavior and will attempt to replace conflicting A resource records during dynamic update.
If you disable this policy setting, existing A resource records that contain conflicting IP addresses will not be replaced during a dynamic update, and an error will be recorded in Event Viewer.</string>
<string id="DNS_RegistrationRefreshInterval">Registration refresh interval</string>
<string id="DNS_RegistrationRefreshInterval_Help">Specifies the interval used by DNS clients to refresh registration of A and PTR resource. This policy setting only applies to computers performing dynamic DNS updates.
Computers configured to perform dynamic DNS registration of A and PTR resource records periodically reregister their records with DNS servers, even if the record has not changed. This reregistration is required to indicate to DNS servers that records are current and should not be automatically removed (scavenged) when a DNS server is configured to delete stale records.
Warning: If record scavenging is enabled on the zone, the value of this policy setting should never be longer than the value of the DNS zone refresh interval. Configuring the registration refresh interval to be longer than the refresh interval of the DNS zone might result in the undesired deletion of A and PTR resource records.
To specify the registration refresh interval, click Enabled and then enter a value of 1800 or greater. The value that you specify is the number of seconds to use for the registration refresh interval. For example, 1800 seconds is 30 minutes.
If you enable this policy setting, registration refresh interval that you specify will be applied to all network connections used by computers that receive this policy setting.
If you disable this policy setting, or if you do not configure this policy setting, computers will use the local or DHCP supplied setting. By default, client computers configured with a static IP address attempt to update their DNS resource records once every 24 hours and DHCP clients will attempt to update their DNS resource records when a DHCP lease is granted or renewed.</string>
<string id="DNS_RegistrationTtl">TTL value for A and PTR records</string>
<string id="DNS_RegistrationTtl_Help">
Specifies the value of the time to live (TTL) field in A and PTR resource records that are registered by computers to which this policy setting is applied.
To specify the TTL, click Enabled and then enter a value in seconds (for example, 900 is 15 minutes).
If you enable this policy setting, the TTL value that you specify will be applied to DNS resource records registered for all network connections used by computers that receive this policy setting.
If you disable this policy setting, or if you do not configure this policy setting, computers will use the TTL settings specified in DNS. By default, the TTL is 1200 seconds (20 minutes).</string>
<string id="DNS_SearchList">DNS suffix search list</string>
<string id="DNS_SearchList_Help">Specifies the DNS suffixes to attach to an unqualified single-label name before submission of a DNS query for that name.
An unqualified single-label name contains no dots. The name "example" is a single-label name. This is different from a fully qualified domain name such as "example.microsoft.com."
Client computers that receive this policy setting will attach one or more suffixes to DNS queries for a single-label name. For example, a DNS query for the single-label name "example" will be modified to "example.microsoft.com" before sending the query to a DNS server if this policy setting is enabled with a suffix of "microsoft.com."
To use this policy setting, click Enabled, and then enter a string value representing the DNS suffixes that should be appended to single-label names. You must specify at least one suffix. Use a comma-delimited string, such as "microsoft.com,serverua.microsoft.com,office.microsoft.com" to specify multiple suffixes.
If you enable this policy setting, one DNS suffix is attached at a time for each query. If a query is unsuccessful, a new DNS suffix is added in place of the failed suffix, and this new query is submitted. The values are used in the order they appear in the string, starting with the leftmost value and proceeding to the right until a query is successful or all suffixes are tried.
If you disable this policy setting, or if you do not configure this policy setting, the primary DNS suffix and network connection-specific DNS suffixes are appended to the unqualified queries.</string>
<string id="DNS_UpdateSecurityLevel">Update security level</string>
<string id="DNS_UpdateSecurityLevel_Help">Specifies the security level for dynamic DNS updates.
To use this policy setting, click Enabled and then select one of the following values:
Unsecure followed by secure - computers send secure dynamic updates only when nonsecure dynamic updates are refused.
Only unsecure - computers send only nonsecure dynamic updates.
Only secure - computers send only secure dynamic updates.
If you enable this policy setting, computers that attempt to send dynamic DNS updates will use the security level that you specify in this policy setting.
If you disable this policy setting, or if you do not configure this policy setting, computers will use local settings. By default, DNS clients attempt to use unsecured dynamic update first. If an unsecured update is refused, clients try to use secure update.</string>
<string id="DNS_UpdateSecurityLevel_OnlySecure">Only secure</string>
<string id="DNS_UpdateSecurityLevel_OnlyUnsecure">Only unsecure</string>
<string id="DNS_UpdateSecurityLevel_UnsecureFollowedBySecure">Unsecure followed by secure</string>
<string id="DNS_UpdateTopLevelDomainZones">Update top level domain zones</string>
<string id="DNS_UpdateTopLevelDomainZones_Help">Specifies if computers may send dynamic updates to zones with a single label name. These zones are also known as top-level domain zones, for example: "com."
By default, a DNS client that is configured to perform dynamic DNS update will update the DNS zone that is authoritative for its DNS resource records unless the authoritative zone is a top-level domain or root zone.
If you enable this policy setting, computers send dynamic updates to any zone that is authoritative for the resource records that the computer needs to update, except the root zone.
If you disable this policy setting, or if you do not configure this policy setting, computers do not send dynamic updates to the root zone or top-level domain zones that are authoritative for the resource records that the computer needs to update.</string>
<string id="DNS_UseDomainNameDevolution">Primary DNS suffix devolution</string>
<string id="DNS_UseDomainNameDevolution_Help">Specifies if the DNS client performs primary DNS suffix devolution during the name resolution process.
With devolution, a DNS client creates queries by appending a single-label, unqualified domain name with the parent suffix of the primary DNS suffix name, and the parent of that suffix, and so on, stopping if the name is successfully resolved or at a level determined by devolution settings. Devolution can be used when a user or application submits a query for a single-label domain name.
The DNS client appends DNS suffixes to the single-label, unqualified domain name based on the state of the Append primary and connection specific DNS suffixes radio button and Append parent suffixes of the primary DNS suffix check box on the DNS tab in Advanced TCP/IP Settings for the Internet Protocol (TCP/IP) Properties dialog box.
Devolution is not enabled if a global suffix search list is configured using Group Policy.
If a global suffix search list is not configured, and the Append primary and connection specific DNS suffixes radio button is selected, the DNS client appends the following names to a single-label name when it sends DNS queries:
The primary DNS suffix, as specified on the Computer Name tab of the System control panel.
Each connection-specific DNS suffix, assigned either through DHCP or specified in the DNS suffix for this connection box on the DNS tab in the Advanced TCP/IP Settings dialog box for each connection.
For example, when a user submits a query for a single-label name such as "example," the DNS client attaches a suffix such as "microsoft.com" resulting in the query "example.microsoft.com," before sending the query to a DNS server.
If a DNS suffix search list is not specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the primary DNS suffix of the computer (drops the leftmost label of the primary DNS suffix), attaches this devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server.
For example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the non-dot-terminated single-label name "example," and the DNS query for example.ooo.aaa.microsoft.com fails, the DNS client devolves the primary DNS suffix (drops the leftmost label) till the specified devolution level, and submits a query for example.aaa.microsoft.com. If this query fails, the primary DNS suffix is devolved further if it is under specified devolution level and the query example.microsoft.com is submitted. If this query fails, devolution continues if it is under specified devolution level and the query example.microsoft.com is submitted, corresponding to a devolution level of two. The primary DNS suffix cannot be devolved beyond a devolution level of two. The devolution level can be configured using the primary DNS suffix devolution level policy setting. The default devolution level is two.
If you enable this policy setting, or if you do not configure this policy setting, DNS clients attempt to resolve single-label names using concatenations of the single-label name to be resolved and the devolved primary DNS suffix.
If you disable this policy setting, DNS clients do not attempt to resolve names that are concatenations of the single-label name to be resolved and the devolved primary DNS suffix.</string>
<string id="DNS_DomainNameDevolutionLevel">Primary DNS suffix devolution level</string>
<string id="DNS_DomainNameDevolutionLevel_Help">Specifies if the devolution level that DNS clients will use if they perform primary DNS suffix devolution during the name resolution process.
With devolution, a DNS client creates queries by appending a single-label, unqualified domain name with the parent suffix of the primary DNS suffix name, and the parent of that suffix, and so on, stopping if the name is successfully resolved or at a level determined by devolution settings. Devolution can be used when a user or application submits a query for a single-label domain name.
The DNS client appends DNS suffixes to the single-label, unqualified domain name based on the state of the Append primary and connection specific DNS suffixes radio button and Append parent suffixes of the primary DNS suffix check box on the DNS tab in Advanced TCP/IP Settings for the Internet Protocol (TCP/IP) Properties dialog box.
Devolution is not enabled if a global suffix search list is configured using Group Policy.
If a global suffix search list is not configured, and the Append primary and connection specific DNS suffixes radio button is selected, the DNS client appends the following names to a single-label name when it sends DNS queries:
The primary DNS suffix, as specified on the Computer Name tab of the System control panel.
Each connection-specific DNS suffix, assigned either through DHCP or specified in the DNS suffix for this connection box on the DNS tab in the Advanced TCP/IP Settings dialog box for each connection.
For example, when a user submits a query for a single-label name such as "example," the DNS client attaches a suffix such as "microsoft.com" resulting in the query "example.microsoft.com," before sending the query to a DNS server.
If a DNS suffix search list is not specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the primary DNS suffix of the computer (drops the leftmost label of the primary DNS suffix), attaches this devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server.
For example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the non-dot-terminated single-label name "example," and the DNS query for example.ooo.aaa.microsoft.com fails, the DNS client devolves the primary DNS suffix (drops the leftmost label) till the specified devolution level, and submits a query for example.aaa.microsoft.com. If this query fails, the primary DNS suffix is devolved further if it is under specified devolution level and the query example.microsoft.com is submitted. If this query fails, devolution continues if it is under specified devolution level and the query example.microsoft.com is submitted, corresponding to a devolution level of two. The primary DNS suffix cannot be devolved beyond a devolution level of two. The devolution level can be configured using this policy setting. The default devolution level is two.
If you enable this policy setting and DNS devolution is also enabled, DNS clients use the DNS devolution level that you specify.
If this policy setting is disabled, or if this policy setting is not configured, DNS clients use the default devolution level of two provided that DNS devolution is enabled.</string>
<string id="DNS_TurnOffMulticast">Turn off multicast name resolution</string>
<string id="DNS_TurnOffMulticast_Help">Specifies that link local multicast name resolution (LLMNR) is disabled on client computers.
LLMNR is a secondary name resolution protocol. With LLMNR, queries are sent using multicast over a local network link on a single subnet from a client computer to another client computer on the same subnet that also has LLMNR enabled. LLMNR does not require a DNS server or DNS client configuration, and provides name resolution in scenarios in which conventional DNS name resolution is not possible.
If you enable this policy setting, LLMNR will be disabled on all available network adapters on the client computer.
If you disable this policy setting, or you do not configure this policy setting, LLMNR will be enabled on all available network adapters.</string>
<string id="DNS_AppendToMultiLabelName">Allow DNS suffix appending to unqualified multi-label name queries</string>
<string id="DNS_AppendToMultiLabelName_Help">Specifies that computers may attach suffixes to an unqualified multi-label name before sending subsequent DNS queries if the original name query fails.
A name containing dots, but not dot-terminated, is called an unqualified multi-label name, for example "server.corp" is an unqualified multi-label name. The name "server.corp.contoso.com." is an example of a fully qualified name because it contains a terminating dot.
For example, if attaching suffixes is allowed, an unqualified multi-label name query for "server.corp" will be queried by the DNS client first. If the query succeeds, the response is returned to the client. If the query fails, the unqualified multi-label name is appended with DNS suffixes. These suffixes can be derived from a combination of the local DNS client's primary domain suffix, a connection-specific domain suffix, and a DNS suffix search list.
If attaching suffixes is allowed, and a DNS client with a primary domain suffix of "contoso.com" performs a query for "server.corp" the DNS client will send a query for "server.corp" first, and then a query for "server.corp.contoso.com." second if the first query fails.
If you enable this policy setting, suffixes are allowed to be appended to an unqualified multi-label name if the original name query fails.
If you disable this policy setting, no suffixes are appended to unqualified multi-label name queries if the original name query fails.
If you do not configure this policy setting, computers will use their local DNS client settings to determine the query behavior for unqualified multi-label names.</string>
<string id="DNS_SmartMultiHomedNameResolution">Turn off smart multi-homed name resolution</string>
<string id="DNS_SmartMultiHomedNameResolution_Help">Specifies that a multi-homed DNS client should optimize name resolution across networks. The setting improves performance by issuing parallel DNS, link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT) queries across all networks. In the event that multiple positive responses are received, the network binding order is used to determine which response to accept.
If you enable this policy setting, the DNS client will not perform any optimizations. DNS queries will be issued across all networks first. LLMNR queries will be issued if the DNS queries fail, followed by NetBT queries if LLMNR queries fail.
If you disable this policy setting, or if you do not configure this policy setting, name resolution will be optimized when issuing DNS, LLMNR and NetBT queries.</string>
<string id="DNS_SmartProtocolReorder">Turn off smart protocol reordering</string>
<string id="DNS_SmartProtocolReorder_Help">Specifies that the DNS client should prefer responses from link local name resolution protocols on non-domain networks over DNS responses when issuing queries for flat names. Examples of link local name resolution protocols include link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT).
If you enable this policy setting, the DNS client will prefer DNS responses, followed by LLMNR, followed by NetBT for all networks.
If you disable this policy setting, or if you do not configure this policy setting, the DNS client will prefer link local responses for flat name queries on non-domain networks.
Note: This policy setting is applicable only if the turn off smart multi-homed name resolution policy setting is disabled or not configured.</string>
<string id="DNS_AllowFQDNNetBiosQueries">Allow NetBT queries for fully qualified domain names</string>
<string id="DNS_AllowFQDNNetBiosQueries_Help">Specifies that NetBIOS over TCP/IP (NetBT) queries are issued for fully qualified domain names.
If you enable this policy setting, NetBT queries will be issued for multi-label and fully qualified domain names such as "www.example.com" in addition to single-label names.
If you disable this policy setting, or if you do not configure this policy setting, NetBT queries will only be issued for single-label names such as "example" and not for multi-label and fully qualified domain names.</string>
<string id="DNS_PreferLocalResponsesOverLowerOrderDns">Prefer link local responses over DNS when received over a network with higher precedence</string>
<string id="DNS_PreferLocalResponsesOverLowerOrderDns_Help">Specifies that responses from link local name resolution protocols received over a network interface that is higher in the binding order are preferred over DNS responses from network interfaces lower in the binding order. Examples of link local name resolution protocols include link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT).
If you enable this policy setting, responses from link local protocols will be preferred over DNS responses if the local responses are from a network with a higher binding order.
If you disable this policy setting, or if you do not configure this policy setting, then DNS responses from networks lower in the binding order will be preferred over responses from link local protocols received from networks higher in the binding order.
Note: This policy setting is applicable only if the turn off smart multi-homed name resolution policy setting is disabled or not configured.</string>
<string id="DNS_IdnEncoding">Turn off IDN encoding</string>
<string id="DNS_IdnEncoding_Help">Specifies whether the DNS client should convert internationalized domain names (IDNs) to Punycode when the computer is on non-domain networks with no WINS servers configured.
If this policy setting is enabled, IDNs are not converted to Punycode.
If this policy setting is disabled, or if this policy setting is not configured, IDNs are converted to Punycode when the computer is on non-domain networks with no WINS servers configured.</string>
<string id="DNS_IdnMapping">IDN mapping</string>
<string id="DNS_IdnMapping_Help">Specifies whether the DNS client should convert internationalized domain names (IDNs) to the Nameprep form, a canonical Unicode representation of the string.
If this policy setting is enabled, IDNs are converted to the Nameprep form.
If this policy setting is disabled, or if this policy setting is not configured, IDNs are not converted to the Nameprep form.</string>
<string id="DNS_Doh">Configure DNS over HTTPS (DoH) name resolution</string>
<string id="DNS_Doh_Disabled">Prohibit DoH</string>
<string id="DNS_Doh_Auto">Allow DoH</string>
<string id="DNS_Doh_Force">Require DoH</string>
<string id="DNS_Doh_Help">Specifies if the DNS client will perform name resolution over DNS over HTTPS (DoH).
By default, the DNS client will do classic DNS name resolution (over UDP or TCP). This setting can enhance the DNS client to use DoH protocol to resolve domain names.
To use this policy setting, click Enabled, and then select one of the following options from the drop-down list:
Prohibit DoH: No DoH name resolution will be performed.
Allow DoH: Perform DoH queries if the configured DNS servers support it. If they don't support it, try classic name resolution.
Require DoH: Allow only DoH name resolution. If there are no DoH capable DNS servers configured, name resolution will fail.
If you disable this policy setting, or if you do not configure this policy setting, computers will use locally configured settings. DDR (Discovery of Designated Resolvers) plaintext traffic is allowed as it is necessary for auto-discovering DoH settings.</string>
<string id="DNS_Netbios">Configure NetBIOS settings</string>
<string id="DNS_Netbios_Disable">Disable NetBIOS name resolution</string>
<string id="DNS_Netbios_Allow">Allow NetBIOS name resolution</string>
<string id="DNS_Netbios_Disable_Public_Networks">Disable NetBIOS name resolution on public networks</string>
<string id="DNS_Netbios_Learning_Mode">NetBIOS learning mode</string>
<string id="DNS_Netbios_Help">Specifies if the DNS client will perform name resolution over NetBIOS.
By default, the DNS client will disable NetBIOS name resolution on public networks for security reasons.
To use this policy setting, click Enabled, and then select one of the following options from the drop-down list:
Disable NetBIOS name resolution: Never allow NetBIOS name resolution.
Allow NetBIOS name resolution: Always allow NetBIOS name resolution.
Disable NetBIOS name resolution on public networks: Only allow NetBIOS name resolution on network adapters which are not connected to public networks.
NetBIOS learning mode: Always allow NetBIOS name resolution and use it as a fallback after mDNS/LLMNR queries fail.
If you disable this policy setting, or if you do not configure this policy setting, computers will use locally configured settings.</string>
<string id="DNS_Ddr">Configure Discovery of Designated Resolvers (DDR) protocol</string>
<string id="DNS_Ddr_Help">Specifies if the DNS client would use the DDR protocol.
The Discovery of Designated Resolvers (DDR) protocol allows Windows to move from unencrypted DNS to encrypted DNS when only the IP address of a resolver is known.
If you enable this policy, the DNS client will use the DDR protocol.
If you disable this policy setting, or if you do not configure this policy setting, computers will use locally configured settings.</string>
</stringTable>
<presentationTable>
<presentation id="DNS_Domain">
<textBox refId="DNS_DomainLabel">
<label>DNS suffix:</label>
</textBox>
</presentation>
<presentation id="DNS_NameServer">
<textBox refId="DNS_NameServerLabel">
<label>IP addresses:</label>
</textBox>
</presentation>
<presentation id="DNS_PrimaryDnsSuffix">
<textBox refId="DNS_PrimaryDnsSuffixBox">
<label>Enter a primary DNS suffix:</label>
</textBox>
</presentation>
<presentation id="DNS_RegisterReverseLookup">
<dropdownList refId="DNS_RegisterReverseLookup_Box" defaultItem="0">Register PTR records:</dropdownList>
</presentation>
<presentation id="DNS_RegistrationRefreshInterval">
<decimalTextBox refId="DNS_RegistrationRefreshIntervalLabel" defaultValue="1800" spinStep="100">Seconds:</decimalTextBox>
</presentation>
<presentation id="DNS_DomainNameDevolutionLevel">
<decimalTextBox refId="DNS_DomainNameDevolutionLevelLabel" defaultValue="2" spinStep="1">Set the primary DNS suffix devolution level</decimalTextBox>
</presentation>
<presentation id="DNS_RegistrationTtl">
<decimalTextBox refId="DNS_RegistrationTtlLabel" defaultValue="600" spinStep="100">Seconds:</decimalTextBox>
</presentation>
<presentation id="DNS_SearchList">
<textBox refId="DNS_SearchListLabel">
<label>DNS Suffixes:</label>
</textBox>
</presentation>
<presentation id="DNS_UpdateSecurityLevel">
<dropdownList refId="DNS_UpdateSecurityLevel_Box" defaultItem="2">Update security level:</dropdownList>
</presentation>
<presentation id="DNS_Doh">
<dropdownList refId="DNS_Doh_Box" defaultItem="1">Configure DoH options:</dropdownList>
</presentation>
<presentation id="DNS_Netbios">
<dropdownList refId="DNS_Netbios_Box" defaultItem="1">Configure NetBIOS options:</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/EAIME.adml
+180
View File
@@ -0,0 +1,180 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="L_IME">IME</string>
<string id="L_TurnOnMisconversionLoggingForMisconversionReport">Turn on misconversion logging for misconversion report</string>
<string id="L_TurnOnMisconversionLoggingForMisconversionReportExplain">This policy setting allows you to turn on logging of misconversion for the misconversion report.
If you enable this policy setting, misconversion logging is turned on.
If you disable or do not configure this policy setting, misconversion logging is turned off.
This policy setting applies to Japanese Microsoft IME and Traditional Chinese IME.</string>
<string id="L_TurnOffSavingAutoTuningDataToFile">Turn off saving auto-tuning data to file</string>
<string id="L_TurnOffSavingAutoTuningDataToFileExplain">This policy setting allows you to turn off saving the auto-tuning result to file.
If you enable this policy setting, the auto-tuning data is not saved to file.
If you disable or do not configure this policy setting, auto-tuning data is saved to file by default.
This policy setting applies to Japanese Microsoft IME only.</string>
<string id="L_TurnOffHistorybasedPredictiveInput">Turn off history-based predictive input</string>
<string id="L_TurnOffHistorybasedPredictiveInputExplain">This policy setting allows you to turn off history-based predictive input.
If you enable this policy setting, history-based predictive input is turned off.
If you disable or do not configure this policy setting, history-based predictive input is on by default.
This policy setting applies to Japanese Microsoft IME only.
Note: Changes to this setting will not take effect until the user logs off.</string>
<string id="L_TurnOffOpenExtendedDictionary">Turn off Open Extended Dictionary</string>
<string id="L_TurnOffOpenExtendedDictionaryExplain">This policy setting allows you to turn off Open Extended Dictionary.
If you enable this policy setting, Open Extended Dictionary is turned off. You cannot add a new Open Extended Dictionary.
For Japanese Microsoft IME, an Open Extended Dictionary that is added before enabling this policy setting is not used for conversion.
If you disable or do not configure this policy setting, Open Extended Dictionary can be added and used by default.
This policy setting is applied to Japanese Microsoft IME.</string>
<string id="L_TurnOffInternetSearchIntegration">Turn off Internet search integration</string>
<string id="L_TurnOffInternetSearchIntegrationExplain">This policy setting allows you to turn off Internet search integration.
Search integration includes both using Search Provider (Japanese Microsoft IME) and performing bing search from predictive input for Japanese Microsoft IME.
If you enable this policy setting, you cannot use search integration.
If you disable or do not configure this policy setting, the search integration function can be used by default.
This policy setting applies to Japanese Microsoft IME.
Note: Changes to this setting will not take effect until the user logs off.</string>
<string id="L_TurnOffCustomDictionary">Turn off custom dictionary</string>
<string id="L_TurnOffCustomDictionaryExplain">This policy setting allows you to turn off the ability to use a custom dictionary.
If you enable this policy setting, you cannot add, edit, and delete words in the custom dictionary either with GUI tools or APIs. A word registered in the custom dictionary before enabling this policy setting can continue to be used for conversion.
If you disable or do not configure this policy setting, the custom dictionary can be used by default.
[Clear auto-tuning information] removes self-tuned words from the custom dictionary, even if a group policy setting is turned on. To do this, select Settings &gt; Time &amp; Language &gt; Japanese Options &gt; Microsoft IME Options. If compatibility mode is turned on, select Advanced options &gt; Dictionary/Auto-tuning &gt; [Clear auto-tuning information].
[Clear input history] removes self-tuned words from the custom dictionary, even if a group policy setting is turned on. To do this, select Settings &gt; Time &amp; Language &gt; Japanese Options &gt; Microsoft IME Options &gt; Learning and Dictionary &gt; [Clear input history].
This policy setting is applied to Japanese Microsoft IME.
Note: Changes to this setting will not take effect until the user logs off.</string>
<string id="L_RestrictCharacterCodeRangeOfConversion">Restrict character code range of conversion</string>
<string id="L_RestrictCharacterCodeRangeOfConversionExplain">This policy setting allows you to restrict character code range of conversion by setting character filter.
If you enable this policy setting, then only the character code ranges specified by this policy setting are used for conversion of IME. You can specify multiple ranges by setting a value combined with a bitwise OR of following values:
0x0001 // JIS208 area
0x0002 // NEC special char code
0x0004 // NEC selected IBM extended code
0x0008 // IBM extended code
0x0010 // Half width katakana code
0x0100 // EUDC(GAIJI)
0x0200 // S-JIS unmapped area
0x0400 // Unicode char
0x0800 // surrogate char
0x1000 // IVS char
0xFFFF // no definition.
If you disable or do not configure this policy setting, no range of characters are filtered by default.
This policy setting applies to Japanese Microsoft IME only.
Note: Changes to this setting will not take effect until the user logs off.</string>
<string id="L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList">Do not include Non-Publishing Standard Glyph in the candidate list</string>
<string id="L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateListExplain">This policy setting allows you to include the Non-Publishing Standard Glyph in the candidate list when Publishing Standard Glyph for the word exists.
If you enable this policy setting, Non-Publishing Standard Glyph is not included in the candidate list when Publishing Standard Glyph for the word exists.
If you disable or do not configure this policy setting, both Publishing Standard Glyph and Non-Publishing Standard Glyph are included in the candidate list.
This policy setting applies to Japanese Microsoft IME only.
Note: Changes to this setting will not take effect until the user logs off.</string>
<string id="L_TurnOnCloudCandidate">Turn on cloud candidate</string>
<string id="L_TurnOnCloudCandidateExplain">This policy setting controls the cloud candidates feature, which uses an online service to provide input suggestions that don't exist in a PC's local dictionary.
If you enable this policy setting, the functionality associated with this feature is turned on, the user's keyboard input is sent to Microsoft to generate the suggestions, and the user won't be able to turn it off.
If you disable this policy setting, the functionality associated with this feature is turned off, and the user won't be able to turn it on.
If you don't configure this policy setting, it will be turned off by default, and the user can turn on and turn off the cloud candidates feature.
This Policy setting applies to Microsoft CHS Pinyin IME and JPN IME.</string>
<string id="L_TurnOnCloudCandidateCHS">Turn on cloud candidate for CHS</string>
<string id="L_TurnOnCloudCandidateCHSExplain">This policy setting controls the cloud candidates feature, which uses an online service to provide input suggestions that don't exist in a PC's local dictionary.
If you enable this policy setting, the functionality associated with this feature is turned on, the user's keyboard input is sent to Microsoft to generate the suggestions, and the user won't be able to turn it off.
If you disable this policy setting, the functionality associated with this feature is turned off, and the user won't be able to turn it on.
If you don't configure this policy setting, it will be turned off by default, and the user can turn on and turn off the cloud candidates feature.
This Policy setting applies only to Microsoft CHS Pinyin IME.</string>
<string id="L_ConfigureSimplifiedChineseImeVersion">Configure Simplified Chinese IME version</string>
<string id="L_ConfigureSimplifiedChineseImeVersionExplain">This policy setting controls the version of Microsoft IME.​
If you don’t configure this policy setting, user can control IME version to use. The new Microsoft IME is on by default.​
If you enable this, user is not allowed to control IME version to use. The previous version of Microsoft IME is always selected.​
If you disable this, user is not allowed to control IME version to use. The new Microsoft IME is always selected.
This Policy setting applies only to Microsoft Simplified Chinese IME.
Note: Changes to this setting will not take effect until the user logs off.</string>
<string id="L_ConfigureTraditionalChineseImeVersion">Configure Traditional Chinese IME version</string>
<string id="L_ConfigureTraditionalChineseImeVersionExplain">This policy setting controls the version of Microsoft IME.​
If you don’t configure this policy setting, user can control IME version to use. The new Microsoft IME is on by default.​
If you enable this, user is not allowed to control IME version to use. The previous version of Microsoft IME is always selected.​
If you disable this, user is not allowed to control IME version to use. The new Microsoft IME is always selected.
This Policy setting applies only to Microsoft Traditional Chinese IME.
Note: Changes to this setting will not take effect until the user logs off.</string>
<string id="L_ConfigureJapaneseImeVersion">Configure Japanese IME version</string>
<string id="L_ConfigureJapaneseImeVersionExplain">This policy setting controls the version of Microsoft IME.​
If you don’t configure this policy setting, user can control IME version to use. The new Microsoft IME is on by default.​
If you enable this, user is not allowed to control IME version to use. The previous version of Microsoft IME is always selected.​
If you disable this, user is not allowed to control IME version to use. The new Microsoft IME is always selected.
This Policy setting applies only to Microsoft Japanese IME.
Note: Changes to this setting will not take effect until the user logs off.</string>
<string id="L_ConfigureKoreanImeVersion">Configure Korean IME version</string>
<string id="L_ConfigureKoreanImeVersionExplain">This policy setting controls the version of Microsoft IME.​
If you don’t configure this policy setting, user can control IME version to use. The new Microsoft IME is on by default.​
If you enable this, user is not allowed to control IME version to use. The previous version of Microsoft IME is always selected.​
If you disable this, user is not allowed to control IME version to use. The new Microsoft IME is always selected.
This Policy setting applies only to Microsoft Korean IME.
Note: Changes to this setting will not take effect until the user logs off.</string>
</stringTable>
<presentationTable>
<presentation id="L_RestrictCharacterCodeRangeOfConversion">
<textBox refId="L_RestrictCharacterCodeRangeOfConversionID">
<label>Character code range:</label>
</textBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/EarlyLaunchAM.adml
+31
View File
@@ -0,0 +1,31 @@
<policyDefinitionResources revision="1.0" schemaVersion="1.0">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="ELAMCategory">Early Launch Antimalware</string>
<string id="POL_DriverLoadPolicy_Name">Boot-Start Driver Initialization Policy</string>
<string id="POL_DriverLoadPolicy_Name_Help">This policy setting allows you to specify which boot-start drivers are initialized based on a classification determined by an Early Launch Antimalware boot-start driver. The Early Launch Antimalware boot-start driver can return the following classifications for each boot-start driver:
- Good: The driver has been signed and has not been tampered with.
- Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized.
- Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver.
- Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot-start driver.
If you enable this policy setting you will be able to choose which boot-start drivers to initialize the next time the computer is started.
If you disable or do not configure this policy setting, the boot start drivers determined to be Good, Unknown or Bad but Boot Critical are initialized and the initialization of drivers determined to be Bad is skipped.
If your malware detection application does not include an Early Launch Antimalware boot-start driver or if your Early Launch Antimalware boot-start driver has been disabled, this setting has no effect and all boot-start drivers are initialized.
</string>
<string id="SelectDriverLoadPolicy-GoodOnly">Good only</string>
<string id="SelectDriverLoadPolicy-GoodPlusUnknown">Good and unknown</string>
<string id="SelectDriverLoadPolicy-GoodPlusUnknownPlusKnownBadCritical">Good, unknown and bad but critical</string>
<string id="SelectDriverLoadPolicy-All">All</string>
</stringTable>
<presentationTable>
<presentation id="POL_DriverLoadPolicy_Name">
<dropdownList refId="SelectDriverLoadPolicy" defaultItem="2" noSort="true">Choose the boot-start drivers that can be initialized:</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/EdgeUI.adml
+54
View File
@@ -0,0 +1,54 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2011 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="EdgeUI">Edge UI</string>
<string id="EdgeUI_Help">Contains settings related to system user interfaces attached to the screen edges.</string>
<string id="TurnOffBackstack">Turn off switching between recent apps</string>
<string id="TurnOffBackstack_Help">If you enable this setting, users will not be allowed to switch between recent apps. The App Switching option in the PC settings app will be disabled as well.
If you disable or do not configure this policy setting, users will be allowed to switch between recent apps.</string>
<string id="DisableMFUTracking">Turn off tracking of app usage</string>
<string id="ExplainDisableMFUTracking">This policy setting prevents Windows from keeping track of the apps that are used and searched most frequently. If you enable this policy setting, apps will be sorted alphabetically in:
- search results
- the Search and Share panes
- the drop-down app list in the Picker
If you disable or don't configure this policy setting, Windows will keep track of the apps that are used and searched most frequently. Most frequently used apps will appear at the top.</string>
<string id="DisableRecentApps">Do not show recent apps when the mouse is pointing to the upper-left corner of the screen</string>
<string id="DisableRecentApps_Help">This policy setting allows you to prevent the last app and the list of recent apps from appearing when the mouse is pointing to the upper-left corner of the screen.
If you enable this policy setting, the user will no longer be able to switch to recent apps using the mouse. The user will still be able to switch apps using touch gestures, keyboard shortcuts, and the Start screen.
If you disable or don't configure this policy setting, the recent apps will be available by default, and the user can configure this setting.</string>
<string id="DisableCharms">Search, Share, Start, Devices, and Settings don't appear when the mouse is pointing to the upper-right corner of the screen</string>
<string id="DisableCharms_Help">This policy setting allows you to prevent Search, Share, Start, Devices, and Settings from appearing when the mouse is pointing to the upper-right corner of the screen.
If you enable this policy setting, Search, Share, Start, Devices, and Settings will no longer appear when the mouse is pointing to the upper-right corner. They'll still be available if the mouse is pointing to the lower-right corner.
If you disable or don't configure this policy setting, Search, Share, Start, Devices, and Settings will be available by default, and the user can configure this setting.</string>
<string id="ShowCommandPromptOnWinX">Prevent users from replacing the Command Prompt with Windows PowerShell in the menu they see when they right-click the lower-left corner or press the Windows logo key+X</string>
<string id="ShowCommandPromptOnWinX_Help">This policy setting allows you to prevent users from replacing the Command Prompt with Windows PowerShell in the menu they see when they right-click the lower-left corner or press the Windows logo key + X.
If you enable this policy setting, the Command Prompt will always be listed in that menu, and users won't be able to replace it with Windows PowerShell. Users will still be able to access Windows PowerShell, but not from that menu.
If you disable or don't configure this policy setting, Command Prompt will be listed in the menu by default, and users can configure this setting.</string>
<string id="DisableHelpSticker">Disable help tips</string>
<string id="DisableHelpSticker_Help">Disables help tips that Windows shows to the user.
By default, Windows will show the user help tips until the user has successfully completed the scenarios.
If this setting is enabled, Windows will not show any help tips to the user.
</string>
<string id="AllowEdgeSwipe">Allow edge swipe</string>
<string id="AllowEdgeSwipe_Help">If you disable this policy setting, users will not be able to invoke any system UI by swiping in from any screen edge.
If you enable or do not configure this policy setting, users will be able to invoke system UI by swiping in from the screen edges.
</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/EncryptFilesonMove.adml
+18
View File
@@ -0,0 +1,18 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="NoEncryptOnMove">Do not automatically encrypt files moved to encrypted folders</string>
<string id="NoEncryptOnMove_Help">This policy setting prevents File Explorer from encrypting files that are moved to an encrypted folder.
If you enable this policy setting, File Explorer will not automatically encrypt files that are moved to an encrypted folder.
If you disable or do not configure this policy setting, File Explorer automatically encrypts files that are moved to an encrypted folder.
This setting applies only to files moved within a volume. When files are moved to other volumes, or if you create a new file in an encrypted folder, File Explorer encrypts those files automatically.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/EnhancedStorage.adml
+75
View File
@@ -0,0 +1,75 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Enhanced Storage Devices Group Policies</displayName>
<description>Group Policies for managing Enhanced Storage devices</description>
<resources>
<stringTable>
<string id="EnStorDeviceAccess">Enhanced Storage Access</string>
<string id="RootHubConnectedEnStorDevices">Allow only USB root hub connected Enhanced Storage devices</string>
<string id="RootHubConnectedEnStorDevices_Help">This policy setting configures whether or not only USB root hub connected Enhanced Storage devices are allowed. Allowing only root hub connected Enhanced Storage devices minimizes the risk of an unauthorized USB device reading data on an Enhanced Storage device.
If you enable this policy setting, only USB root hub connected Enhanced Storage devices are allowed.
If you disable or do not configure this policy setting, USB Enhanced Storage devices connected to both USB root hubs and non-root hubs will be allowed.</string>
<string id="LockDeviceOnMachineLock">Lock Enhanced Storage when the computer is locked</string>
<string id="LockDeviceOnMachineLock_Help">This policy setting locks Enhanced Storage devices when the computer is locked.
This policy setting is supported in Windows Server SKUs only.
If you enable this policy setting, the Enhanced Storage device remains locked when the computer is locked.
If you disable or do not configure this policy setting, the Enhanced Storage device state is not changed when the computer is locked.</string>
<string id="DisallowLegacyDiskDevices">Do not allow non-Enhanced Storage removable devices</string>
<string id="DisallowLegacyDiskDevices_Help">This policy setting configures whether or not non-Enhanced Storage removable devices are allowed on your computer.
If you enable this policy setting, non-Enhanced Storage removable devices are not allowed on your computer.
If you disable or do not configure this policy setting, non-Enhanced Storage removable devices are allowed on your computer.</string>
<string id="DisablePasswordAuthentication">Do not allow password authentication of Enhanced Storage devices</string>
<string id="DisablePasswordAuthentication_Help">This policy setting configures whether or not a password can be used to unlock an Enhanced Storage device.
If you enable this policy setting, a password cannot be used to unlock an Enhanced Storage device.
If you disable or do not configure this policy setting, a password can be used to unlock an Enhanced Storage device.</string>
<string id="TCGSecurityActivationDisabled">Do not allow Windows to activate Enhanced Storage devices</string>
<string id="TCGSecurityActivationDisabled_Help">This policy setting configures whether or not Windows will activate an Enhanced Storage device.
If you enable this policy setting, Windows will not activate unactivated Enhanced Storage devices.
If you disable or do not configure this policy setting, Windows will activate unactivated Enhanced Storage devices.</string>
<string id="ApprovedEnStorDevices">Configure list of Enhanced Storage devices usable on your computer</string>
<string id="ApprovedEnStorDevices_Help">This policy setting allows you to configure a list of Enhanced Storage devices by manufacturer and product ID that are usable on your computer.
If you enable this policy setting, only Enhanced Storage devices that contain a manufacturer and product ID specified in this policy are usable on your computer.
If you disable or do not configure this policy setting, all Enhanced Storage devices are usable on your computer.</string>
<string id="ApprovedSilos">Configure list of IEEE 1667 silos usable on your computer</string>
<string id="ApprovedSilos_Help">This policy setting allows you to create a list of IEEE 1667 silos, compliant with the Institute of Electrical and Electronics Engineers, Inc. (IEEE) 1667 specification, that are usable on your computer.
If you enable this policy setting, only IEEE 1667 silos that match a silo type identifier specified in this policy are usable on your computer.
If you disable or do not configure this policy setting, all IEEE 1667 silos on Enhanced Storage devices are usable on your computer.</string>
</stringTable>
<presentationTable>
<presentation id="ApprovedEnStorDevices">
<listBox refId="ApprovedEnStorDevices_List">Usable Enhanced Storage Devices:</listBox>
<text>The device identifier should be entered in the form "Vendor ID-Product ID" where "Vendor ID" is the Institute of Electrical and Electronics Engineers, Inc. (IEEE) issued organizationally unique identifier (OUI) of the manufacturer and "Product ID" is a string assigned by the manufacturer.</text>
<text>For more information on how to obtain the manufacturer and product ID from the device search for "Enhanced Storage Access" on Microsoft TechNet.</text>
</presentation>
<presentation id="ApprovedSilos">
<listBox refId="ApprovedSilos_List">Usable IEEE 1667 Silo Type Identifiers:</listBox>
<text>Each silo type identifier must be a separate entry.</text>
<text>For more information on how to set a silo type identifier for this policy search for "Enhanced Storage Access" on Microsoft TechNet.</text>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/ErrorReporting.adml
+295
View File
@@ -0,0 +1,295 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Windows Error Reporting</displayName>
<description>Windows Error Reporting</description>
<resources>
<stringTable>
<string id="CAT_WindowsErrorReporting">Windows Error Reporting</string>
<string id="CAT_WindowsErrorReportingAdvanced">Advanced Error Reporting Settings</string>
<string id="CAT_WindowsErrorReportingConsent">Consent</string>
<string id="PCH_AllOrNoneDef">Default application reporting settings</string>
<string id="PCH_AllOrNoneDef_Exclude">Do not report any application errors</string>
<string id="PCH_AllOrNoneDef_Help">This policy setting controls whether errors in general applications are included in reports when Windows Error Reporting is enabled.
If you enable this policy setting, you can instruct Windows Error Reporting in the Default pull-down menu to report either all application errors (the default setting), or no application errors.
If the Report all errors in Microsoft applications check box is filled, all errors in Microsoft applications are reported, regardless of the setting in the Default pull-down menu. When the Report all errors in Windows check box is filled, all errors in Windows applications are reported, regardless of the setting in the Default dropdown list. The Windows applications category is a subset of Microsoft applications.
If you disable or do not configure this policy setting, users can enable or disable Windows Error Reporting in Control Panel. The default setting in Control Panel is Upload all applications.
This policy setting is ignored if the Configure Error Reporting policy setting is disabled or not configured.
For related information, see the Configure Error Reporting and Report Operating System Errors policy settings.</string>
<string id="PCH_AllOrNoneDef_Include">Report all application errors</string>
<string id="PCH_AllOrNoneEx">List of applications to never report errors for</string>
<string id="PCH_AllOrNoneEx_Help">This policy setting controls Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on.
If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show under the Exclude errors for applications on this list setting, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. Errors that are generated by applications in this list are not reported, even if the Default Application Reporting Settings policy setting is configured to report all application errors.
If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence. If an application is listed both in the List of applications to always report errors for policy setting, and in the exclusion list in this policy setting, the application is excluded from error reporting. You can also use the exclusion list in this policy setting to exclude specific Microsoft applications or parts of Windows if the check boxes for these categories are filled in the Default application reporting settings policy setting.
If you disable or do not configure this policy setting, the Default application reporting settings policy setting takes precedence.</string>
<string id="PCH_AllOrNoneInc">List of applications to always report errors for</string>
<string id="PCH_AllOrNoneInc_Help">This policy setting specifies applications for which Windows Error Reporting should always report errors.
To create a list of applications for which Windows Error Reporting never reports errors, click Show under the Exclude errors for applications on this list setting, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). Errors that are generated by applications in this list are not reported, even if the Default Application Reporting Settings policy setting is configured to report all application errors.
If you enable this policy setting, you can create a list of applications that are always included in error reporting. To add applications to the list, click Show under the Report errors for applications on this list setting, and edit the list of application file names in the Show Contents dialog box. The file names must include the .exe file name extension (for example, notepad.exe). Errors that are generated by applications on this list are always reported, even if the Default dropdown in the Default application reporting policy setting is set to report no application errors.
If the Report all errors in Microsoft applications or Report all errors in Windows components check boxes in the Default Application Reporting policy setting are filled, Windows Error Reporting reports errors as if all applications in these categories were added to the list in this policy setting. (Note: The Microsoft applications category includes the Windows components category.)
If you disable this policy setting or do not configure it, the Default application reporting settings policy setting takes precedence.
Also see the ""Default Application Reporting"" and ""Application Exclusion List"" policies.
This setting will be ignored if the 'Configure Error Reporting' setting is disabled or not configured.</string>
<string id="PCH_ConfigureReport">Configure Error Reporting</string>
<string id="PCH_ConfigureReport_Help">This policy setting configures how errors are reported to Microsoft, and what information is sent when Windows Error Reporting is enabled.
This policy setting does not enable or disable Windows Error Reporting. To turn Windows Error Reporting on or off, see the Turn off Windows Error Reporting policy setting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings.
Important: If the Turn off Windows Error Reporting policy setting is not configured, then Control Panel settings for Windows Error Reporting override this policy setting.
If you enable this policy setting, the setting overrides any user changes made to Windows Error Reporting settings in Control Panel, and default values are applied for any Windows Error Reporting policy settings that are not configured (even if users have changed settings by using Control Panel). If you enable this policy setting, you can configure the following settings in the policy setting:
- ""Do not display links to any Microsoft ‘More information’ websites"": Select this option if you do not want error dialog boxes to display links to Microsoft websites.
- ""Do not collect additional files"": Select this option if you do not want additional files to be collected and included in error reports.
- ""Do not collect additional computer data"": Select this if you do not want additional information about the computer to be collected and included in error reports.
- ""Force queue mode for application errors"": Select this option if you do not want users to report errors. When this option is selected, errors are stored in a queue directory, and the next administrator to log on to the computer can send the error reports to Microsoft.
- ""Corporate file path"": Type a UNC path to enable Corporate Error Reporting. All errors are stored at the specified location instead of being sent directly to Microsoft, and the next administrator to log onto the computer can send the error reports to Microsoft.
- ""Replace instances of the word ‘Microsoft’ with"": You can specify text with which to customize your error report dialog boxes. The word ""Microsoft"" is replaced with the specified text.
If you do not configure this policy setting, users can change Windows Error Reporting settings in Control Panel. By default, these settings are Enable Reporting on computers that are running Windows XP, and Report to Queue on computers that are running Windows Server 2003.
If you disable this policy setting, configuration settings in the policy setting are left blank.
See related policy settings Display Error Notification (same folder as this policy setting), and Turn off Windows Error Reporting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings.</string>
<string id="PCH_ReportOperatingSystemFaults">Report operating system errors</string>
<string id="PCH_ReportOperatingSystemFaults_Help">This policy setting controls whether errors in the operating system are included Windows Error Reporting is enabled.
If you enable this policy setting, Windows Error Reporting includes operating system errors.
If you disable this policy setting, operating system errors are not included in error reports.
If you do not configure this policy setting, users can change this setting in Control Panel. By default, Windows Error Reporting settings in Control Panel are set to upload operating system errors.
See also the Configure Error Reporting policy setting.</string>
<string id="PCH_ShowUI">Display Error Notification</string>
<string id="PCH_ShowUI_Help">This policy setting controls whether users are shown an error dialog box that lets them report an error.
If you enable this policy setting, users are notified in a dialog box that an error has occurred, and can display more details about the error. If the Configure Error Reporting policy setting is also enabled, the user can also report the error.
If you disable this policy setting, users are not notified that errors have occurred. If the Configure Error Reporting policy setting is also enabled, errors are reported, but users receive no notification. Disabling this policy setting is useful for servers that do not have interactive users.
If you do not configure this policy setting, users can change this setting in Control Panel, which is set to enable notification by default on computers that are running Windows XP Personal Edition and Windows XP Professional Edition, and disable notification by default on computers that are running Windows Server.
See also the Configure Error Reporting policy setting.</string>
<string id="WerArchive">Configure Report Archive</string>
<string id="WerArchiveEverything">Store all</string>
<string id="WerArchiveExp">This policy setting controls the behavior of the Windows Error Reporting archive.
If you enable this policy setting, you can configure Windows Error Reporting archiving behavior. If Archive behavior is set to Store all, all data collected for each error report is stored in the appropriate location. If Archive behavior is set to Store parameters only, only the minimum information required to check for an existing solution is stored. The Maximum number of reports to store setting determines how many reports are stored before older reports are automatically deleted.
If you disable or do not configure this policy setting, no Windows Error Reporting information is stored.</string>
<string id="WerArchiveOnlyMetaData">Store parameters only</string>
<string id="WerCER">Configure Corporate Windows Error Reporting</string>
<string id="WerCERExp">This policy setting specifies a corporate server to which Windows Error Reporting sends reports (if you do not want to send error reports to Microsoft).
If you enable this policy setting, you can specify the name or IP address of an error report destination server on your organization’s network. You can also select Connect using SSL to transmit error reports over a Secure Sockets Layer (SSL) connection, and specify a port number on the destination server for transmission.
If you disable or do not configure this policy setting, Windows Error Reporting sends error reports to Microsoft.</string>
<string id="WerConsentAlwaysAsk">Always ask before sending data</string>
<string id="WerConsentCustomize">Customize consent settings</string>
<string id="WerConsentCustomizeExp">This policy setting determines the consent behavior of Windows Error Reporting for specific event types.
If you enable this policy setting, you can add specific event types to a list by clicking Show, and typing event types in the Value Name column of the Show Contents dialog box. Event types are those for generic, non-fatal errors: crash, no response, and kernel fault errors. For each specified event type, you can set a consent level of 0, 1, 2, 3, or 4.
- 0 (Disable): Windows Error Reporting sends no data to Microsoft for this event type.
- 1 (Always ask before sending data): Windows prompts the user for consent to send reports.
- 2 (Send parameters): Windows Error Reporting automatically sends the minimum data required to check for an existing solution, and Windows prompts the user for consent to send any additional data requested by Microsoft.
- 3 (Send parameters and safe additional data): Windows Error Reporting automatically sends the minimum data required to check for an existing solution, as well as data which Windows has determined (within a high probability) does not contain personally identifiable data, and prompts the user for consent to send any additional data requested by Microsoft.
- 4 (Send all data): Any data requested by Microsoft is sent automatically.
If you disable or do not configure this policy setting, then the default consent settings that are applied are those specified by the user in Control Panel, or in the Configure Default Consent policy setting.</string>
<string id="WerConsentDisabled">Disable</string>
<string id="WerConsentEverything">Send all data</string>
<string id="WerConsentOverride">Ignore custom consent settings</string>
<string id="WerConsentOverrideExp">This policy setting determines the behavior of the Configure Default Consent setting in relation to custom consent settings.
If you enable this policy setting, the default consent levels of Windows Error Reporting always override any other consent policy setting.
If you disable or do not configure this policy setting, custom consent policy settings for error reporting determine the consent level for specified event types, and the default consent setting determines only the consent level of any other error reports.</string>
<string id="WerConsentParamsAndSafeData">Send parameters and safe additional data</string>
<string id="WerConsentParamsOnly">Send parameters</string>
<string id="WerDefaultConsent">Configure Default consent</string>
<string id="WerDefaultConsentExp">This policy setting determines the default consent behavior of Windows Error Reporting.
If you enable this policy setting, you can set the default consent handling for error reports. The following list describes the Consent level settings that are available in the pull-down menu in this policy setting:
- Always ask before sending data: Windows prompts users for consent to send reports.
- Send parameters: Only the minimum data that is required to check for an existing solution is sent automatically, and Windows prompts users for consent to send any additional data that is requested by Microsoft.
- Send parameters and safe additional data: the minimum data that is required to check for an existing solution, along with data which Windows has determined (within a high probability) does not contain personally-identifiable information is sent automatically, and Windows prompts the user for consent to send any additional data that is requested by Microsoft.
- Send all data: any error reporting data requested by Microsoft is sent automatically.
If this policy setting is disabled or not configured, then the consent level defaults to the highest-privacy setting: Always ask before sending data.</string>
<string id="WerDisable">Disable Windows Error Reporting</string>
<string id="WerDisabledExp">This policy setting turns off Windows Error Reporting, so that reports are not collected or sent to either Microsoft or internal servers within your organization when software unexpectedly stops working or fails.
If you enable this policy setting, Windows Error Reporting does not send any problem information to Microsoft. Additionally, solution information is not available in Security and Maintenance in Control Panel.
If you disable or do not configure this policy setting, the Turn off Windows Error Reporting policy setting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings takes precedence. If Turn off Windows Error Reporting is also either disabled or not configured, user settings in Control Panel for Windows Error Reporting are applied.</string>
<string id="WerDoNotShowUI">Prevent display of the user interface for critical errors</string>
<string id="WerDoNotShowUIExp">This policy setting prevents the display of the user interface for critical errors.
If you enable or do not configure this policy setting, Windows Error Reporting does not display any GUI-based error messages or dialog boxes for critical errors.
If you disable this policy setting, Windows Error Reporting displays the GUI-based error messages or dialog boxes for critical errors.</string>
<string id="WerExlusion">List of applications to be excluded</string>
<string id="WerExlusionExp">This policy setting limits Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on.
If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. To remove an application from the list, click the name, and then press DELETE. If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence.
If you disable or do not configure this policy setting, errors are reported on all Microsoft and Windows applications by default.</string>
<string id="WerForceAdminQueue">Always queue for administrator</string>
<string id="WerForceQueue">Always queue</string>
<string id="WerNoLogging">Disable logging</string>
<string id="WerNoLoggingExp">This policy setting controls whether Windows Error Reporting saves its own events and error messages to the system event log.
If you enable this policy setting, Windows Error Reporting events are not recorded in the system event log.
If you disable or do not configure this policy setting, Windows Error Reporting events and errors are logged to the system event log, as with other Windows-based programs.</string>
<string id="WerNoSecondLevelData">Do not send additional data</string>
<string id="WerNoSecondLevelDataExp">This policy setting controls whether additional data in support of error reports can be sent to Microsoft automatically.
If you enable this policy setting, any additional data requests from Microsoft in response to a Windows Error Reporting report are automatically declined, without notification to the user.
If you disable or do not configure this policy setting, then consent policy settings in Computer Configuration/Administrative Templates/Windows Components/Windows Error Reporting/Consent take precedence.</string>
<string id="WerQueue">Configure Report Queue</string>
<string id="WerMachineQueueExp">This policy setting determines the behavior of the Windows Error Reporting report queue.
If you enable this policy setting, you can configure report queue behavior by using the controls in the policy setting. When the Queuing behavior pull-down list is set to Default, Windows determines, when a problem occurs, whether the report should be placed in the reporting queue, or the user should be prompted to send it immediately. When Queuing behavior is set to Always queue, all reports are added to the queue until the user is prompted to send the reports, or until the user sends problem reports by using the Solutions to Problems page in Control Panel. If Queuing behavior is set to Always queue for administrator, reports are queued until an administrator is prompted to send them, or until the administrator sends them by using the Solutions to Problems page in Control Panel.
The Maximum number of reports to queue setting determines how many reports can be queued before older reports are automatically deleted. The setting for Number of days between solution check reminders determines the interval time between the display of system notifications that remind the user to check for solutions to problems. A value of 0 disables the reminder.
If you disable or do not configure this policy setting, Windows Error Reporting reports are not queued, and users can only send reports at the time that a problem occurs.</string>
<string id="WerUserQueueExp">This policy setting determines the behavior of the Windows Error Reporting report queue.
If you enable this policy setting, you can configure report queue behavior by using the controls in the policy setting. When the Queuing behavior pull-down list is set to Default, Windows determines, when a problem occurs, whether the report should be placed in the reporting queue, or the user should be prompted to send it immediately. When Queuing behavior is set to Always queue, all reports are added to the queue until the user is prompted to send the reports, or until the user sends problem reports by using the Solutions to Problems page in Control Panel.
The Maximum number of reports to queue setting determines how many reports can be queued before older reports are automatically deleted. The setting for Number of days between solution check reminders determines the interval time between the display of system notifications that remind the user to check for solutions to problems. A value of 0 disables the reminder.
If you disable or do not configure this policy setting, Windows Error Reporting reports are not queued, and users can only send reports at the time that a problem occurs.</string>
<string id="WerQueueNormal">Default</string>
<string id="WerBypassDataThrottling">Do not throttle additional data</string>
<string id="WerBypassDataThrottlingExp">This policy setting determines whether Windows Error Reporting (WER) sends additional, second-level report data even if a CAB file containing data about the same event types has already been uploaded to the server.
If you enable this policy setting, WER does not throttle data; that is, WER uploads additional CAB files that can contain data about the same event types as an earlier uploaded report.
If you disable or do not configure this policy setting, WER throttles data by default; that is, WER does not upload more than one CAB file for a report that contains data about the same event types.</string>
<string id="WerBypassPowerThrottling">Send additional data when on battery power</string>
<string id="WerBypassPowerThrottlingExp">This policy setting determines whether Windows Error Reporting (WER) checks if the computer is running on battery power. By default, when a computer is running on battery power, WER only checks for solutions, but does not upload additional report data until the computer is connected to a more permanent power source.
If you enable this policy setting, WER does not determine whether the computer is running on battery power, but checks for solutions and uploads report data normally.
If you disable or do not configure this policy setting, WER checks for solutions while a computer is running on battery power, but does not upload report data until the computer is connected to a more permanent power source.</string>
<string id="WerBypassNetworkCostThrottling">Send data when on connected to a restricted/costed network</string>
<string id="WerBypassNetworkCostThrottlingExp">This policy setting determines whether Windows Error Reporting (WER) checks for a network cost policy that restricts the amount of data that is sent over the network.
If you enable this policy setting, WER does not check for network cost policy restrictions, and transmits data even if network cost is restricted.
If you disable or do not configure this policy setting, WER does not send data, but will check the network cost policy again if the network profile is changed.</string>
<string id="WerAutoApproveOSDumps">Automatically send memory dumps for OS-generated error reports</string>
<string id="WerAutoApproveOSDumpsExp">This policy setting controls whether memory dumps in support of OS-generated error reports can be sent to Microsoft automatically. This policy does not apply to error reports generated by 3rd-party products, or additional data other than memory dumps.
If you enable or do not configure this policy setting, any memory dumps generated for error reports by Microsoft Windows are automatically uploaded, without notification to the user.
If you disable this policy setting, then all memory dumps are uploaded according to the default consent and notification settings.
</string>
</stringTable>
<presentationTable>
<presentation id="PCH_AllOrNoneDef">
<dropdownList refId="PCH_AllOrNoneDef_List" noSort="true" defaultItem="0">Default:</dropdownList>
<checkBox refId="PCH_AllOrNoneIncMS_Chk" defaultChecked="true">Report all errors in Microsoft applications.</checkBox>
<checkBox refId="PCH_AllOrNoneWinComp_Chk" defaultChecked="true">Report all errors in Windows components.</checkBox>
</presentation>
<presentation id="PCH_AllOrNoneEx">
<listBox refId="PCH_AllOrNoneEx_List">Exclude errors for applications on this list:</listBox>
</presentation>
<presentation id="PCH_AllOrNoneInc">
<listBox refId="PCH_AllOrNoneInc_List">Report errors for applications on this list:</listBox>
</presentation>
<presentation id="PCH_ConfigureReport">
<checkBox refId="PCH_NoExternalURL_Chk">Do not display links to any Microsoft provided 'more information' web sites.</checkBox>
<checkBox refId="PCH_NoFileCollect_Chk">Do not collect additional files</checkBox>
<checkBox refId="PCH_NoLevelTwo_Chk">Do not collect additional machine data</checkBox>
<checkBox refId="PCH_ForceQ_Chk">Force queue mode for application errors</checkBox>
<textBox refId="PCH_DumpPath_Edit">
<label>Corporate upload file path:</label>
</textBox>
<textBox refId="PCH_CompanyText_Edit">
<label>Replace instances of the word 'Microsoft' with:</label>
</textBox>
</presentation>
<presentation id="WerArchive_1">
<dropdownList refId="WerArchiveBehavior" noSort="true">Archive behavior:</dropdownList>
<decimalTextBox refId="WerMaxArchiveCount" defaultValue="500" spinStep="50">Maximum number of reports to store:</decimalTextBox>
</presentation>
<presentation id="WerArchive_2">
<dropdownList refId="WerArchiveBehavior" noSort="true">Archive behavior:</dropdownList>
<decimalTextBox refId="WerMaxArchiveCount" defaultValue="500" spinStep="50">Maximum number of reports to store:</decimalTextBox>
</presentation>
<presentation id="WerCER">
<textBox refId="WerCERServer">
<label>Corporate server name:</label>
</textBox>
<checkBox refId="WerCERUseSSL">Connect using SSL</checkBox>
<checkBox refId="WerCerUploadOnFreeNetworksOnly">Only upload on free networks</checkBox>
<decimalTextBox refId="WerCERCorporatePortNumber" defaultValue="1273" spin="false">Server port:</decimalTextBox>
</presentation>
<presentation id="WerConsentCustomize_1">
<listBox refId="WerConsentCustomize">Customize consent settings</listBox>
</presentation>
<presentation id="WerConsentCustomize_2">
<listBox refId="WerConsentCustomize">Customize consent settings</listBox>
</presentation>
<presentation id="WerDefaultConsent_1">
<dropdownList refId="WerConsent" noSort="true">Consent level</dropdownList>
</presentation>
<presentation id="WerDefaultConsent_2">
<dropdownList refId="WerConsent" noSort="true">Consent level</dropdownList>
</presentation>
<presentation id="WerExlusion_1">
<listBox refId="WerExlusionList">List of applications to be excluded</listBox>
</presentation>
<presentation id="WerExlusion_2">
<listBox refId="WerExlusionList">List of applications to be excluded</listBox>
</presentation>
<presentation id="WerQueue_1">
<dropdownList refId="WerQueueBehavior" noSort="true">Queuing behavior:</dropdownList>
<decimalTextBox refId="WerMaxQueueCount" defaultValue="50" spinStep="10">Maximum number of reports to queue:</decimalTextBox>
<decimalTextBox refId="WerMaxQueueSize" defaultValue="1024" spinStep="50">Maximum size of the queue (MB):</decimalTextBox>
<decimalTextBox refId="WerUpdateCheck" defaultValue="14">Number of days between solution check reminders:</decimalTextBox>
</presentation>
<presentation id="WerQueue_2">
<dropdownList refId="WerQueueBehavior" noSort="true">Queuing behavior:</dropdownList>
<decimalTextBox refId="WerMaxQueueCount" defaultValue="50" spinStep="10">Maximum number of reports to queue:</decimalTextBox>
<decimalTextBox refId="WerMaxQueueSize" defaultValue="1024" spinStep="50">Maximum size of the queue (MB):</decimalTextBox>
<decimalTextBox refId="WerMinFreeDiskSpace" defaultValue="2800" spinStep="100">Minimum free disk space (MB):</decimalTextBox>
<decimalTextBox refId="WerUpdateCheck" defaultValue="14">Number of days between solution check reminders:</decimalTextBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/EventForwarding.adml
+55
View File
@@ -0,0 +1,55 @@
<?xml version="1.0"?>
<policyDefinitionResources revision="1.0" schemaVersion="1.0">
<displayName>Event Forwarding</displayName>
<description>Policy Definitions For Event Forwarding</description>
<resources>
<stringTable>
<string id="EventForwarding">Event Forwarding</string>
<string id="ForwarderResourceUsage">Configure forwarder resource usage</string>
<string id="ForwarderResourceUsage_Help">This policy setting controls resource usage for the forwarder (source computer) by controlling the events/per second sent to the Event Collector.
If you enable this policy setting, you can control the volume of events sent to the Event Collector by the source computer. This may be required in high volume environments.
If you disable or do not configure this policy setting, forwarder resource usage is not specified.
This setting applies across all subscriptions for the forwarder (source computer).</string>
<string id="SubscriptionManager">Configure target Subscription Manager</string>
<string id="Subscription_Help">This policy setting allows you to configure the server address, refresh interval, and issuer certificate authority (CA) of a target Subscription Manager.
If you enable this policy setting, you can configure the Source Computer to contact a specific FQDN (Fully Qualified Domain Name) or IP Address and request subscription specifics.
Use the following syntax when using the HTTPS protocol:
Server=https://&lt;FQDN of the collector&gt;:5986/wsman/SubscriptionManager/WEC,Refresh=&lt;Refresh interval in seconds&gt;,IssuerCA=&lt;Thumb print of the client authentication certificate&gt;. When using the HTTP protocol, use port 5985.
If you disable or do not configure this policy setting, the Event Collector computer will not be specified.</string>
<string id="SubscriptionManager_Listbox">SubscriptionManagers</string>
</stringTable>
<presentationTable>
<presentation id="SubscriptionManager">
<listBox refId="SubscriptionManager_Listbox">SubscriptionManagers</listBox>
</presentation>
<presentation id="ForwarderResourceUsage">
<decimalTextBox refId="MaxForwardingRate" spinStep="100">The maximum forwarding rate ( events/sec ) allowed for the forwarder: </decimalTextBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/EventLog.adml
+173
View File
@@ -0,0 +1,173 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="Channel_Log_AutoBackup">Back up log automatically when full</string>
<string id="Channel_Log_AutoBackup_Help">This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled.
If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started.
If you disable this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and old events are retained.
If you do not configure this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and the old events are retained.</string>
<string id="Channel_Log_FileLogAccess">Configure log access</string>
<string id="Channel_Log_FileLogAccess_Legacy">Configure log access (legacy)</string>
<string id="Channel_Log_FileLogAccessApplication_Help">This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string.
If you enable this policy setting, only those users matching the security descriptor can access the log.
If you disable or do not configure this policy setting, all authenticated users and system services can write, read, or clear this log.
Note: If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the "Configure log access (legacy)" policy setting to enforce this change across all tools and APIs.</string>
<string id="Channel_Log_FileLogAccessApplication_Help_Legacy">This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You must set both "configure log access" policy settings for this log in order to affect the both modern and legacy tools.
If you enable this policy setting, only those users matching the security descriptor can access the log.
If you disable this policy setting, all authenticated users and system services can write, read, or clear this log.
If you do not configure this policy setting, the previous policy setting configuration remains in effect.</string>
<string id="Channel_Log_FileLogAccessSecurity_Help">This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You cannot configure write permissions for this log. You must set both "configure log access" policy settings for this log in order to affect the both modern and legacy tools.
If you enable this policy setting, only those users whose security descriptor matches the configured specified value can access the log.
If you disable or do not configure this policy setting, only system software and administrators can read or clear this log.
Note: If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the "Configure log access (legacy)" policy setting to enforce this change across all tools and APIs.</string>
<string id="Channel_Log_FileLogAccessSecurity_Help_Legacy">This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You cannot configure write permissions for this log.
If you enable this policy setting, only those users whose security descriptor matches the configured specified value can access the log.
If you disable this policy setting, only system software and administrators can read or clear this log.
If you do not configure this policy setting, the previous policy setting configuration remains in effect.</string>
<string id="Channel_Log_FileLogAccessSystem_Help">This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You must set both "configure log access" policy settings for this log in order to affect the both modern and legacy tools.
If you enable this policy setting, only users whose security descriptor matches the configured value can access the log.
If you disable or do not configure this policy setting, only system software and administrators can write or clear this log, and any authenticated user can read events from it.
Note: If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the "Configure log access (legacy)" policy setting to enforce this change across all tools and APIs.</string>
<string id="Channel_Log_FileLogAccessSystem_Help_Legacy">This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string.
If you enable this policy setting, only users whose security descriptor matches the configured value can access the log.
If you disable this policy setting, only system software and administrators can write or clear this log, and any authenticated user can read events from it.
If you do not configure this policy setting, the previous policy setting configuration remains in effect.</string>
<string id="Channel_Log_Retention">Control Event Log behavior when the log file reaches its maximum size</string>
<string id="Channel_Log_Retention_Help">This policy setting controls Event Log behavior when the log file reaches its maximum size.
If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost.
If you disable or do not configure this policy setting and a log file reaches its maximum size, new events overwrite old events.
Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting.</string>
<string id="Channel_LogEnabled">Turn on logging</string>
<string id="Channel_LogEnabled_Help">This policy setting turns on logging.
If you enable or do not configure this policy setting, then events can be written to this log.
If the policy setting is disabled, then no new events can be logged. Events can always be read from the log, regardless of this policy setting.</string>
<string id="Channel_LogFilePath">Control the location of the log file</string>
<string id="Channel_LogFilePath_Help">This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators.
If you enable this policy setting, the Event Log uses the path specified in this policy setting.
If you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\System32\winevt\Logs.</string>
<string id="Channel_LogMaxSize">Specify the maximum log file size (KB)</string>
<string id="Channel_LogMaxSize_Help">This policy setting specifies the maximum size of the log file in kilobytes.
If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes), in kilobyte increments.
If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 1 megabyte.</string>
<string id="Channel_LogMaxSizeSecurity_Help">This policy setting specifies the maximum size of the log file in kilobytes.
If you enable this policy setting, you can configure the maximum log file size to be between 20 megabytes (20480 kilobytes) and 2 terabytes (2147483647 kilobytes), in kilobyte increments.
If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 20 megabytes.</string>
<string id="ChannelName_Help">Configuration Settings for log</string>
<string id="EventLog_Application">Application</string>
<string id="EventLog_Security">Security</string>
<string id="EventLog_Setup">Setup</string>
<string id="EventLog_System">System</string>
<string id="EventLogCategory">Event Log Service</string>
</stringTable>
<presentationTable>
<presentation id="Channel_Log_FileLogAccess_1">
<textBox refId="Channel_Log_FileLogAccess">
<label>Log Access</label>
</textBox>
</presentation>
<presentation id="Channel_Log_FileLogAccess_2">
<textBox refId="Channel_Log_FileLogAccess">
<label>Log Access</label>
</textBox>
</presentation>
<presentation id="Channel_Log_FileLogAccess_3">
<textBox refId="Channel_Log_FileLogAccess">
<label>Log Access</label>
</textBox>
</presentation>
<presentation id="Channel_Log_FileLogAccess_4">
<textBox refId="Channel_Log_FileLogAccess">
<label>Log Access</label>
</textBox>
</presentation>
<presentation id="Channel_Log_FileLogAccess_5">
<textBox refId="Channel_Log_FileLogAccess">
<label>Log Access</label>
</textBox>
</presentation>
<presentation id="Channel_Log_FileLogAccess_6">
<textBox refId="Channel_Log_FileLogAccess">
<label>Log Access</label>
</textBox>
</presentation>
<presentation id="Channel_Log_FileLogAccess_7">
<textBox refId="Channel_Log_FileLogAccess">
<label>Log Access</label>
</textBox>
</presentation>
<presentation id="Channel_Log_FileLogAccess_8">
<textBox refId="Channel_Log_FileLogAccess">
<label>Log Access</label>
</textBox>
</presentation>
<presentation id="Channel_LogFilePath_1">
<textBox refId="Channel_LogFilePath">
<label>Log File Path</label>
</textBox>
</presentation>
<presentation id="Channel_LogFilePath_2">
<textBox refId="Channel_LogFilePath">
<label>Log File Path</label>
</textBox>
</presentation>
<presentation id="Channel_LogFilePath_3">
<textBox refId="Channel_LogFilePath">
<label>Log File Path</label>
</textBox>
</presentation>
<presentation id="Channel_LogFilePath_4">
<textBox refId="Channel_LogFilePath">
<label>Log File Path</label>
</textBox>
</presentation>
<presentation id="Channel_LogMaxSize_1">
<decimalTextBox refId="Channel_LogMaxSize" defaultValue="1024">Maximum Log Size (KB)</decimalTextBox>
</presentation>
<presentation id="Channel_LogMaxSize_2">
<decimalTextBox refId="Channel_LogMaxSize" defaultValue="20480">Maximum Log Size (KB)</decimalTextBox>
</presentation>
<presentation id="Channel_LogMaxSize_3">
<decimalTextBox refId="Channel_LogMaxSize" defaultValue="1024">Maximum Log Size (KB)</decimalTextBox>
</presentation>
<presentation id="Channel_LogMaxSize_4">
<decimalTextBox refId="Channel_LogMaxSize" defaultValue="1024">Maximum Log Size (KB)</decimalTextBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/EventLogging.adml
+34
View File
@@ -0,0 +1,34 @@
<?xml version="1.0" encoding="utf-8"?>
<policyDefinitionResources xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/PolicyDefinitions">
<displayName>Event Logging</displayName>
<description>This file contains the configuration options for Windows Event Logging</description>
<resources>
<stringTable>
<string id="EventLogging">Event Logging</string>
<string id="EnableProtectedEventLogging">Enable Protected Event Logging</string>
<string id="EnableProtectedEventLogging_Explain">
This policy setting lets you configure Protected Event Logging.
If you enable this policy setting, components that support it will use the certificate you supply to encrypt potentially sensitive event log data before writing it to the event log. Data will be encrypted using the Cryptographic Message Syntax (CMS) standard and the public key you provide. You can use the Unprotect-CmsMessage PowerShell cmdlet to decrypt these encrypted messages, provided that you have access to the private key corresponding to the public key that they were encrypted with.
If you disable or do not configure this policy setting, components will not encrypt event log messages before writing them to the event log.
</string>
</stringTable>
<presentationTable>
<presentation id="EnableProtectedEventLogging">
<text>
Provide an encryption certificate to be used by Protected Event Logging. You may provide either:
- The content of a base-64 encoded X.509 certificate
- The thumbprint of a certificate that can be found in the Local Machine certificate store (usually deployed by PKI infrastructure)
- The full path to a certificate (can be local, or a remote share)
- The path to a directory containing a certificate or certificates (can be local, or a remote share)
- The subject name of a certificate that can be found in the Local Machine certificate store (usually deployed by PKI infrastructure)
The resulting certificate must have 'Document Encryption' as an enhanced key usage (1.3.6.1.4.1.311.80.1), as well as either Data Encipherment or Key Encipherment key usages enabled.
</text>
<multiTextBox refId="EncryptionCertificate"></multiTextBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/EventViewer.adml
+37
View File
@@ -0,0 +1,37 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="EventViewer">Event Viewer</string>
<string id="EventViewer_RedirectionProgram">Events.asp program</string>
<string id="EventViewer_RedirectionProgram_Help">This is the program that will be invoked when the user clicks the events.asp link.</string>
<string id="EventViewer_RedirectionProgramCommandLineParameters">Events.asp program command line parameters</string>
<string id="EventViewer_RedirectionProgramCommandLineParameters_Help">This specifies the command line parameters that will be passed to the events.asp program</string>
<string id="EventViewer_RedirectionURL">Events.asp URL</string>
<string id="EventViewer_RedirectionURL_Help">This is the URL that will be passed to the Description area in the Event Properties dialog box. Change this value if you want to use a different Web server to handle event information requests.</string>
</stringTable>
<presentationTable>
<presentation id="EventViewer_RedirectionProgram">
<textBox refId="EventViewer_RedirectionProgram">
<label>Events.asp program</label>
<defaultValue>%SystemRoot%\PCHealth\HelpCtr\Binaries\HelpCtr.exe</defaultValue>
</textBox>
</presentation>
<presentation id="EventViewer_RedirectionProgramCommandLineParameters">
<textBox refId="EventViewer_RedirectionProgramCommandLineParameters">
<label>Events.asp program command line parameters</label>
<defaultValue>-url hcp://services/centers/support?topic=%s</defaultValue>
</textBox>
</presentation>
<presentation id="EventViewer_RedirectionURL">
<textBox refId="EventViewer_RedirectionURL">
<label>Events.asp URL</label>
<defaultValue></defaultValue>
</textBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/ExploitGuard.adml
+43
View File
@@ -0,0 +1,43 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="WindowsDefenderExploitGuard">Microsoft Defender Exploit Guard</string>
<string id="ExploitProtection">Exploit Protection</string>
<string id="ExploitProtection_Name">Use a common set of exploit protection settings</string>
<string id="ExploitProtection_Help">Specify a common set of Microsoft Defender Exploit Guard system and application mitigation settings that can be applied to all endpoints that have this GP setting configured.
There are some prerequisites before you can enable this setting:
- Manually configure a device's system and application mitigation settings using the Set-ProcessMitigation PowerShell cmdlet, the ConvertTo-ProcessMitigationPolicy PowerShell cmdlet, or directly in Windows Security.
- Generate an XML file with the settings from the device by running the Get-ProcessMitigation PowerShell cmdlet or using the Export button at the bottom of the Exploit Protection area in Windows Security.
- Place the generated XML file in a shared or local path.
Note: Endpoints that have this GP setting set to Enabled must be able to access the XML file, otherwise the settings will not be applied.
Enabled
Specify the location of the XML file in the Options section. You can use a local (or mapped) path, a UNC path, or a URL, such as the following:
- C:\MitigationSettings\Config.XML
- \\Server\Share\Config.xml
- https://localhost:8080/Config.xml
The settings in the XML file will be applied to the endpoint.
Disabled
Common settings will not be applied, and the locally configured settings will be used instead.
Not configured
Same as Disabled.
</string>
</stringTable>
<presentationTable>
<presentation id="ExploitProtection_Name">
<textBox refId="ExploitProtection_Name">
<label>Type the location (local path, UNC path, or URL) of the mitigation settings configuration XML file:</label>
</textBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/Explorer.adml
+52
View File
@@ -0,0 +1,52 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="AlwaysShowClassicMenu">Display the menu bar in File Explorer </string>
<string id="AlwaysShowClassicMenu_Help">This policy setting configures File Explorer to always display the menu bar.
Note: By default, the menu bar is not displayed in File Explorer.
If you enable this policy setting, the menu bar will be displayed in File Explorer.
If you disable or do not configure this policy setting, the menu bar will not be displayed in File Explorer.
Note: When the menu bar is not displayed, users can access the menu bar by pressing the 'ALT' key.</string>
<string id="PreventItemCreationInUsersFilesFolder">Prevent users from adding files to the root of their Users Files folder.</string>
<string id="PreventItemCreationInUsersFilesFolder_Help">This policy setting allows administrators to prevent users from adding new items such as files or folders to the root of their Users Files folder in File Explorer.
If you enable this policy setting, users will no longer be able to add new items such as files or folders to the root of their Users Files folder in File Explorer.
If you disable or do not configure this policy setting, users will be able to add new items such as files or folders to the root of their Users Files folder in File Explorer.
Note: Enabling this policy setting does not prevent the user from being able to add new items such as files and folders to their actual file system profile folder at %userprofile%.</string>
<string id="TurnOffSPIAnimations">Turn off common control and window animations</string>
<string id="TurnOffSPIAnimations_Help">This policy is similar to settings directly available to computer users. Disabling animations can improve usability for users with some visual disabilities as well as improving performance and battery life in some scenarios.</string>
<string id="NoDataExecutionPrevention">Turn off Data Execution Prevention for Explorer</string>
<string id="NoDataExecutionPrevention_Help">Disabling data execution prevention can allow certain legacy plug-in applications to function without terminating Explorer.</string>
<string id="NoHeapTerminationOnCorruption">Turn off heap termination on corruption</string>
<string id="NoHeapTerminationOnCorruption_Help">Disabling heap termination on corruption can allow certain legacy plug-in applications to function without terminating Explorer immediately, although Explorer may still terminate unexpectedly later.</string>
<string id="AdminInfoUrl">Set a support web page link</string>
<string id="AdminInfoUrl_Help">Sets the target of the More Information link that will be displayed when the user attempts to run a program that is blocked by policy.</string>
<string id="AdminInfoUrl_TextBox">Information URL</string>
<string id="DisableRoamedProfileInit">Do not reinitialize a pre-existing roamed user profile when it is loaded on a machine for the first time</string>
<string id="DisableRoamedProfileInit_Help">This policy setting allows administrators who have configured roaming profile in conjunction with Delete Cached Roaming Profile Group Policy setting to ensure that Explorer will not reinitialize default program associations and other settings to default values.
If you enable this policy setting on a machine that does not contain all programs installed in the same manner as it was on the machine on which the user had last logged on, unexpected behavior could occur. </string>
<string id="DisableGraphRecentItems">Turn off files from Office.com in Quick access view</string>
<string id="DisableGraphRecentItems_Help">Turning off files from Office.com will prevent File Explorer from requesting recent cloud file metadata and displaying it in the Quick access view.</string>
</stringTable>
<presentationTable>
<presentation id="AdminInfoUrl">
<textBox refId="AdminInfoUrl_TextBox">
<label>Support Web page URL</label>
<defaultValue>http://msdn.microsoft.com</defaultValue>
</textBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/ExternalBoot.adml
+37
View File
@@ -0,0 +1,37 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Portable Workspace</displayName>
<description>This file contains Portable Workspace policy settings.</description>
<resources>
<stringTable>
<string id="PortableOperatingSystem">Portable Operating System</string>
<string id="PortableOperatingSystem_Launcher_DisplayName">Windows To Go Default Startup Options</string>
<string id="PortableOperatingSystem_Launcher_Help">
This policy setting controls whether the PC will boot to Windows To Go if a USB device containing a Windows To Go workspace is connected, and controls whether users can make changes using the Windows To Go Startup Options Control Panel item.
If you enable this setting, booting to Windows To Go when a USB device is connected will be enabled, and users will not be able to make changes using the Windows To Go Startup Options Control Panel item.
If you disable this setting, booting to Windows To Go when a USB device is connected will not be enabled unless a user configures the option manually in the BIOS or other boot order configuration.
If you do not configure this setting, users who are members of the Administrators group can make changes using the Windows To Go Startup Options Control Panel item.</string>
<string id="PortableOperatingSystem_Hibernate_DisplayName">Allow hibernate (S4) when starting from a Windows To Go workspace</string>
<string id="PortableOperatingSystem_Hibernate_Help">
Specifies whether the PC can use the hibernation sleep state (S4) when started from a Windows To Go workspace.
If you enable this setting, Windows, when started from a Windows To Go workspace, can hibernate the PC.
If you disable or don't configure this setting, Windows, when started from a Windows To Go workspace, can't hibernate the PC.</string>
<string id="PortableOperatingSystem_Sleep_DisplayName">Disallow standby sleep states (S1-S3) when starting from a Windows to Go workspace</string>
<string id="PortableOperatingSystem_Sleep_Help">
Specifies whether the PC can use standby sleep states (S1-S3) when starting from a Windows To Go workspace.
If you enable this setting, Windows, when started from a Windows To Go workspace, can't use standby states to make the PC sleep.
If you disable or don't configure this setting, Windows, when started from a Windows To Go workspace, can use standby states to make the PC sleep.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/FeedbackNotifications.adml
+18
View File
@@ -0,0 +1,18 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2015 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="DoNotShowFeedbackNotifications">Do not show feedback notifications</string>
<string id="DoNotShowFeedbackNotifications_Explain">This policy setting allows an organization to prevent its devices from showing feedback questions from Microsoft.
If you enable this policy setting, users will no longer see feedback notifications through the Windows Feedback app.
If you disable or do not configure this policy setting, users may see notifications through the Windows Feedback app asking users for feedback.
Note: If you disable or do not configure this policy setting, users can control how often they receive feedback questions.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/FileHistory.adml
+17
View File
@@ -0,0 +1,17 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>File History</displayName>
<description>File History</description>
<resources>
<stringTable>
<string id="FileHistoryName">File History</string>
<string id="DisableFileHistory">Turn off File History</string>
<string id="DisableFileHistory_explanation">This policy setting allows you to turn off File History.
If you enable this policy setting, File History cannot be activated to create regular, automatic backups.
If you disable or do not configure this policy setting, File History can be activated to create regular, automatic backups.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/FileRecovery.adml
+37
View File
@@ -0,0 +1,37 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="WdiScenarioCategory">Corrupted File Recovery</string>
<string id="WdiScenarioExecutionPolicy">Configure Corrupted File Recovery behavior</string>
<string id="WdiScenarioExecutionPolicyExplain">This policy setting allows you to configure the recovery behavior for corrupted files to one of three states:
Regular: Detection, troubleshooting, and recovery of corrupted files will automatically start with a minimal UI display. Windows will attempt to present you with a dialog box when a system restart is required. This is the default recovery behavior for corrupted files.
Silent: Detection, troubleshooting, and recovery of corrupted files will automatically start with no UI. Windows will log an administrator event when a system restart is required. This behavior is recommended for headless operation.
Troubleshooting Only: Detection and troubleshooting of corrupted files will automatically start with no UI. Recovery is not attempted automatically. Windows will log an administrator event with instructions if manual recovery is possible.
If you enable this setting, the recovery behavior for corrupted files will be set to either the regular (default), silent, or troubleshooting only state.
If you disable this setting, the recovery behavior for corrupted files will be disabled. No troubleshooting or resolution will be attempted.
If you do not configure this setting, the recovery behavior for corrupted files will be set to the regular recovery behavior.
No system or service restarts are required for changes to this policy to take immediate effect after a Group Policy refresh.
Note: This policy setting will take effect only when the Diagnostic Policy Service (DPS) is in the running state. When the service is stopped or disabled, system file recovery will not be attempted. The DPS can be configured with the Services snap-in to the Microsoft Management Console.</string>
<string id="WdiScenarioExecutionPolicyLevelResolution">Regular</string>
<string id="WdiScenarioExecutionPolicyLevelSilent">Silent</string>
<string id="WdiScenarioExecutionPolicyLevelTsOnly">Troubleshooting Only</string>
</stringTable>
<presentationTable>
<presentation id="WdiScenarioExecutionPolicy">
<dropdownList refId="WdiScenarioExecutionPolicyLevel" noSort="true" defaultItem="1">Scenario Execution Level</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/FileRevocation.adml
+29
View File
@@ -0,0 +1,29 @@
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<!-- (c) Microsoft Corporation -->
<policyDefinitionResources xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0">
<!-- Documentation says these are optional, but GPEdit does not agree-->
<displayName>File Revocation Policy Settings</displayName>
<description>File Revocation Policy Settings</description>
<resources>
<stringTable>
<string id="FileRevocationCategory">File Revocation</string>
<string id="DelegatedPackageFamilyNames_Name">Allow Windows Runtime apps to revoke enterprise data</string>
<string id="DelegatedPackageFamilyNames_Help">Windows Runtime applications can protect content which has been associated with an enterprise identifier (EID), but can only revoke access to content it protected. To allow an application to revoke access to all content on the device that is protected by a particular enterprise, add an entry to the list on a new line that contains the enterprise identifier, separated by a comma, and the Package Family Name of the application. The EID must be an internet domain belonging to the enterprise in standard international domain name format.
Example value:
Contoso.com,ContosoIT.HumanResourcesApp_m5g0r7arhahqy
If you enable this policy setting, the application identified by the Package Family Name will be permitted to revoke access to all content protected using the specified EID on the device.
If you disable or do not configure this policy setting, the only Windows Runtime applications that can revoke access to all enterprise-protected content on the device are Windows Mail and the user-selected mailto protocol handler app. Any other Windows Runtime application will only be able to revoke access to content it protected.
Note: File revocation applies to all content protected under the same second level domain as the provided enterprise identifier. So, revoking an enterprise ID of mail.contoso.com will revoke the user’s access to all content protected under the contoso.com hierarchy.</string>
</stringTable>
<presentationTable>
<presentation id="DelegatedPackageFamilyNames">
<text>Apps permitted to revoke all protected data from the device for the specified enterprise identifier:</text>
<multiTextBox refId="DelegatedPackageFamilyNames_EIDs"/>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/FileServerVSSProvider.adml
+23
View File
@@ -0,0 +1,23 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.2" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<!-- Component name -->
<string id="Cat_FileShareShadowCopyProvider">File Share Shadow Copy Provider</string>
<!-- Component name -->
<string id="Pol_EncryptProtocol">Allow or Disallow use of encryption to protect the RPC protocol messages between File Share Shadow Copy Provider running on application server and File Share Shadow Copy Agent running on the file servers.</string>
<string id="Pol_EncryptProtocol_Help">Determines whether the RPC protocol messagese used by VSS for SMB2 File Shares feature is enabled.
VSS for SMB2 File Shares feature enables VSS aware backup applications to perform application consistent backup and restore of VSS aware applications storing data on SMB2 File Shares.
By default, the RPC protocol message between File Server VSS provider and File Server VSS Agent is signed but not encrypted.
Note: To make changes to this setting effective, you must restart Volume Shadow Copy (VSS) Service .</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/FileSys.adml
+120
View File
@@ -0,0 +1,120 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="Filesystem">Filesystem</string>
<string id="NTFS">NTFS</string>
<string id="SymlinkEvalExplain">Symbolic links can introduce vulnerabilities in certain applications. To mitigate this issue, you can selectively enable or disable the evaluation of these types of symbolic links:
Local Link to a Local Target
Local Link to a Remote Target
Remote Link to Remote Target
Remote Link to Local Target
For further information please refer to the Windows Help section
NOTE: If this policy is Disabled or Not Configured, local administrators may select the types of symbolic links to be evaluated.</string>
<string id="SymlinkEvaluation">Selectively allow the evaluation of a symbolic link</string>
<string id="DisableCompression">Do not allow compression on all NTFS volumes</string>
<string id="DisableCompressionText">Compression can add to the processing overhead of filesystem operations. Enabling this setting will prevent access to and creation of compressed files.
A reboot is required for this setting to take effect</string>
<string id="DisableEncryption">Do not allow encryption on all NTFS volumes</string>
<string id="DisableEncryptionText">Encryption can add to the processing overhead of filesystem operations. Enabling this setting will prevent access to and creation of encrypted files.
A reboot is required for this setting to take effect</string>
<string id="EnablePagefileEncryption">Enable NTFS pagefile encryption</string>
<string id="EnablePagefileEncryptionText">Encrypting the page file prevents malicious users from reading data that has been paged to disk, but also adds processing overhead for filesystem operations. Enabling this setting will cause the page files to be encrypted.</string>
<string id="LongPathsEnabled">Enable Win32 long paths</string>
<string id="LongPathsEnabledText">Enabling Win32 long paths will allow manifested win32 applications and Windows Store applications to access paths beyond the normal 260 character limit. Enabling this setting will cause the long paths to be accessible within the process.</string>
<string id="ShortNameCreationSettings">Short name creation options</string>
<string id="ShortNameCreationSettingsText">These settings provide control over whether or not short names are generated during file creation. Some applications require short names for compatibility, but short names have a negative performance impact on the system.
If you enable short names on all volumes then short names will always be generated. If you disable them on all volumes then they will never be generated. If you set short name creation to be configurable on a per volume basis then an on-disk flag will determine whether or not short names are created on a given volume. If you disable short name creation on all data volumes then short names will only be generated for files created on the system volume.</string>
<string id="ShortNameCreationSetting_0">Enable on all volumes</string>
<string id="ShortNameCreationSetting_1">Disable on all volumes</string>
<string id="ShortNameCreationSetting_2">Enable / disable on a per volume basis</string>
<string id="ShortNameCreationSetting_3">Disable on all data volumes</string>
<string id="DisableDeleteNotification">Disable delete notifications on all volumes</string>
<string id="DisableDeleteNotificationText">Delete notification is a feature that notifies the underlying storage device of clusters that are freed due to a file delete operation.
A value of 0, the default, will enable delete notifications for all volumes.
A value of 1 will disable delete notifications for all volumes.</string>
<string id="TxfDeprecatedFunctionality">Enable / disable TXF deprecated features</string>
<string id="TxfDeprecatedFunctionalityText">TXF deprecated features included savepoints, secondary RM, miniversion and roll forward. Please enable it if you want to use these APIs.</string>
<string id="NtfsForceNonPagedPoolAllocation">Enable NTFS non-paged pool usage</string>
<string id="NtfsForceNonPagedPoolAllocationExplain">By default NTFS allocates memory from both pageable and non-pageable memory as needed. Enabling this setting tells NTFS to use non-pageable memory for all allocations. NTFS also changes all of its code sections to be non-pageable.
The benefit of enabling this feature is a reduction in page-faults and stack usage at the cost of additional memory consumption.
A reboot is required for this setting to take effect</string>
<string id="NtfsParallelFlushThreshold">NTFS parallel flush threshold</string>
<string id="NtfsParallelFlushThresholdExplain">When flushing modified file data from memory, NTFS chooses to use one or more threads based on how many files are currently open. This setting gives control over the open file threshold used to trigger parallel flush.</string>
<string id="NtfsParallelFlushWorkers">NTFS parallel flush worker threads</string>
<string id="NtfsParallelFlushWorkersExplain">When flushing modified file data from memory, NTFS chooses to use one or more threads based on how many files are currently open. This setting gives control over how many threads will be used.
Making this value larger may decrease the time it takes to flush a volume but the flush may have a larger impact on other concurrent IO operations.
Values with special meaning:
0: Use the system calculated default
1: Disable parallel flush
The default value and limit for this setting varies based on the number of available processors on a given system:
- Default value calculation is: (([NumProcessors]/2) + 1)
- Default max value calculation is: ([NumProcessors]*2)</string>
<string id="NtfsDefaultTier">NTFS default tier</string>
<string id="NtfsDefaultTierExplain">For NTFS tiered volumes this controls the tier that new allocations go to by default.
Client systems default to the Performance tier.
Server systems default to the Capacity tier.</string>
<string id="DefaultTierSetting_1">Capacity tier</string>
<string id="DefaultTierSetting_2">Performance tier</string>
</stringTable>
<presentationTable>
<presentation id="SymlinkEvaluation">
<checkBox refId="SymLinkClassL2L">Local Link to Local Target</checkBox>
<checkBox refId="SymLinkClassL2R">Local Link to a Remote Target</checkBox>
<checkBox refId="SymLinkClassR2R">Remote Link to Remote Target</checkBox>
<checkBox refId="SymLinkClassR2L">Remote Link to Local Target</checkBox>
</presentation>
<presentation id="CompressionOptions"/>
<presentation id="EncryptionOptions"/>
<presentation id="LongPathsEnabledOptions"/>
<presentation id="PagefileEncryptionOptions"/>
<presentation id="ShortNameCreationSettings">
<dropdownList refId="ShortNameCreationSetting_Levels" noSort="true" defaultItem="2">Short name creation options</dropdownList>
</presentation>
<presentation id="DeleteNotificationOptions"/>
<presentation id="TxfDeprecatedFunctionalityOptions"/>
<presentation id="NtfsForceNonPagedPoolAllocationOptions"/>
<presentation id="NtfsParallelFlushThresholdOptions">
<decimalTextBox refId="NtfsParallelFlushThresholdID" defaultValue="1000">Open File Threshold:</decimalTextBox>
</presentation>
<presentation id="NtfsParallelFlushWorkersOptions">
<decimalTextBox refId="NtfsParallelFlushWorkersID" defaultValue="5">Open File Threshold:</decimalTextBox>
</presentation>
<presentation id="NtfsDefaultTierOptions">
<dropdownList refId="NtfsDefaultTier_Levels" noSort="true" defaultItem="1">NTFS default tier options</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/FindMy.adml
+18
View File
@@ -0,0 +1,18 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Find My Device</displayName>
<description>Configuration for FindMyDevice</description>
<resources>
<stringTable>
<string id="FindMyDeviceCat_DisplayName">Find My Device</string>
<string id="FindMyDevice_AllowFindMyDevice_DisplayName">Turn On/Off Find My Device</string>
<string id="FindMyDevice_AllowFindMyDevice_Explain">This policy turns on Find My Device.
When Find My Device is on, the device and its location are registered in the cloud so that the device can be located when the user initiates a Find command from account.microsoft.com. On devices that are compatible with active digitizers, enabling Find My Device will also allow the user to view the last location of use of their active digitizer on their device; this location is stored locally on the user's device after each use of their active digitizer.
When Find My Device is off, the device and its location are not registered and the Find My Device feature will not work.The user will also not be able to view the location of the last use of their active digitizer on their device.
</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/FolderRedirection.adml
+80
View File
@@ -0,0 +1,80 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="Fdeploy_Cat">Folder Redirection</string>
<string id="LocalizeXPRelativePaths">Use localized subfolder names when redirecting Start Menu and My Documents</string>
<string id="LocalizeXPRelativePaths_Help">This policy setting allows the administrator to define whether Folder Redirection should use localized names for the All Programs, Startup, My Music, My Pictures, and My Videos subfolders when redirecting the parent Start Menu and legacy My Documents folder respectively.
If you enable this policy setting, Windows Vista, Windows 7, Windows 8, and Windows Server 2012 will use localized folder names for these subfolders when redirecting the Start Menu or legacy My Documents folder.
If you disable or not configure this policy setting, Windows Vista, Windows 7, Windows 8, and Windows Server 2012 will use the standard English names for these subfolders when redirecting the Start Menu or legacy My Documents folder.
Note: This policy is valid only on Windows Vista, Windows 7, Windows 8, and Windows Server 2012 when it processes a legacy redirection policy already deployed for these folders in your existing localized environment.</string>
<string id="DisableFRAdminPinByFolder">Do not automatically make specific redirected folders available offline</string>
<string id="DisableFRAdminPinByFolder_Help">This policy setting allows you to control whether individual redirected shell folders are available offline by default.
For the folders affected by this setting, users must manually select the files they wish to make available offline.
If you disable or do not configure this policy setting, all redirected shell folders are automatically made available offline. All subfolders within the redirected folders are also made available offline.
Note: This policy setting does not prevent files from being automatically cached if the network share is configured for "Automatic Caching", nor does it affect the availability of the "Always available offline" menu option in the user interface.
Note: The configuration of this policy for any folder will override the configured value of "Do not automatically make all redirected folders available offline".</string>
<string id="DisableFRAdminPin">Do not automatically make all redirected folders available offline</string>
<string id="DisableFRAdminPin_Help">This policy setting allows you to control whether all redirected shell folders, such as Contacts, Documents, Desktop, Favorites, Music, Pictures, Videos, Start Menu, and AppData\Roaming, are available offline by default.
If you enable this policy setting, users must manually select the files they wish to make available offline.
If you disable or do not configure this policy setting, redirected shell folders are automatically made available offline. All subfolders within the redirected folders are also made available offline.
Note: This policy setting does not prevent files from being automatically cached if the network share is configured for "Automatic Caching", nor does it affect the availability of the "Always available offline" menu option in the user interface.
Note: Do not enable this policy setting if users will need access to their redirected files if the network or server holding the redirected files becomes unavailable.
Note: If one or more valid folder GUIDs are specified in the policy setting "Do not automatically make specific redirected folders available offline", that setting will override the configured value of "Do not automatically make all redirected folders available offline".
</string>
<string id="FolderRedirectionEnableCacheRename">Enable optimized move of contents in Offline Files cache on Folder Redirection server path change</string>
<string id="FolderRedirectionEnableCacheRename_Help">This policy setting controls whether the contents of redirected folders is copied from the old location to the new location or simply renamed in the Offline Files cache when a folder is redirected to a new location.
If you enable this policy setting, when the path to a redirected folder is changed from one network location to another and Folder Redirection is configured to move the content to the new location, instead of copying the content to the new location, the cached content is renamed in the local cache and not copied to the new location. To use this policy setting, you must move or restore the server content to the new network location using a method that preserves the state of the files, including their timestamps, before updating the Folder Redirection location.
If you disable or do not configure this policy setting, when the path to a redirected folder is changed and Folder Redirection is configured to move the content to the new location, Windows copies the contents of the local cache to the new network location, then deleted the content from the old network location.
</string>
<string id="PrimaryComputerFr">Redirect folders on primary computers only</string>
<string id="PrimaryComputerFr_Help">This policy setting controls whether folders are redirected on a user's primary computers only. This policy setting is useful to improve logon performance and to increase security for user data on computers where the user might not want to download private data, such as on a meeting room computer or on a computer in a remote office.
To designate a user's primary computers, an administrator must use management software or a script to add primary computer attributes to the user's account in Active Directory Domain Services (AD DS). This policy setting also requires the Windows Server 2012 version of the Active Directory schema to function.
If you enable this policy setting and the user has redirected folders, such as the Documents and Pictures folders, the folders are redirected on the user's primary computer only.
If you disable or do not configure this policy setting and the user has redirected folders, the folders are redirected on every computer that the user logs on to.
Note: If you enable this policy setting in Computer Configuration and User Configuration, the Computer Configuration policy setting takes precedence.
</string>
</stringTable>
<presentationTable>
<presentation id="DisableFRAdminPinByFolder">
<text>Set the checkbox for any redirected shell folder that should not automatically be made available offline.</text>
<checkBox refId="DisablePinAppDataRoaming">AppData(Roaming)</checkBox>
<checkBox refId="DisablePinDesktop">Desktop</checkBox>
<checkBox refId="DisablePinStartMenu">Start Menu</checkBox>
<checkBox refId="DisablePinDocuments">Documents</checkBox>
<checkBox refId="DisablePinPictures">Pictures</checkBox>
<checkBox refId="DisablePinMusic">Music</checkBox>
<checkBox refId="DisablePinVideos">Videos</checkBox>
<checkBox refId="DisablePinFavorites">Favorites</checkBox>
<checkBox refId="DisablePinContacts">Contacts</checkBox>
<checkBox refId="DisablePinDownloads">Downloads</checkBox>
<checkBox refId="DisablePinLinks">Links</checkBox>
<checkBox refId="DisablePinSearches">Searches</checkBox>
<checkBox refId="DisablePinSavedGames">Saved Games</checkBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/FramePanes.adml
+34
View File
@@ -0,0 +1,34 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="ExplorerFramePanePolicies">Explorer Frame Pane</string>
<string id="PreviewPane">Turn on or off details pane</string>
<string id="PreviewPane_DropDownList_Show">Always show</string>
<string id="PreviewPane_DropDownList_Hide">Always hide</string>
<string id="PreviewPane_help">This policy setting shows or hides the Details Pane in File Explorer.
If you enable this policy setting and configure it to hide the pane, the Details Pane in File Explorer is hidden and cannot be turned on by the user.
If you enable this policy setting and configure it to show the pane, the Details Pane is always visible and cannot be hidden by the user. Note: This has a side effect of not being able to toggle to the Preview Pane since the two cannot be displayed at the same time.
If you disable, or do not configure this policy setting, the Details Pane is hidden by default and can be displayed by the user. This is the default policy setting.
</string>
<string id="NoReadingPane">Turn off Preview Pane</string>
<string id="NoReadingPane_help">Hides the Preview Pane in File Explorer.
If you enable this policy setting, the Preview Pane in File Explorer is hidden and cannot be turned on by the user.
If you disable, or do not configure this setting, the Preview Pane is hidden by default and can be displayed by the user.
</string>
</stringTable>
<presentationTable>
<presentation id="PreviewPane_DropDownList">
<dropdownList refId="PreviewPane_Dropdownlist_Box" defaultItem="0">Configure details pane</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/GameDVR.adml
+19
View File
@@ -0,0 +1,19 @@
<?xml version="1.0" encoding="utf-8"?>
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/PolicyDefinitions">
<displayName>Windows Game Recording and Broadcasting</displayName>
<description>Manages the Windows Game Recording and Broadcasting states</description>
<resources>
<stringTable>
<string id="GAMEDVR">Windows Game Recording and Broadcasting</string>
<string id="GAMEDVRHELP">Manages the Windows Game Recording and Broadcasting states</string>
<string id="GameDVRMode">Enables or disables Windows Game Recording and Broadcasting</string>
<string id="SUPPORTED_ProductOnly">Windows 10</string>
<string id="GameDVRMode_Help">Windows Game Recording and Broadcasting.
This setting enables or disables the Windows Game Recording and Broadcasting features. If you disable this setting, Windows Game Recording will not be allowed.
If the setting is enabled or not configured, then Recording and Broadcasting (streaming) will be allowed.
</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/Globalization.adml
+330
View File
@@ -0,0 +1,330 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="CustomLocalesNoSelect">Disallow selection of Custom Locales</string>
<string id="CustomLocalesNoSelect_Help">This policy setting prevents a user from selecting a supplemental custom locale as their user locale. The user is restricted to the set of locales that are installed with the operating system.
This does not affect the selection of replacement locales. To prevent the selection of replacement locales, adjust the permissions of the %windir%\Globalization directory to prevent the installation of locales by unauthorized users.
The policy setting "Restrict user locales" can also be enabled to disallow selection of a custom locale, even if this policy setting is not configured.
If you enable this policy setting, the user cannot select a custom locale as their user locale, but they can still select a replacement locale if one is installed.
If you disable or do not configure this policy setting, the user can select a custom locale as their user locale.
If this policy setting is enabled at the machine level, it cannot be disabled by a per-user policy setting. If this policy setting is disabled at the machine level, the per-user policy setting will be ignored. If this policy setting is not configured at the machine level, restrictions will be based on per-user policy settings.
To set this policy setting on a per-user basis, make sure that you do not configure the per-machine policy setting.
</string>
<string id="HideAdminOptions">Hide Regional and Language Options administrative options</string>
<string id="HideAdminOptions_Help">This policy setting removes the Administrative options from the Region settings control panel. Administrative options include interfaces for setting system locale and copying settings to the default user. This policy setting does not, however, prevent an administrator or another application from changing these values programmatically.
This policy setting is used only to simplify the Regional Options control panel.
If you enable this policy setting, the user cannot see the Administrative options.
If you disable or do not configure this policy setting, the user can see the Administrative options.
Note: Even if a user can see the Administrative options, other policies may prevent them from modifying the values.</string>
<string id="HideCurrentLocation">Hide the geographic location option</string>
<string id="HideCurrentLocation_Help">This policy setting removes the option to change the user's geographical location (GeoID) from the Region settings control panel.
This policy setting is used only to simplify the Regional Options control panel.
If you enable this policy setting, the user does not see the option to change the GeoID. This does not prevent the user or an application from changing the GeoID programmatically.
If you disable or do not configure this policy setting, the user sees the option for changing the user location (GeoID).
Note: Even if a user can see the GeoID option, the "Disallow changing of geographical location" option can prevent them from actually changing their current geographical location.</string>
<string id="HideLanguageSelection">Hide the select language group options</string>
<string id="HideLanguageSelection_Help">This policy setting removes the option to change the user's menus and dialogs (UI) language from the Language and Regional Options control panel.
This policy setting is used only to simplify the Regional Options control panel.
If you enable this policy setting, the user does not see the option for changing the UI language. This does not prevent the user or an application from changing the UI language programmatically.
If you disable or do not configure this policy setting, the user sees the option for changing the UI language.
Note: Even if a user can see the option to change the UI language, other policy settings can prevent them from changing their UI language.</string>
<string id="HideLocaleSelectAndCustomize">Hide user locale selection and customization options</string>
<string id="HideLocaleSelectAndCustomize_Help">This policy setting removes the regional formats interface from the Region settings control panel.
This policy setting is used only to simplify the Regional and Language Options control panel.
If you enable this policy setting, the user does not see the regional formats options. This does not prevent the user or an application from changing their user locale or user overrides programmatically.
If you disable or do not configure this policy setting, the user sees the regional formats options for changing and customizing the user locale.</string>
<string id="LocaleSystemRestrict">Restrict system locales</string>
<string id="LocaleSystemRestrict_Help">This policy setting restricts the permitted system locales to the specified list. If the list is empty, it locks the system locale to its current value. This policy setting does not change the existing system locale; however, the next time that an administrator attempts to change the computer's system locale, they will be restricted to the specified list.
The locale list is specified using language names, separated by a semicolon (;). For example, en-US is English (United States). Specifying "en-US;en-CA" would restrict the system locale to English (United States) and English (Canada).
If you enable this policy setting, administrators can select a system locale only from the specified system locale list.
If you disable or do not configure this policy setting, administrators can select any system locale shipped with the operating system.</string>
<string id="LocaleUserRestrict">Restrict user locales</string>
<string id="LocaleUserRestrict_Help">This policy setting restricts users on a computer to the specified list of user locales. If the list is empty, it locks all user locales to their current values. This policy setting does not change existing user locale settings; however, the next time a user attempts to change their user locale, their choices will be restricted to locales in this list.
To set this policy setting on a per-user basis, make sure that you do not configure the per-computer policy setting.
The locale list is specified using language tags, separated by a semicolon (;). For example, en-US is English (United States). Specifying "en-CA;fr-CA" would restrict the user locale to English (Canada) and French (Canada).
If you enable this policy setting, only locales in the specified locale list can be selected by users.
If you disable or do not configure this policy setting, users can select any locale installed on the computer, unless restricted by the "Disallow selection of Custom Locales" policy setting.
If this policy setting is enabled at the computer level, it cannot be disabled by a per-user policy. If this policy setting is disabled at the computer level, the per-user policy is ignored. If this policy setting is not configured at the computer level, restrictions are based on per-user policies.
</string>
<string id="LockMachineUILanguage">Restricts the UI language Windows uses for all logged users</string>
<string id="LockMachineUILanguage_Help">This policy setting restricts the Windows UI language for all users.
This is a policy setting for computers with more than one UI language installed.
If you enable this policy setting, the UI language of Windows menus and dialogs for systems with more than one language will follow the language specified by the administrator as the system UI languages. The UI language selected by the user will be ignored if it is different than any of the system UI languages.
If you disable or do not configure this policy setting, the user can specify which UI language is used.</string>
<string id="LockUserUILanguage">Restricts the UI languages Windows should use for the selected user</string>
<string id="LockUserUILanguage_Help">This policy setting restricts the Windows UI language for specific users.
This policy setting applies to computers with more than one UI language installed.
If you enable this policy setting, the UI language of Windows menus and dialogs for systems with more than one language is restricted to a specified language for the selected user. If the specified language is not installed on the target computer or you disable this policy setting, the language selection defaults to the language selected by the user.
If you disable or do not configure this policy setting, there is no restriction on which language users should use.
To enable this policy setting in Windows Server 2003, Windows XP, or Windows 2000, to use the "Restrict selection of Windows menus and dialogs language" policy setting.</string>
<string id="MachineUILanguageOverwrite">Force selected system UI language to overwrite the user UI language</string>
<string id="MachineUILanguageOverwrite_Help">This policy setting controls which UI language is used for computers with more than one UI language installed.
If you enable this policy setting, the UI language of Windows menus and dialogs for systems with more than one language is restricted to a specified language. If the specified language is not installed on the target computer or you disable this policy setting, the language selection defaults to the language selected by the local administrator.
If you disable or do not configure this policy setting, there is no restriction of a specific language used for the Windows menus and dialogs.</string>
<string id="NlsManagementCat">Locale Services</string>
<string id="PreventGeoIdChange">Disallow changing of geographic location</string>
<string id="PreventGeoIdChange_Help">This policy setting prevents users from changing their user geographical location (GeoID).
If you enable this policy setting, users cannot change their GeoID.
If you disable or do not configure this policy setting, users may select any GeoID.
If you enable this policy setting at the computer level, it cannot be disabled by a per-user policy setting. If you disable this policy setting at the computer level, the per-user policy is ignored. If you do not configure this policy setting at the computer level, restrictions are based on per-user policy settings.
To set this policy setting on a per-user basis, make sure that the per-computer policy setting is not configured.</string>
<string id="PreventUserOverrides">Disallow user override of locale settings</string>
<string id="PreventUserOverrides_Help">This policy setting prevents the user from customizing their locale by changing their user overrides.
Any existing overrides in place when this policy is enabled will be frozen. To remove existing user overrides, first reset the user(s) values to the defaults and then apply this policy.
When this policy setting is enabled, users can still choose alternate locales installed on the system unless prevented by other policies, however, they will be unable to customize those choices. The user cannot customize their user locale with user overrides.
If this policy setting is disabled or not configured, then the user can customize their user locale overrides.
If this policy is set to Enabled at the computer level, then it cannot be disabled by a per-User policy. If this policy is set to Disabled at the computer level, then the per-User policy will be ignored. If this policy is set to Not Configured at the computer level, then restrictions will be based on per-User policies.
To set this policy on a per-user basis, make sure that the per-computer policy is set to Not Configured.</string>
<string id="RegionalOptions">Regional and Language Options</string>
<string id="RestrictUILangSelect">Restrict selection of Windows menus and dialogs language</string>
<string id="RestrictUILangSelect_Help">This policy setting restricts users to the specified language by disabling the menus and dialog box controls in the Region settings control panel. If the specified language is not installed on the target computer, the language selection defaults to English.
If you enable this policy setting, the dialog box controls in the Regional and Language Options control panel are not accessible to the logged on user. This prevents users from specifying a language different than the one used.
To enable this policy setting in Windows Vista, use the "Restricts the UI languages Windows should use for the selected user" policy setting.
If you disable or do not configure this policy setting, the logged-on user can access the dialog box controls in the Regional and Language Options control panel to select any available UI language.</string>
<string id="UILang1">English</string>
<string id="UILang10">Swedish</string>
<string id="UILang11">Dutch</string>
<string id="UILang12">Portuguese (Brazil)</string>
<string id="UILang13">Finnish</string>
<string id="UILang14">Norwegian</string>
<string id="UILang15">Danish</string>
<string id="UILang16">Hungarian</string>
<string id="UILang17">Polish</string>
<string id="UILang18">Russian</string>
<string id="UILang19">Czech</string>
<string id="UILang2">Japanese</string>
<string id="UILang20">Greek</string>
<string id="UILang21">Portuguese (Portugal)</string>
<string id="UILang22">Turkish</string>
<string id="UILang23">Arabic</string>
<string id="UILang24">Hebrew</string>
<string id="UILang25">Slovak</string>
<string id="UILang26">Slovenian</string>
<string id="UILang27">Romanian</string>
<string id="UILang28">Croatian</string>
<string id="UILang29">Bulgarian</string>
<string id="UILang3">Korean</string>
<string id="UILang30">Estonian</string>
<string id="UILang31">Lithuanian</string>
<string id="UILang32">Latvian</string>
<string id="UILang33">Thai</string>
<string id="UILang4">German</string>
<string id="UILang5">Simplified Chinese</string>
<string id="UILang6">Traditional Chinese</string>
<string id="UILang34">Traditional Chinese (Hong Kong)</string>
<string id="UILang35">Traditional Chinese (Taiwan)</string>
<string id="UILang7">French</string>
<string id="UILang8">Spanish</string>
<string id="UILang9">Italian</string>
<string id="UILang36">Serbian (Latin)</string>
<string id="UILang37">Ukrainian</string>
<string id="Y2K">Century interpretation for Year 2000</string>
<string id="Y2K_Help">This policy setting determines how programs interpret two-digit years.
This policy setting affects only the programs that use this Windows feature to interpret two-digit years. If a program does not interpret two-digit years correctly, consult the documentation or manufacturer of the program.
If you enable this policy setting, the system specifies the largest two-digit year interpreted as being preceded by 20. All numbers less than or equal to the specified value are interpreted as being preceded by 20. All numbers greater than the specified value are interpreted as being preceded by 19.
For example, the default value, 2029, specifies that all two-digit years less than or equal to 29 (00 to 29) are interpreted as being preceded by 20, that is 2000 to 2029. Conversely, all two-digit years greater than 29 (30 to 99) are interpreted as being preceded by 19, that is, 1930 to 1999.
If you disable or do not configure this policy setting, Windows does not interpret two-digit year formats using this scheme for the program.</string>
<string id="TurnOffOfferTextPredictions">Turn off offer text predictions as I type</string>
<string id="TurnOffOfferTextPredictions_Help">
This policy turns off the offer text predictions as I type option. This does not, however, prevent the user or an application from changing the setting programmatically.
The offer text predictions as I type option controls whether or not text prediction suggestions will be presented to the user on the on-screen keyboard.
If the policy is Enabled, then the option will be locked to not offer text predictions.
If the policy is Disabled or Not Configured, then the user will be free to change the setting according to their preference.
Note that the availability and function of this setting is dependent on supported languages being enabled.</string>
<string id="TurnOffInsertSpace">Turn off insert a space after selecting a text prediction</string>
<string id="TurnOffInsertSpace_Help">
This policy turns off the insert a space after selecting a text prediction option. This does not, however, prevent the user or an application from changing the setting programmatically.
The insert a space after selecting a text prediction option controls whether or not a space will be inserted after the user selects a text prediction candidate when using the on-screen keyboard.
If the policy is Enabled, then the option will be locked to not insert a space after selecting a text prediction.
If the policy is Disabled or Not Configured, then the user will be free to change the setting according to their preference.
Note that the availability and function of this setting is dependent on supported languages being enabled.</string>
<string id="TurnOffAutocorrectMisspelledWords">Turn off autocorrect misspelled words</string>
<string id="TurnOffAutocorrectMisspelledWords_Help">
This policy turns off the autocorrect misspelled words option. This does not, however, prevent the user or an application from changing the setting programmatically.
The autocorrect misspelled words option controls whether or not errors in typed text will be automatically corrected.
If the policy is Enabled, then the option will be locked to not autocorrect misspelled words.
If the policy is Disabled or Not Configured, then the user will be free to change the setting according to their preference.
Note that the availability and function of this setting is dependent on supported languages being enabled.</string>
<string id="TurnOffHighlightMisspelledWords">Turn off highlight misspelled words</string>
<string id="TurnOffHighlightMisspelledWords_Help">
This policy turns off the highlight misspelled words option. This does not, however, prevent the user or an application from changing the setting programmatically.
The highlight misspelled words option controls whether or next spelling errors in typed text will be highlighted.
If the policy is Enabled, then the option will be locked to not highlight misspelled words.
If the policy is Disabled or Not Configured, then the user will be free to change the setting according to their preference.
Note that the availability and function of this setting is dependent on supported languages being enabled.</string>
<string id="ImplicitDataCollectionOff">Turn off automatic learning</string>
<string id="ImplicitDataCollectionOff_Help">
This policy setting turns off the automatic learning component of handwriting recognition personalization.
Automatic learning enables the collection and storage of text and ink written by the user in order to help adapt handwriting recognition to the vocabulary and handwriting style of the user.
Text that is collected includes all outgoing messages in Windows Mail, and MAPI enabled email clients, as well as URLs from the Internet Explorer browser history. The information that is stored includes word frequency and new words not already known to the handwriting recognition engines (for example, proper names and acronyms). Deleting email content or the browser history does not delete the stored personalization data. Ink entered through Input Panel is collected and stored.
Note: Automatic learning of both text and ink might not be available for all languages, even when handwriting personalization is available. See Tablet PC Help for more information.
If you enable this policy setting, automatic learning stops and any stored data is deleted. Users cannot configure this setting in Control Panel.
If you disable this policy setting, automatic learning is turned on. Users cannot configure this policy setting in Control Panel. Collected data is only used for handwriting recognition, if handwriting personalization is turned on.
If you do not configure this policy, users can choose to enable or disable automatic learning either from the Handwriting tab in the Tablet Settings in Control Panel or from the opt-in dialog.
This policy setting is related to the "Turn off handwriting personalization" policy setting.
Note: The amount of stored ink is limited to 50 MB and the amount of text information to approximately 5 MB. When these limits are reached and new data is collected, old data is deleted to make room for more recent data.
Note: Handwriting personalization works only for Microsoft handwriting recognizers, and not with third-party recognizers.</string>
<string id="InputPersonalization">Handwriting personalization</string>
<string id="BlockUserInputMethodsForSignIn">Disallow copying of user input methods to the system account for sign-in</string>
<string id="BlockUserInputMethodsForSignIn_Help">
This policy prevents automatic copying of user input methods to the system account for use on the sign-in screen. The user is restricted to the set of input methods that are enabled in the system account.
Note this does not affect the availability of user input methods on the lock screen or with the UAC prompt.
If the policy is Enabled, then the user will get input methods enabled for the system account on the sign-in page.
If the policy is Disabled or Not Configured, then the user will be able to use input methods enabled for their user account on the sign-in page.</string>
<string id="BlockCleanupOfUnusedPreinstalledLangPacks">Block clean-up of unused language packs</string>
<string id="BlockCleanupOfUnusedPreinstalledLangPacks_Help">
This policy setting controls whether the LPRemove task will run to clean up language packs installed on a machine but are not used by any users on that machine.
If you enable this policy setting, language packs that are installed as part of the system image will remain installed even if they are not used by any user on that system.
If you disable or do not configure this policy setting, language packs that are installed as part of the system image but are not used by any user on that system will be removed as part of a scheduled clean up task.
</string>
<string id="AllowInputPersonalization">Allow users to enable online speech recognition services</string>
<string id="AllowInputPersonalization_Help">
This policy specifies whether users on the device have the option to enable online speech recognition services.
If this policy is enabled or not configured, control is deferred to users, and users may choose whether to enable speech services via settings.
If this policy is disabled, speech services will be disabled, and users cannot enable speech services via settings.
</string>
<string id="RestrictLanguagePacksAndFeaturesInstall">Restrict Language Pack and Language Feature Installation</string>
<string id="RestrictLanguagePacksAndFeaturesInstall_Machine_Help">
This policy setting restricts all users from installing language packs and language features on demand packages. This policy does not restrict switching the Windows language, if you want to restrict the Windows language use the following policy: "Restricts the UI languages Windows uses for all logged users."  
If you enable this policy setting, the installation of language packs and language features is prevented for all users.
If you disable or do not configure this policy setting, there is no language packs or feature installation restriction for any user.  
</string>
<string id="RestrictLanguagePacksAndFeaturesInstall_User_Help">
This policy setting restricts the user from installing language packs and language features on demand. This policy does not restrict switching the Windows language, if you want to restrict the Windows language use the following policy: "Restricts the UI languages Windows should use for the selected user."  
If you enable this policy setting, the installation of language packs and language features is prevented for the user.  
If you disable or do not configure this policy setting, there is no language packs or language features installation restriction for the user.  
</string>
</stringTable>
<presentationTable>
<presentation id="LocaleSystemRestrict">
<text>These systems are restricted to the following locale(s)</text>
<text>The expected form is en-US;fr-FR</text>
<textBox refId="AllowableSystemLocaleTagList">
<label>System Locales</label>
</textBox>
</presentation>
<presentation id="LocaleUserRestrict_1">
<text>The user is restricted to using the following locale(s)</text>
<text>The expected form is en-US;fr-FR</text>
<textBox refId="AllowableUserLocaleTagList">
<label>User Locales</label>
</textBox>
</presentation>
<presentation id="LocaleUserRestrict_2">
<text>The user is restricted to using the following locale(s)</text>
<text>The expected form is en-US;fr-FR</text>
<textBox refId="AllowableUserLocaleTagList">
<label>User Locales</label>
</textBox>
</presentation>
<presentation id="LockMachineUILanguage">
<dropdownList refId="UILangSelect" noSort="true" defaultItem="0">Restrict users to the following language:</dropdownList>
</presentation>
<presentation id="LockUserUILanguage">
<dropdownList refId="UILangSelect" noSort="true" defaultItem="0">Restrict users to the following language:</dropdownList>
</presentation>
<presentation id="RestrictUILangSelect">
<dropdownList refId="UILangSelect" noSort="true" defaultItem="0">Restrict users to the following language:</dropdownList>
</presentation>
<presentation id="Y2K">
<text>Specify the maximum year for which two-digit years are interpreted as being 21st century:</text>
<decimalTextBox refId="Y2KYear" defaultValue="2029">Year </decimalTextBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/GroupPolicy.adml
+670
View File
@@ -0,0 +1,670 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="MitigationOptions">Mitigation Options</string>
<string id="Font_List">Untrusted Font Blocking</string>
<string id="Font_List_Help">This security feature provides a global setting to prevent programs from loading untrusted fonts. Untrusted fonts are any font installed outside of the %windir%\Fonts directory. This feature can be configured to be in 3 modes: On, Off, and Audit. By default, it is Off and no fonts are blocked. If you aren't quite ready to deploy this feature into your organization, you can run it in Audit mode to see if blocking untrusted fonts causes any usability or compatibility issues.</string>
<string id="FontMitigation_On">Block untrusted fonts and log events</string>
<string id="FontMitigation_Off">Do not block untrusted fonts</string>
<string id="FontMitigation_Audit">Log events without blocking untrusted fonts</string>
<string id="ProcessMitigationOptions_List">Process Mitigation Options</string>
<string id="ProcessMitigationOptions_List_Help">
This security feature provides a means to override individual process MitigationOptions settings. This can be used to enforce a number of security policies specific to applications. The application name is specified as the Value name, including extension. The Value is specified as a bit field with a series of flags in particular positions. Bits can be set to either 0 (setting is forced off), 1 (setting is forced on), or ? (setting retains its existing value prior to GPO evaluation). The recognized bit locations are:
PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE (0x00000001)
Enables data execution prevention (DEP) for the child process
PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE (0x00000002)
Enables DEP-ATL thunk emulation for the child process. DEP-ATL thunk emulation causes the system to intercept NX faults that originate from the Active Template Library (ATL) thunk layer.
PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE (0x00000004)
Enables structured exception handler overwrite protection (SEHOP) for the child process. SEHOP blocks exploits that use the structured exception handler (SEH) overwrite technique.
PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON (0x00000100)
The force Address Space Layout Randomization (ASLR) policy forcibly rebases images that are not dynamic base compatible by acting as though an image base collision happened at load time. If relocations are required, images that do not have a base relocation section will not be loaded.
PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON (0x00010000)
PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF (0x00020000)
The bottom-up randomization policy, which includes stack randomization options, causes a random location to be used as the lowest user address.
For instance, to enable PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE and PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON, disable PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF, and to leave all other options at their default values, specify a value of:
???????????????0???????1???????1
Setting flags not specified here to any value other than ? results in undefined behavior.
</string>
<string id="ResetDfsClientInfoDuringRefreshPolicy">Enable AD/DFS domain controller synchronization during policy refresh</string>
<string id="ResetDfsClientInfoDuringRefreshPolicy_Help">Enabling this setting will cause the Group Policy Client to connect to the same domain controller for DFS shares as is being used for Active Directory.
</string>
<string id="DisableAOACProcessing">Turn off Group Policy Client Service AOAC optimization</string>
<string id="DisableAOACProcessing_Help">This policy setting prevents the Group Policy Client Service from stopping when idle.
</string>
<string id="EnableCDP">Continue experiences on this device</string>
<string id="EnableCDP_Help">
This policy setting determines whether the Windows device is allowed to participate in cross-device experiences (continue experiences).
If you enable this policy setting, the Windows device is discoverable by other Windows devices that belong to the same user, and can participate in cross-device experiences.
If you disable this policy setting, the Windows device is not discoverable by other devices, and cannot participate in cross-device experiences.
If you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot.
</string>
<string id="EnableMMX">Phone-PC linking on this device</string>
<string id="EnableMMX_Help">
This policy allows IT admins to turn off the ability to Link a Phone with a PC to continue reading, emailing and other tasks that requires linking between Phone and PC.
If you enable this policy setting, the Windows device will be able to enroll in Phone-PC linking functionality and participate in Continue on PC experiences.
If you disable this policy setting, the Windows device is not allowed to be linked to Phones, will remove itself from the device list of any linked Phones, and cannot participate in Continue on PC experiences.
If you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot.
</string>
<string id="EnableAppUriHandlers">Configure web-to-app linking with app URI handlers</string>
<string id="EnableAppUriHandlers_Help">
This policy setting determines whether Windows supports web-to-app linking with app URI handlers.
Enabling this policy setting enables web-to-app linking so that apps can be launched with a http(s) URI.
Disabling this policy disables web-to-app linking and http(s) URIs will be opened in the default browser instead of launching the associated app.
If you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot.
</string>
<string id="Fonts">Fonts</string>
<string id="EnableFontProviders">Enable Font Providers</string>
<string id="EnableFontProviders_Help">
This policy setting determines whether Windows is allowed to download fonts and font catalog data from an online font provider.
If you enable this policy setting, Windows periodically queries an online font provider to determine whether a new font catalog is available. Windows may also download font data if needed to format or render text.
If you disable this policy setting, Windows does not connect to an online font provider and only enumerates locally-installed fonts.
If you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot.
</string>
<string id="EnableLogonOptimization">Configure Group Policy Caching</string>
<string id="EnableLogonOptimization_Help">
This policy setting allows you to configure Group Policy caching behavior.
If you enable or do not configure this policy setting, Group Policy caches policy information after every background processing session. This cache saves applicable GPOs and the settings contained within them. When Group Policy runs in synchronous foreground mode, it refers to this cache, which enables it to run faster. When the cache is read, Group Policy attempts to contact a logon domain controller to determine the link speed. When Group Policy runs in background mode or asynchronous foreground mode, it continues to download the latest version of the policy information, and it uses a bandwidth estimate to determine slow link thresholds. (See the “Configure Group Policy Slow Link Detection” policy setting to configure asynchronous foreground behavior.)
The slow link value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before reporting the link speed as slow. The default is 500 milliseconds.
The timeout value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before determining that there is no network connectivity. This stops the current Group Policy processing. Group Policy will run in the background the next time a connection to a domain controller is established. Setting this value too high might result in longer waits for the user at boot or logon. The default is 5000 milliseconds.
If you disable this policy setting, the Group Policy client will not cache applicable GPOs or settings that are contained within the GPOs. When Group Policy runs synchronously, it downloads the latest version of the policy from the network and uses bandwidth estimates to determine slow link thresholds. (See the “Configure Group Policy Slow Link Detection” policy setting to configure asynchronous foreground behavior.)
</string>
<string id="EnableLogonOptimizationOnServerSKU">Enable Group Policy Caching for Servers</string>
<string id="EnableLogonOptimizationOnServerSKU_Help">
This policy setting allows you to configure Group Policy caching behavior on Windows Server machines.
If you enable this policy setting, Group Policy caches policy information after every background processing session. This cache saves applicable GPOs and the settings contained within them. When Group Policy runs in synchronous foreground mode, it refers to this cache, which enables it to run faster. When the cache is read, Group Policy attempts to contact a logon domain controller to determine the link speed. When Group Policy runs in background mode or asynchronous foreground mode, it continues to download the latest version of the policy information, and it uses a bandwidth estimate to determine slow link thresholds. (See the “Configure Group Policy Slow Link Detection” policy setting to configure asynchronous foreground behavior.)
The slow link value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before reporting the link speed as slow. The default is 500 milliseconds.
The timeout value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before determining that there is no network connectivity. This stops the current Group Policy processing. Group Policy will run in the background the next time a connection to a domain controller is established. Setting this value too high might result in longer waits for the user at boot or logon. The default is 5000 milliseconds.
If you disable or do not configure this policy setting, the Group Policy client will not cache applicable GPOs or settings that are contained within the GPOs. When Group Policy runs synchronously, it downloads the latest version of the policy from the network and uses bandwidth estimates to determine slow link thresholds. (See the “Configure Group Policy Slow Link Detection” policy setting to configure asynchronous foreground behavior.)
</string>
<string id="LogonScriptDelay">Configure Logon Script Delay</string>
<string id="LogonScriptDelay_Help">
Enter “0” to disable Logon Script Delay.
This policy setting allows you to configure how long the Group Policy client waits after logon before running scripts.
By default, the Group Policy client waits five minutes before running logon scripts. This helps create a responsive desktop environment by preventing disk contention.
If you enable this policy setting, Group Policy will wait for the specified amount of time before running logon scripts.
If you disable this policy setting, Group Policy will run scripts immediately after logon.
If you do not configure this policy setting, Group Policy will wait five minutes before running logon scripts.
</string>
<string id="SlowLinkDefaultForDirectAccess">Configure Direct Access connections as a fast network connection</string>
<string id="SlowLinkDefaultForDirectAccess_Help">This policy setting allows an administrator to define the Direct Access connection to be considered a fast network connection for the purposes of applying and updating Group Policy.
When Group Policy detects the bandwidth speed of a Direct Access connection, the detection can sometimes fail to provide any bandwidth speed information. If Group Policy detects a bandwidth speed, Group Policy will follow the normal rules for evaluating if the Direct Access connection is a fast or slow network connection. If no bandwidth speed is detected, Group Policy will default to a slow network connection. This policy setting allows the administrator the option to override the default to slow network connection and instead default to using a fast network connection in the case that no network bandwidth speed is determined.
Note: When Group Policy detects a slow network connection, Group Policy will only process those client side extensions configured for processing across a slow link (slow network connection).
If you enable this policy, when Group Policy cannot determine the bandwidth speed across Direct Access, Group Policy will evaluate the network connection as a fast link and process all client side extensions.
If you disable this setting or do not configure it, Group Policy will evaluate the network connection as a slow link and process only those client side extensions configured to process over a slow link.
</string>
<string id="SlowlinkDefaultToAsync">Change Group Policy processing to run asynchronously when a slow network connection is detected.</string>
<string id="SlowlinkDefaultToAsync_Help">This policy directs Group Policy processing to skip processing any client side extension that requires synchronous processing (that is, whether computers wait for the network to be fully initialized during computer startup and user logon) when a slow network connection is detected.
If you enable this policy setting, when a slow network connection is detected, Group Policy processing will always run in an asynchronous manner.
Client computers will not wait for the network to be fully initialized at startup and logon. Existing users will be logged on using cached credentials,
which will result in shorter logon times. Group Policy will be applied in the background after the network becomes available.
Note that because this is a background refresh, extensions requiring synchronous processing such as Software Installation, Folder Redirection
and Drive Maps preference extension will not be applied.
Note: There are two conditions that will cause Group Policy to be processed synchronously even if this policy setting is enabled:
1 - At the first computer startup after the client computer has joined the domain.
2 - If the policy setting "Always wait for the network at computer startup and logon" is enabled.
If you disable or do not configure this policy setting, detecting a slow network connection will not affect whether Group Policy processing will be synchronous or asynchronous.
</string>
<string id="DisableLGPOProcessing">Turn off Local Group Policy Objects processing</string>
<string id="DisableLGPOProcessing_Help">This policy setting prevents Local Group Policy Objects (Local GPOs) from being applied.
By default, the policy settings in Local GPOs are applied before any domain-based GPO policy settings. These policy settings can apply to both users and the local computer. You can disable the processing and application of all Local GPOs to ensure that only domain-based GPOs are applied.
If you enable this policy setting, the system does not process and apply any Local GPOs.
If you disable or do not configure this policy setting, Local GPOs continue to be applied.
Note: For computers joined to a domain, it is strongly recommended that you only configure this policy setting in domain-based GPOs. This policy setting will be ignored on computers that are joined to a workgroup.
</string>
<string id="SyncWaitTime">Specify startup policy processing wait time</string>
<string id="SyncWaitTime_Help">This policy setting specifies how long Group Policy should wait for network availability notifications during startup policy processing. If the startup policy processing is synchronous, the computer is blocked until the network is available or the default wait time is reached. If the startup policy processing is asynchronous, the computer is not blocked and policy processing will occur in the background. In either case, configuring this policy setting overrides any system-computed wait times.
If you enable this policy setting, Group Policy will use this administratively configured maximum wait time and override any default or system-computed wait time.
If you disable or do not configure this policy setting, Group Policy will use the default wait time of 30 seconds on computers running Windows Vista operating system.
</string>
<string id="AllowX-ForestPolicy-and-RUP">Allow cross-forest user policy and roaming user profiles</string>
<string id="AllowX-ForestPolicy-and-RUP_Help">This policy setting allows user-based policy processing, roaming user profiles, and user object logon scripts for interactive logons across forests.
This policy setting affects all user accounts that interactively log on to a computer in a different forest when a trust across forests or a two-way forest trust exists.
If you do not configure this policy setting:
- No user-based policy settings are applied from the user's forest.
- Users do not receive their roaming profiles; they receive a local profile on the computer from the local forest. A warning message appears to the user, and an event log message (1529) is posted.
- Loopback Group Policy processing is applied, using the Group Policy Objects (GPOs) that are scoped to the computer.
- An event log message (1109) is posted, stating that loopback was invoked in Replace mode.
If you enable this policy setting, the behavior is exactly the same as in Windows 2000: user policy is applied, and a roaming user profile is allowed from the trusted forest.
If you disable this policy setting, the behavior is the same as if it is not configured.</string>
<string id="CSE_AppMgmt">Configure software Installation policy processing</string>
<string id="CSE_AppMgmt_Help">This policy setting determines when software installation policies are updated.
This policy setting affects all policy settings that use the software installation component of Group Policy, such as policy settings in Software Settings\Software Installation. You can set software installation policy only for Group Policy Objects stored in Active Directory, not for Group Policy Objects on the local computer.
This policy setting overrides customized settings that the program implementing the software installation policy set when it was installed.
If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.
The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy setting implementations specify that they are updated only when changed. However, you might want to update unchanged policy settings, such as reapplying a desired policies in case a user has changed it.</string>
<string id="CSE_DiskQuota">Configure disk quota policy processing</string>
<string id="CSE_DiskQuota_Help">This policy setting determines when disk quota policies are updated.
This policy setting affects all policies that use the disk quota component of Group Policy, such as those in Computer Configuration\Administrative Templates\System\Disk Quotas.
This policy setting overrides customized settings that the program implementing the disk quota policy set when it was installed.
If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.
The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.
The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.</string>
<string id="CSE_EFSRecovery">Configure EFS recovery policy processing</string>
<string id="CSE_EFSRecovery_Help">This policy setting determines when encryption policies are updated.
This policy setting affects all policies that use the encryption component of Group Policy, such as policies related to encryption in Windows Settings\Security Settings.
It overrides customized settings that the program implementing the encryption policy set when it was installed.
If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.
The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.
The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.</string>
<string id="CSE_FolderRedirection">Configure folder redirection policy processing</string>
<string id="CSE_FolderRedirection_Help">This policy setting determines when folder redirection policies are updated.
This policy setting affects all policies that use the folder redirection component of Group Policy, such as those in WindowsSettings\Folder Redirection. You can only set folder redirection policy for Group Policy objects, stored in Active Directory, not for Group Policy objects on the local computer.
This policy setting overrides customized settings that the program implementing the folder redirection policy setting set when it was installed.
If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.
The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.</string>
<string id="CSE_IEM">Configure Internet Explorer Maintenance policy processing</string>
<string id="CSE_IEM_Help">This policy setting determines when Internet Explorer Maintenance policies are updated.
This policy setting affects all policies that use the Internet Explorer Maintenance component of Group Policy, such as those in Windows Settings\Internet Explorer Maintenance.
This policy setting overrides customized settings that the program implementing the Internet Explorer Maintenance policy set when it was installed.
If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.
The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.
The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it.</string>
<string id="CSE_IPSecurity">Configure IP security policy processing</string>
<string id="CSE_IPSecurity_Help">This policy setting determines when IP security policies are updated.
This policy setting affects all policies that use the IP security component of Group Policy, such as policies in Computer Configuration\Windows Settings\Security Settings\IP Security Policies on Local Machine.
This policy setting overrides customized settings that the program implementing the IP security policy set when it was installed.
If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.
The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.
The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it.</string>
<string id="CSE_Registry">Configure registry policy processing</string>
<string id="CSE_Registry_Help">This policy setting determines when registry policies are updated.
This policy setting affects all policies in the Administrative Templates folder and any other policies that store values in the registry. It overrides customized settings that the program implementing a registry policy set when it was installed.
If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.
The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.
The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it.</string>
<string id="CSE_Scripts">Configure scripts policy processing</string>
<string id="CSE_Scripts_Help">This policy setting determines when policies that assign shared scripts are updated.
This policy setting affects all policies that use the scripts component of Group Policy, such as those in WindowsSettings\Scripts. It overrides customized settings that the program implementing the scripts policy set when it was installed.
If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this setting, it has no effect on the system.
The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.
The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it.</string>
<string id="CSE_Security">Configure security policy processing</string>
<string id="CSE_Security_Help">This policy setting determines when security policies are updated.
This policy setting affects all policies that use the security component of Group Policy, such as those in Windows Settings\Security Settings.
This policy setting overrides customized settings that the program implementing the security policy set when it was installed.
If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.
The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.
The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they be updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it.</string>
<string id="CSE_Wireless">Configure wireless policy processing</string>
<string id="CSE_Wireless_Help">This policy setting determines when policies that assign wireless network settings are updated.
This policy setting affects all policies that use the wireless network component of Group Policy, such as those in WindowsSettings\Wireless Network Policies.
It overrides customized settings that the program implementing the wireless network set when it was installed.
If you enable this policy, you can use the check boxes provided to change the options.
If you disable this setting or do not configure it, it has no effect on the system.
The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.
The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.</string>
<string id="CSE_Wired">Configure wired policy processing</string>
<string id="CSE_Wired_Help">This policy setting determines when policies that assign wired network settings are updated.
This policy setting affects all policies that use the wired network component of Group Policy, such as those in Windows Settings\Wired Network Policies.
It overrides customized settings that the program implementing the wired network set when it was installed.
If you enable this policy, you can use the check boxes provided to change the options.
If you disable this setting or do not configure it, it has no effect on the system.
The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.
The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.</string>
<string id="DenyRsopToInteractiveUser">Determine if interactive users can generate Resultant Set of Policy data</string>
<string id="DenyRsopToInteractiveUser_Help">This policy setting controls the ability of users to view their Resultant Set of Policy (RSoP) data.
By default, interactively logged on users can view their own Resultant Set of Policy (RSoP) data.
If you enable this policy setting, interactive users cannot generate RSoP data.
If you disable or do not configure this policy setting, interactive users can generate RSoP.
Note: This policy setting does not affect administrators. If you enable or disable this policy setting, by default administrators can view RSoP data.
Note: To view RSoP data on a client computer, use the RSoP snap-in for the Microsoft Management Console. You can launch the RSoP snap-in from the command line by typing RSOP.msc
Note: This policy setting exists as both a User Configuration and Computer Configuration setting.
Also, see the "Turn off Resultant set of Policy logging" policy setting in Computer Configuration\Administrative Templates\System\GroupPolicy.</string>
<string id="DisableAutoADMUpdate">Turn off automatic update of ADM files</string>
<string id="DisableAutoADMUpdate_Help">Prevents the system from updating the Administrative Templates source files automatically when you open the Group Policy Object Editor. Administrators might want to use this if they are concerned about the amount of space used on the system volume of a DC.
By default, when you start the Group Policy Object Editor, a timestamp comparison is performed on the source files in the local %SYSTEMROOT%\inf directory and the source files stored in the GPO. If the local files are newer, they are copied into the GPO.
Changing the status of this setting to Enabled will keep any source files from copying to the GPO.
Changing the status of this setting to Disabled will enforce the default behavior. Files will always be copied to the GPO if they have a later timestamp.
NOTE: If the Computer Configuration policy setting, "Always use local ADM files for the Group Policy Object Editor" is enabled, the state of this setting is ignored and always treated as Enabled.</string>
<string id="DisableBackgroundPolicy">Turn off background refresh of Group Policy</string>
<string id="DisableBackgroundPolicy_Help">This policy setting prevents Group Policy from being updated while the computer is in use. This policy setting applies to Group Policy for computers, users, and domain controllers.
If you enable this policy setting, the system waits until the current user logs off the system before updating the computer and user settings.
If you disable or do not configure this policy setting, updates can be applied while users are working. The frequency of updates is determined by the "Set Group Policy refresh interval for computers" and "Set Group Policy refresh interval for users" policy settings.
Note: If you make changes to this policy setting, you must restart your computer for it to take effect.</string>
<string id="DisableUsersFromMachGP">Remove users' ability to invoke machine policy refresh</string>
<string id="DisableUsersFromMachGP_Help">This policy setting allows you to control a user's ability to invoke a computer policy refresh.
If you enable this policy setting, users are not able to invoke a refresh of computer policy. Computer policy will still be applied at startup or when an official policy refresh occurs.
If you disable or do not configure this policy setting, the default behavior applies. By default, computer policy is applied when the computer starts up. It also applies at a specified refresh interval or when manually invoked by the user.
Note: This policy setting applies only to non-administrators. Administrators can still invoke a refresh of computer policy at any time, no matter how this policy setting is configured.
Also, see the "Set Group Policy refresh interval for computers" policy setting to change the policy refresh interval.
Note: If you make changes to this policy setting, you must restart your computer for it to take effect.</string>
<string id="EnforcePoliciesOnly">Enforce Show Policies Only</string>
<string id="EnforcePoliciesOnly_Help">This policy setting prevents administrators from viewing or using Group Policy preferences.
A Group Policy administration (.adm) file can contain both true settings and preferences. True settings, which are fully supported by Group Policy, must use registry entries in the Software\Policies or Software\Microsoft\Windows\CurrentVersion\Policies registry subkeys. Preferences, which are not fully supported, use registry entries in other subkeys.
If you enable this policy setting, the "Show Policies Only" command is turned on, and administrators cannot turn it off. As a result, Group Policy Object Editor displays only true settings; preferences do not appear.
If you disable or do not configure this policy setting, the "Show Policies Only" command is turned on by default, but administrators can view preferences by turning off the "Show Policies Only" command.
Note: To find the "Show Policies Only" command, in Group Policy Object Editor, click the Administrative Templates folder (either one), right-click the same folder, and then point to "View."
In Group Policy Object Editor, preferences have a red icon to distinguish them from true settings, which have a blue icon.</string>
<string id="GPDCOptionAny">Use any available domain controller</string>
<string id="GPDCOptionInherit">Inherit from Active Directory Snap-ins</string>
<string id="GPDCOptionPDC">Use the Primary Domain Controller</string>
<string id="GPDCOptions">Configure Group Policy domain controller selection</string>
<string id="GPDCOptions_Help">This policy setting determines which domain controller the Group Policy Object Editor snap-in uses.
If you enable this setting, you can which domain controller is used according to these options:
"Use the Primary Domain Controller" indicates that the Group Policy Object Editor snap-in reads and writes changes to the domain controller designated as the PDC Operations Master for the domain.
"Inherit from Active Directory Snap-ins" indicates that the Group Policy Object Editor snap-in reads and writes changes to the domain controller that Active Directory Users and Computers or Active Directory Sites and Services snap-ins use.
"Use any available domain controller" indicates that the Group Policy Object Editor snap-in can read and write changes to any available domain controller.
If you disable this setting or do not configure it, the Group Policy Object Editor snap-in uses the domain controller designated as the PDC Operations Master for the domain.
Note: To change the PDC Operations Master for a domain, in Active Directory Users and Computers, right-click a domain, and then click "Operations Masters."</string>
<string id="GPTransferRate">Configure Group Policy slow link detection</string>
<string id="GPTransferRate_Help">This policy setting defines a slow connection for purposes of applying and updating Group Policy.
If the rate at which data is transferred from the domain controller providing a policy update to the computers in this group is slower than the rate specified by this setting, the system considers the connection to be slow.
The system's response to a slow policy connection varies among policies. The program implementing the policy can specify the response to a slow link. Also, the policy processing settings in this folder lets you override the programs' specified responses to slow links.
If you enable this setting, you can, in the "Connection speed" box, type a decimal number between 0 and 4,294,967,200, indicating a transfer rate in kilobits per second. Any connection slower than this rate is considered to be slow. If you type 0, all connections are considered to be fast.
If you disable this setting or do not configure it, the system uses the default value of 500 kilobits per second.
This setting appears in the Computer Configuration and User Configuration folders. The setting in Computer Configuration defines a slow link for policies in the Computer Configuration folder. The setting in User Configuration defines a slow link for settings in the User Configuration folder.
Also, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile. Note: If the profile server has IP connectivity, the connection speed setting is used. If the profile server does not have IP connectivity, the SMB timing is used.</string>
<string id="GroupPolicyRefreshRate">Set Group Policy refresh interval for computers</string>
<string id="GroupPolicyRefreshRate_Help">This policy setting specifies how often Group Policy for computers is updated while the computer is in use (in the background). This setting specifies a background update rate only for Group Policies in the Computer Configuration folder.
In addition to background updates, Group Policy for the computer is always updated when the system starts.
By default, computer Group Policy is updated in the background every 90 minutes, with a random offset of 0 to 30 minutes.
If you enable this setting, you can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the computer tries to update Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations.
If you disable this setting, Group Policy is updated every 90 minutes (the default). To specify that Group Policy should never be updated while the computer is in use, select the "Turn off background refresh of Group Policy" policy.
The Set Group Policy refresh interval for computers policy also lets you specify how much the actual update interval varies. To prevent clients with the same update interval from requesting updates simultaneously, the system varies the update interval for each client by a random number of minutes. The number you type in the random time box sets the upper limit for the range of variance. For example, if you type 30 minutes, the system selects a variance of 0 to 30 minutes. Typing a large number establishes a broad range and makes it less likely that client requests overlap. However, updates might be delayed significantly.
This setting establishes the update rate for computer Group Policy. To set an update rate for user policies, use the "Set Group Policy refresh interval for users" setting (located in User Configuration\Administrative Templates\System\Group Policy).
This setting is only used when the "Turn off background refresh of Group Policy" setting is not enabled.
Note: Consider notifying users that their policy is updated periodically so that they recognize the signs of a policy update. When Group Policy is updated, the Windows desktop is refreshed; it flickers briefly and closes open menus. Also, restrictions imposed by Group Policies, such as those that limit the programs users can run, might interfere with tasks in progress.</string>
<string id="GroupPolicyRefreshRateDC">Set Group Policy refresh interval for domain controllers</string>
<string id="GroupPolicyRefreshRateDC_Help">This policy setting specifies how often Group Policy is updated on domain controllers while they are running (in the background). The updates specified by this setting occur in addition to updates performed when the system starts.
By default, Group Policy on the domain controllers is updated every five minutes.
If you enable this setting, you can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the domain controller tries to update Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations.
If you disable or do not configure this setting, the domain controller updates Group Policy every 5 minutes (the default). To specify that Group Policies for users should never be updated while the computer is in use, select the "Turn off background refresh of Group Policy" setting.
This setting also lets you specify how much the actual update interval varies. To prevent domain controllers with the same update interval from requesting updates simultaneously, the system varies the update interval for each controller by a random number of minutes. The number you type in the random time box sets the upper limit for the range of variance. For example, if you type 30 minutes, the system selects a variance of 0 to 30 minutes. Typing a large number establishes a broad range and makes it less likely that update requests overlap. However, updates might be delayed significantly.
Note: This setting is used only when you are establishing policy for a domain, site, organizational unit (OU), or customized group. If you are establishing policy for a local computer only, the system ignores this setting.</string>
<string id="GroupPolicyRefreshRateUser">Set Group Policy refresh interval for users</string>
<string id="GroupPolicyRefreshRateUser_Help">This policy setting specifies how often Group Policy for users is updated while the computer is in use (in the background). This setting specifies a background update rate only for the Group Policies in the User Configuration folder.
In addition to background updates, Group Policy for users is always updated when users log on.
By default, user Group Policy is updated in the background every 90 minutes, with a random offset of 0 to 30 minutes.
If you enable this setting, you can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the computer tries to update user Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations.
If you disable this setting, user Group Policy is updated every 90 minutes (the default). To specify that Group Policy for users should never be updated while the computer is in use, select the "Turn off background refresh of Group Policy" setting.
This setting also lets you specify how much the actual update interval varies. To prevent clients with the same update interval from requesting updates simultaneously, the system varies the update interval for each client by a random number of minutes. The number you type in the random time box sets the upper limit for the range of variance. For example, if you type 30 minutes, the system selects a variance of 0 to 30 minutes. Typing a large number establishes a broad range and makes it less likely that client requests overlap. However, updates might be delayed significantly.
Important: If the "Turn off background refresh of Group Policy" setting is enabled, this setting is ignored.
Note: This setting establishes the update rate for user Group Policies. To set an update rate for computer Group Policies, use the "Group Policy refresh interval for computers" setting (located in Computer Configuration\Administrative Templates\System\Group Policy).
Tip: Consider notifying users that their policy is updated periodically so that they recognize the signs of a policy update. When Group Policy is updated, the Windows desktop is refreshed; it flickers briefly and closes open menus. Also, restrictions imposed by Group Policies, such as those that limit the programs a user can run, might interfere with tasks in progress.</string>
<string id="NewGPODisplayName">Set default name for new Group Policy objects</string>
<string id="NewGPODisplayName_Help">This policy setting allows you to set the default display name for new Group Policy objects.
This setting allows you to specify the default name for new Group Policy objects created from policy compliant Group Policy Management tools including the Group Policy tab in Active Directory tools and the GPO browser.
The display name can contain environment variables and can be a maximum of 255 characters long.
If this setting is Disabled or Not Configured, the default display name of New Group Policy object is used.</string>
<string id="NewGPOLinksDisabled">Create new Group Policy Object links disabled by default</string>
<string id="NewGPOLinksDisabled_Help">This policy setting allows you to create new Group Policy object links in the disabled state.
If you enable this setting, you can create all new Group Policy object links in the disabled state by default. After you configure and test the new object links by using a policy compliant Group Policy management tool such as Active Directory Users and Computers or Active Directory Sites and Services, you can enable the object links for use on the system.
If you disable this setting or do not configure it, new Group Policy object links are created in the enabled state. If you do not want them to be effective until they are configured and tested, you must disable the object link.</string>
<string id="OnlyUseLocalAdminFiles">Always use local ADM files for Group Policy Object Editor</string>
<string id="OnlyUseLocalAdminFiles_Help">This policy setting lets you always use local ADM files for the Group Policy snap-in.
By default, when you edit a Group Policy Object (GPO) using the Group Policy Object Editor snap-in, the ADM files are loaded from that GPO into the Group Policy Object Editor snap-in. This allows you to use the same version of the ADM files that were used to create the GPO while editing this GPO.
This leads to the following behavior:
- If you originally created the GPO with, for example, an English system, the GPO contains English ADM files.
- If you later edit the GPO from a different-language system, you get the English ADM files as they were in the GPO.
You can change this behavior by using this setting.
If you enable this setting, the Group Policy Object Editor snap-in always uses local ADM files in your %windir%\inf directory when editing GPOs.
This leads to the following behavior:
- If you had originally created the GPO with an English system, and then you edit the GPO with a Japanese system, the Group Policy Object Editor snap-in uses the local Japanese ADM files, and you see the text in Japanese under Administrative Templates.
If you disable or do not configure this setting, the Group Policy Object Editor snap-in always loads all ADM files from the actual GPO.
Note: If the ADMs that you require are not all available locally in your %windir%\inf directory, you might not be able to see all the settings that have been configured in the GPO that you are editing.</string>
<string id="PolicyPolicies">Group Policy</string>
<string id="RSoPLogging">Turn off Resultant Set of Policy logging</string>
<string id="RSoPLogging_Help">This setting allows you to enable or disable Resultant Set of Policy (RSoP) logging on a client computer.
RSoP logs information on Group Policy settings that have been applied to the client. This information includes details such as which Group Policy Objects (GPO) were applied, where they came from, and the client-side extension settings that were included.
If you enable this setting, RSoP logging is turned off.
If you disable or do not configure this setting, RSoP logging is turned on. By default, RSoP logging is always on.
Note: To view the RSoP information logged on a client computer, you can use the RSoP snap-in in the Microsoft Management Console (MMC).</string>
<string id="UserPolicyMode">Configure user Group Policy loopback processing mode</string>
<string id="UserPolicyMode_Help">This policy setting directs the system to apply the set of Group Policy objects for the computer to any user who logs on to a computer affected by this setting. It is intended for special-use computers, such as those in public places, laboratories, and classrooms, where you must modify the user setting based on the computer that is being used.
By default, the user's Group Policy Objects determine which user settings apply. If this setting is enabled, then, when a user logs on to this computer, the computer's Group Policy Objects determine which set of Group Policy Objects applies.
If you enable this setting, you can select one of the following modes from the Mode box:
"Replace" indicates that the user settings defined in the computer's Group Policy Objects replace the user settings normally applied to the user.
"Merge" indicates that the user settings defined in the computer's Group Policy Objects and the user settings normally applied to the user are combined. If the settings conflict, the user settings in the computer's Group Policy Objects take precedence over the user's normal settings.
If you disable this setting or do not configure it, the user's Group Policy Objects determines which user settings apply.
Note: This setting is effective only when both the computer account and the user account are in at least Windows 2000 domains.</string>
<string id="UserPolicyMode_Merge">Merge</string>
<string id="UserPolicyMode_Replace">Replace</string>
<string id="CorpConnSyncWaitTime">Specify workplace connectivity wait time for policy processing</string>
<string id="CorpConnSyncWaitTime_Help">This policy setting specifies how long Group Policy should wait for workplace connectivity notifications during startup policy processing. If the startup policy processing is synchronous, the computer is blocked until workplace connectivity is available or the wait time is reached. If the startup policy processing is asynchronous, the computer is not blocked and policy processing will occur in the background. In either case, configuring this policy setting overrides any system-computed wait times.
If you enable this policy setting, Group Policy uses this administratively configured maximum wait time for workplace connectivity, and overrides any default or system-computed wait time.
If you disable or do not configure this policy setting, Group Policy will use the default wait time of 60 seconds on computers running Windows operating systems greater than Windows 7 configured for workplace connectivity.</string>
</stringTable>
<presentationTable>
<presentation id="Font_List">
<dropdownList refId="FontMitigation_DL" defaultItem="0" noSort="true">Mitigation Options</dropdownList>
</presentation>
<presentation id="ProcessMitigationOptions_List">
<listBox refId="ProcessMitigationOptionsList">Process Mitigation Options</listBox>
</presentation>
<presentation id="FontProvidersPolicy">
<dropdownList refId="FontProvidersOption" noSort="true" defaultItem="0">The Windows Font Cache Service should be allowed to download fonts and font catalog data from online font providers.</dropdownList>
</presentation>
<presentation id="SyncModeThreshold">
<decimalTextBox refId="SyncModeSlowLinkThreshold1" defaultValue="500">Slow link value:[number field] milliseconds</decimalTextBox>
<decimalTextBox refId="SyncModeNoDCThreshold1" defaultValue="5000">Timeout value: [number field] milliseconds</decimalTextBox>
</presentation>
<presentation id="LogonScriptDelay">
<decimalTextBox refId="AsyncScriptDelay1" defaultValue="5">minute:</decimalTextBox>
</presentation>
<presentation id="SyncWaitTime">
<decimalTextBox refId="SyncWaitTime_Minutes" defaultValue="120">Amount of time to wait (in seconds):</decimalTextBox>
</presentation>
<presentation id="CSE_AppMgmt">
<checkBox refId="CSE_SLOWLINK1">Allow processing across a slow network connection</checkBox>
<checkBox refId="CSE_NOCHANGES1">Process even if the Group Policy objects have not changed</checkBox>
</presentation>
<presentation id="CSE_DiskQuota">
<checkBox refId="CSE_SLOWLINK2">Allow processing across a slow network connection</checkBox>
<checkBox refId="CSE_NOBACKGROUND2">Do not apply during periodic background processing</checkBox>
<checkBox refId="CSE_NOCHANGES2">Process even if the Group Policy objects have not changed</checkBox>
</presentation>
<presentation id="CSE_EFSRecovery">
<checkBox refId="CSE_SLOWLINK3">Allow processing across a slow network connection</checkBox>
<checkBox refId="CSE_NOBACKGROUND3">Do not apply during periodic background processing</checkBox>
<checkBox refId="CSE_NOCHANGES3">Process even if the Group Policy objects have not changed</checkBox>
</presentation>
<presentation id="CSE_FolderRedirection">
<checkBox refId="CSE_SLOWLINK4">Allow processing across a slow network connection</checkBox>
<checkBox refId="CSE_NOCHANGES4">Process even if the Group Policy objects have not changed</checkBox>
</presentation>
<presentation id="CSE_IEM">
<checkBox refId="CSE_SLOWLINK5">Allow processing across a slow network connection</checkBox>
<checkBox refId="CSE_NOBACKGROUND5">Do not apply during periodic background processing</checkBox>
<checkBox refId="CSE_NOCHANGES5">Process even if the Group Policy objects have not changed</checkBox>
</presentation>
<presentation id="CSE_IPSecurity">
<checkBox refId="CSE_SLOWLINK6">Allow processing across a slow network connection</checkBox>
<checkBox refId="CSE_NOBACKGROUND6">Do not apply during periodic background processing</checkBox>
<checkBox refId="CSE_NOCHANGES6">Process even if the Group Policy objects have not changed</checkBox>
</presentation>
<presentation id="CSE_Registry">
<checkBox refId="CSE_NOBACKGROUND10">Do not apply during periodic background processing</checkBox>
<checkBox refId="CSE_NOCHANGES10">Process even if the Group Policy objects have not changed</checkBox>
</presentation>
<presentation id="CSE_Scripts">
<checkBox refId="CSE_SLOWLINK7">Allow processing across a slow network connection</checkBox>
<checkBox refId="CSE_NOBACKGROUND7">Do not apply during periodic background processing</checkBox>
<checkBox refId="CSE_NOCHANGES7">Process even if the Group Policy objects have not changed</checkBox>
</presentation>
<presentation id="CSE_Security">
<checkBox refId="CSE_NOBACKGROUND11">Do not apply during periodic background processing</checkBox>
<checkBox refId="CSE_NOCHANGES11">Process even if the Group Policy objects have not changed</checkBox>
</presentation>
<presentation id="CSE_Wired">
<checkBox refId="CSE_SLOWLINK8">Allow processing across a slow network connection</checkBox>
<checkBox refId="CSE_NOBACKGROUND8">Do not apply during periodic background processing</checkBox>
<checkBox refId="CSE_NOCHANGES8">Process even if the Group Policy objects have not changed</checkBox>
</presentation>
<presentation id="CSE_Wireless">
<checkBox refId="CSE_SLOWLINK9">Allow processing across a slow network connection</checkBox>
<checkBox refId="CSE_NOBACKGROUND9">Do not apply during periodic background processing</checkBox>
<checkBox refId="CSE_NOCHANGES9">Process even if the Group Policy objects have not changed</checkBox>
</presentation>
<presentation id="GPDCOptions">
<dropdownList refId="GPDCOptionsDesc" noSort="true" defaultItem="0">When Group Policy Object Editor is selecting a domain controller to use, it should:</dropdownList>
</presentation>
<presentation id="GPTransferRate_1">
<decimalTextBox refId="TransferRateOp1" defaultValue="500" spinStep="100">Connection speed (Kbps):</decimalTextBox>
<text> </text>
<text>Enter 0 to disable slow link detection.</text>
</presentation>
<presentation id="GPTransferRate_2">
<decimalTextBox refId="TransferRateOp2" defaultValue="500" spinStep="100">Connection speed (Kbps):</decimalTextBox>
<text> </text>
<text>Enter 0 to disable slow link detection.</text>
<checkBox refId="CSE_3G_DEFAULT_TO_SLOWLINK_COMPUTER">Always treat WWAN connections as a slow link</checkBox>
</presentation>
<presentation id="GroupPolicyRefreshRate">
<text>This setting allows you to customize how often Group Policy is applied</text>
<text>to computers. The range is 0 to 44640 minutes (31 days).</text>
<decimalTextBox refId="GPRefreshRate1" defaultValue="90">Minutes:</decimalTextBox>
<text> </text>
<text>This is a random time added to the refresh interval to prevent</text>
<text>all clients from requesting Group Policy at the same time.</text>
<text>The range is 0 to 1440 minutes (24 hours)</text>
<decimalTextBox refId="GPRefreshRateOffset1" defaultValue="30">Minutes:</decimalTextBox>
</presentation>
<presentation id="GroupPolicyRefreshRateDC">
<text>This setting allows you to customize how often Group Policy is applied</text>
<text>to domain controllers. The range is 0 to 44640 minutes (31 days).</text>
<decimalTextBox refId="GPRefreshRate2" defaultValue="5">Minutes:</decimalTextBox>
<text> </text>
<text>This is a random time added to the refresh interval to prevent</text>
<text>all clients from requesting Group Policy at the same time.</text>
<text>The range is 0 to 1440 minutes (24 hours)</text>
<decimalTextBox refId="GPRefreshRateOffset2" defaultValue="0">Minutes:</decimalTextBox>
</presentation>
<presentation id="GroupPolicyRefreshRateUser">
<text>This setting allows you to customize how often Group Policy is applied</text>
<text>to users. The range is 0 to 44640 minutes (31 days).</text>
<decimalTextBox refId="GPRefreshRate3" defaultValue="90">Minutes:</decimalTextBox>
<text> </text>
<text>This is a random time added to the refresh interval to prevent</text>
<text>all clients from requesting Group Policy at the same time.</text>
<text>The range is 0 to 1440 minutes (24 hours)</text>
<decimalTextBox refId="GPRefreshRateOffset3" defaultValue="30">Minutes:</decimalTextBox>
</presentation>
<presentation id="NewGPODisplayName">
<textBox refId="NewGPODisplayNameHeading">
<label>GPO Name:</label>
</textBox>
</presentation>
<presentation id="UserPolicyMode">
<dropdownList refId="UserPolicyModeOp" noSort="true" defaultItem="1">Mode:</dropdownList>
</presentation>
<presentation id="CorpConnSyncWaitTime">
<decimalTextBox refId="CorpConnSyncWaitTime_Seconds" defaultValue="60">Amount of time to wait (in seconds):</decimalTextBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/Handwriting.adml
+13
View File
@@ -0,0 +1,13 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Windows Ink Workspace</displayName>
<description>Windows Ink Workspace</description>
<resources>
<stringTable>
<string id="Handwriting">Handwriting</string>
<string id="PanelDefaultModeDocked">Handwriting Panel Default Mode Docked</string>
<string id="PanelDefaultModeDocked_Help">The handwriting panel has 2 modes - floats near the text box, or, attached to the bottom of the screen. Default is floating near text box. If you want the panel to be fixed, use this policy to fix it to the bottom.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/Help.adml
+71
View File
@@ -0,0 +1,71 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="HelpQualifiedRootDir_Comp">Restrict potentially unsafe HTML Help functions to specified folders</string>
<string id="HelpQualifiedRootDir_Help">This policy setting allows you to restrict certain HTML Help commands to function only in HTML Help (.chm) files within specified folders and their subfolders. Alternatively, you can disable these commands on the entire system. It is strongly recommended that only folders requiring administrative privileges be added to this policy setting.
If you enable this policy setting, the commands function only for .chm files in the specified folders and their subfolders.
To restrict the commands to one or more folders, enable the policy setting and enter the desired folders in the text box on the Settings tab of the Policy Properties dialog box. Use a semicolon to separate folders. For example, to restrict the commands to only .chm files in the %windir%\help folder and D:\somefolder, add the following string to the edit box: "%windir%\help;D:\somefolder".
Note: An environment variable may be used, (for example, %windir%), as long as it is defined on the system. For example, %programfiles% is not defined on some early versions of Windows.
The "Shortcut" command is used to add a link to a Help topic, and runs executables that are external to the Help file. The "WinHelp" command is used to add a link to a Help topic, and runs a WinHLP32.exe Help (.hlp) file.
To disallow the "Shortcut" and "WinHelp" commands on the entire local system, enable the policy setting and leave the text box on the Settings tab of the Policy Properties dialog box blank.
If you disable or do not configure this policy setting, these commands are fully functional for all Help files.
Note: Only folders on the local computer can be specified in this policy setting. You cannot use this policy setting to enable the "Shortcut" and "WinHelp" commands for .chm files that are stored on mapped drives or accessed using UNC paths.
For additional options, see the "Restrict these programs from being launched from Help" policy.
</string>
<string id="RestrictRunFromHelp">Restrict these programs from being launched from Help</string>
<string id="RestrictRunFromHelp_Comp">Restrict these programs from being launched from Help</string>
<string id="RestrictRunFromHelp_Help">
This policy setting allows you to restrict programs from being run from online Help.
If you enable this policy setting, you can prevent specified programs from being run from Help. When you enable this policy setting, enter the file names names of the programs you want to restrict, separated by commas.
If you disable or do not configure this policy setting, users can run all applications from online Help.
Note: You can also restrict users from running applications by using the Software Restriction Policy settings available in Computer Configuration\Security Settings.
Note: This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help
</string>
<string id="DisableHHDEP">Turn off Data Execution Prevention for HTML Help Executible</string>
<string id="DisableHHDEPText">This policy setting allows you to exclude HTML Help Executable from being monitored by software-enforced Data Execution Prevention.
Data Execution Prevention (DEP) is designed to block malicious code that takes advantage of exception-handling mechanisms in Windows by monitoring your programs to make sure that they use system memory safely.
If you enable this policy setting, DEP for HTML Help Executable is turned off. This will allow certain legacy ActiveX controls to function without DEP shutting down HTML Help Executable.
If you disable or do not configure this policy setting, DEP is turned on for HTML Help Executable. This provides an additional security benefit, but HTLM Help stops if DEP detects system memory abnormalities.
</string>
</stringTable>
<presentationTable>
<presentation id="HelpQualifiedRootDir_Comp">
<textBox refId="HelpQualifiedRootDir_Edit">
<label>Enter folder names separated by semi-colons:</label>
</textBox>
<text>Example: %windir%\Help;%windir%\pchealth;%programfiles%</text>
</presentation>
<presentation id="RestrictRunFromHelp">
<textBox refId="RestrictRunFromHelp_Edit">
<label>Enter executables separated by commas:</label>
</textBox>
<text>Example: calc.exe,paint.exe</text>
</presentation>
<presentation id="RestrictRunFromHelp_Comp">
<textBox refId="RestrictRunFromHelp_Edit">
<label>Enter executables separated by commas:</label>
</textBox>
<text>Example: calc.exe,paint.exe</text>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/HelpAndSupport.adml
+38
View File
@@ -0,0 +1,38 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Online Assistance</displayName>
<description>Online Assistance</description>
<resources>
<stringTable>
<string id="Assistance">Online Assistance</string>
<string id="windowscomponents">Windows Components</string>
<string id="ActiveHelpPolicy_Explain">This policy setting specifies whether active content links in trusted assistance content are rendered. By default, the Help viewer renders trusted assistance content with active elements such as ShellExecute links and Guided Help links.
If you enable this policy setting, active content links are not rendered. The text is displayed, but there are no clickable links for these elements.
If you disable or do not configure this policy setting, the default behavior applies (Help viewer renders trusted assistance content with active elements).</string>
<string id="ActiveHelp">Turn off Active Help</string>
<string id="HPExplicitFeedback">Turn off Help Ratings</string>
<string id="HPExplicitFeedbackPolicy_Explain">This policy setting specifies whether users can provide ratings for Help content.
If you enable this policy setting, ratings controls are not added to Help content.
If you disable or do not configure this policy setting, ratings controls are added to Help topics.
Users can use the control to provide feedback on the quality and usefulness of the Help and Support content.</string>
<string id="HPImplicitFeedback">Turn off Help Experience Improvement Program</string>
<string id="HPImplicitFeedbackPolicy_Explain">This policy setting specifies whether users can participate in the Help Experience Improvement program. The Help Experience Improvement program collects information about how customers use Windows Help so that Microsoft can improve it.
If you enable this policy setting, users cannot participate in the Help Experience Improvement program.
If you disable or do not configure this policy setting, users can turn on the Help Experience Improvement program feature from the Help and Support settings page.</string>
<string id="HPOnlineAssistance">Turn off Windows Online</string>
<string id="HPOnlineAssistancePolicy_Explain">This policy setting specifies whether users can search and view content from Windows Online in Help and Support. Windows Online provides the most up-to-date Help content for Windows.
If you enable this policy setting, users are prevented from accessing online assistance content from Windows Online.
If you disable or do not configure this policy setting, users can access online assistance if they have a connection to the Internet and have not disabled Windows Online from the Help and Support Options page.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/ICM.adml
+198
View File
@@ -0,0 +1,198 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="CertMgr_DisableAutoRootUpdates">Turn off Automatic Root Certificates Update</string>
<string id="CertMgr_DisableAutoRootUpdates_Help">This policy setting specifies whether to automatically update root certificates using the Windows Update website.
Typically, a certificate is used when you use a secure website or when you send and receive secure email. Anyone can issue certificates, but to have transactions that are as secure as possible, certificates must be issued by a trusted certificate authority (CA). Microsoft has included a list in Windows XP and other products of companies and organizations that it considers trusted authorities.
If you enable this policy setting, when you are presented with a certificate issued by an untrusted root authority, your computer will not contact the Windows Update website to see if Microsoft has added the CA to its list of trusted authorities.
If you disable or do not configure this policy setting, your computer will contact the Windows Update website.</string>
<string id="DisableHTTPPrinting">Turn off printing over HTTP</string>
<string id="DisableHTTPPrinting_Help">This policy setting specifies whether to allow printing over HTTP from this client.
Printing over HTTP allows a client to print to printers on the intranet as well as the Internet.
Note: This policy setting affects the client side of Internet printing only. It does not prevent this computer from acting as an Internet Printing server and making its shared printers available via HTTP.
If you enable this policy setting, it prevents this client from printing to Internet printers over HTTP.
If you disable or do not configure this policy setting, users can choose to print to Internet printers over HTTP.
Also, see the "Web-based printing" policy setting in Computer Configuration/Administrative Templates/Printers.</string>
<string id="DisableWebPnPDownload">Turn off downloading of print drivers over HTTP</string>
<string id="DisableWebPnPDownload_Help">This policy setting specifies whether to allow this client to download print driver packages over HTTP.
To set up HTTP printing, non-inbox drivers need to be downloaded over HTTP.
Note: This policy setting does not prevent the client from printing to printers on the Intranet or the Internet over HTTP. It only prohibits downloading drivers that are not already installed locally.
If you enable this policy setting, print drivers cannot be downloaded over HTTP.
If you disable or do not configure this policy setting, users can download print drivers over HTTP.</string>
<string id="DriverSearchPlaces_DontSearchWindowsUpdate">Turn off Windows Update device driver searching</string>
<string id="DriverSearchPlaces_DontSearchWindowsUpdate_Help">This policy setting specifies whether Windows searches Windows Update for device drivers when no local drivers for a device are present.
If you enable this policy setting, Windows Update is not searched when a new device is installed.
If you disable this policy setting, Windows Update is always searched for drivers when no local drivers are present.
If you do not configure this policy setting, searching Windows Update is optional when installing a device.
Also see "Turn off Windows Update device driver search prompt" in "Administrative Templates/System," which governs whether an administrator is prompted before searching Windows Update for device drivers if a driver is not found locally.
Note: This policy setting is replaced by "Specify Driver Source Search Order" in "Administrative Templates/System/Device Installation" on newer versions of Windows.</string>
<string id="EventViewer_DisableLinks">Turn off Event Viewer "Events.asp" links</string>
<string id="EventViewer_DisableLinks_Help">This policy setting specifies whether "Events.asp" hyperlinks are available for events within the Event Viewer application.
The Event Viewer normally makes all HTTP(S) URLs into hyperlinks that activate the Internet browser when clicked. In addition, "More Information" is placed at the end of the description text if the event is created by a Microsoft component. This text contains a link (URL) that, if clicked, sends information about the event to Microsoft, and allows users to learn more about why that event occurred.
If you enable this policy setting, event description hyperlinks are not activated and the text "More Information" is not displayed at the end of the description.
If you disable or do not configure this policy setting, the user can click the hyperlink, which prompts the user and then sends information about the event over the Internet to Microsoft. Also, see "Events.asp URL", "Events.asp program", and "Events.asp Program Command Line Parameters" settings in "Administrative Templates/Windows Components/Event Viewer".</string>
<string id="HSS_HeadlinesPolicy">Turn off Help and Support Center "Did you know?" content</string>
<string id="HSS_HeadlinesPolicy_Help">This policy setting specifies whether to show the "Did you know?" section of Help and Support Center.
This content is dynamically updated when users who are connected to the Internet open Help and Support Center, and provides up-to-date information about Windows and the computer.
If you enable this policy setting, the Help and Support Center no longer retrieves nor displays "Did you know?" content.
If you disable or do not configure this policy setting, the Help and Support Center retrieves and displays "Did you know?" content.
You might want to enable this policy setting for users who do not have Internet access, because the content in the "Did you know?" section will remain static indefinitely without an Internet connection.</string>
<string id="HSS_KBSearchPolicy">Turn off Help and Support Center Microsoft Knowledge Base search</string>
<string id="HSS_KBSearchPolicy_Help">This policy setting specifies whether users can perform a Microsoft Knowledge Base search from the Help and Support Center.
The Knowledge Base is an online source of technical support information and self-help tools for Microsoft products, and is searched as part of all Help and Support Center searches with the default search options.
If you enable this policy setting, it removes the Knowledge Base section from the Help and Support Center "Set search options" page, and only Help content on the local computer is searched.
If you disable or do not configure this policy setting, the Knowledge Base is searched if the user has a connection to the Internet and has not disabled the Knowledge Base search from the Search Options page.</string>
<string id="InternetManagement_RestrictCommunication">Restrict Internet communication</string>
<string id="InternetManagement_RestrictCommunication_Help">This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources.
If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet.
If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet.
If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured.</string>
<string id="NC_ExitOnISP">Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com</string>
<string id="NC_ExitOnISP_Help">This policy setting specifies whether the Internet Connection Wizard can connect to Microsoft to download a list of Internet Service Providers (ISPs).
If you enable this policy setting, the "Choose a list of Internet Service Providers" path in the Internet Connection Wizard causes the wizard to exit. This prevents users from retrieving the list of ISPs, which resides on Microsoft servers.
If you disable or do not configure this policy setting, users can connect to Microsoft to download a list of ISPs for their area.</string>
<string id="NC_NoRegistration">Turn off Registration if URL connection is referring to Microsoft.com</string>
<string id="NC_NoRegistration_Help">This policy setting specifies whether the Windows Registration Wizard connects to Microsoft.com for online registration.
If you enable this policy setting, it blocks users from connecting to Microsoft.com for online registration and users cannot register their copy of Windows online.
If you disable or do not configure this policy setting, users can connect to Microsoft.com to complete the online Windows Registration.
Note that registration is optional and involves submitting some personal information to Microsoft. However, Windows Product Activation is required but does not involve submitting any personal information (except the country/region you live in).</string>
<string id="PCH_DoNotReport">Turn off Windows Error Reporting</string>
<string id="PCH_DoNotReport_Help">This policy setting controls whether or not errors are reported to Microsoft.
Error Reporting is used to report information about a system or application that has failed or has stopped responding and is used to improve the quality of the product.
If you enable this policy setting, users are not given the option to report errors.
If you disable or do not configure this policy setting, the errors may be reported to Microsoft via the Internet or to a corporate file share.
This policy setting overrides any user setting made from the Control Panel for error reporting.
Also see the "Configure Error Reporting", "Display Error Notification" and "Disable Windows Error Reporting" policy settings under Computer Configuration/Administrative Templates/Windows Components/Windows Error Reporting.</string>
<string id="RemoveWindowsUpdate_ICM">Turn off access to all Windows Update features</string>
<string id="RemoveWindowsUpdate_ICM_Help">This policy setting allows you to remove access to Windows Update.
If you enable this policy setting, all Windows Update features are removed. This includes blocking access to the Windows Update website at http://windowsupdate.microsoft.com, from the Windows Update hyperlink on the Start menu, and also on the Tools menu in Internet Explorer. Windows automatic updating is also disabled; you will neither be notified about nor will you receive critical updates from Windows Update. This policy setting also prevents Device Manager from automatically installing driver updates from the Windows Update website.
If you disable or do not configure this policy setting, users can access the Windows Update website and enable automatic updating to receive notifications and critical updates from Windows Update.
Note: This policy applies only when this PC is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy.</string>
<string id="SearchCompanion_DisableFileUpdates">Turn off Search Companion content file updates</string>
<string id="SearchCompanion_DisableFileUpdates_Help">This policy setting specifies whether Search Companion should automatically download content updates during local and Internet searches.
When users search the local computer or the Internet, Search Companion occasionally connects to Microsoft to download an updated privacy policy and additional content files used to format and display results.
If you enable this policy setting, Search Companion does not download content updates during searches.
If you disable or do not configure this policy setting, Search Companion downloads content updates unless the user is using Classic Search.
Note: Internet searches still send the search text and information about the search to Microsoft and the chosen search provider. Choosing Classic Search turns off the Search Companion feature completely.</string>
<string id="ShellNoUseInternetOpenWith">Turn off Internet File Association service</string>
<string id="ShellNoUseInternetOpenWith_Help">This policy setting specifies whether to use the Microsoft Web service for finding an application to open a file with an unhandled file association.
When a user opens a file that has an extension that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Web service to find an application.
If you enable this policy setting, the link and the dialog for using the Web service to open an unhandled file association are removed.
If you disable or do not configure this policy setting, the user is allowed to use the Web service.</string>
<string id="ShellNoUseStoreOpenWith">Turn off access to the Store</string>
<string id="ShellNoUseStoreOpenWith_Help">This policy setting specifies whether to use the Store service for finding an application to open a file with an unhandled file type or protocol association.
When a user opens a file type or protocol that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Store service to find an application.
If you enable this policy setting, the "Look for an app in the Store" item in the Open With dialog is removed.
If you disable or do not configure this policy setting, the user is allowed to use the Store service and the Store item is available in the Open With dialog.</string>
<string id="ShellPreventWPWDownload">Turn off Internet download for Web publishing and online ordering wizards</string>
<string id="ShellPreventWPWDownload_Help">This policy setting specifies whether Windows should download a list of providers for the web publishing and online ordering wizards.
These wizards allow users to select from a list of companies that provide services such as online storage and photographic printing. By default, Windows displays providers downloaded from a Windows website in addition to providers specified in the registry.
If you enable this policy setting, Windows does not download providers, and only the service providers that are cached in the local registry are displayed.
If you disable or do not configure this policy setting, a list of providers are downloaded when the user uses the web publishing or online ordering wizards.
See the documentation for the web publishing and online ordering wizards for more information, including details on specifying service providers in the registry.</string>
<string id="ShellRemoveOrderPrints">Turn off the "Order Prints" picture task</string>
<string id="ShellRemoveOrderPrints_Help">This policy setting specifies whether the "Order Prints Online" task is available from Picture Tasks in Windows folders.
The Order Prints Online Wizard is used to download a list of providers and allow users to order prints online.
If you enable this policy setting, the task "Order Prints Online" is removed from Picture Tasks in File Explorer folders.
If you disable or do not configure this policy setting, the task is displayed.</string>
<string id="ShellRemovePublishToWeb">Turn off the "Publish to Web" task for files and folders</string>
<string id="ShellRemovePublishToWeb_Help">This policy setting specifies whether the tasks "Publish this file to the Web," "Publish this folder to the Web," and "Publish the selected items to the Web" are available from File and Folder Tasks in Windows folders.
The Web Publishing Wizard is used to download a list of providers and allow users to publish content to the web.
If you enable this policy setting, these tasks are removed from the File and Folder tasks in Windows folders.
If you disable or do not configure this policy setting, the tasks are shown.</string>
<string id="WinMSG_NoInstrumentation">Turn off the Windows Messenger Customer Experience Improvement Program</string>
<string id="WinMSG_NoInstrumentation_Help">This policy setting specifies whether Windows Messenger collects anonymous information about how Windows Messenger software and service is used.
With the Customer Experience Improvement program, users can allow Microsoft to collect anonymous information about how the product is used. This information is used to improve the product in future releases.
If you enable this policy setting, Windows Messenger does not collect usage information, and the user settings to enable the collection of usage information are not shown.
If you disable this policy setting, Windows Messenger collects anonymous usage information, and the setting is not shown.
If you do not configure this policy setting, users have the choice to opt in and allow information to be collected.</string>
<string id="CEIPEnable">Turn off Windows Customer Experience Improvement Program</string>
<string id="CEIPEnableExp">This policy setting turns off the Windows Customer Experience Improvement Program. The Windows Customer Experience Improvement Program collects information about your hardware configuration and how you use our software and services to identify trends and usage patterns. Microsoft will not collect your name, address, or any other personally identifiable information. There are no surveys to complete, no salesperson will call, and you can continue working without interruption. It is simple and user-friendly.
If you enable this policy setting, all users are opted out of the Windows Customer Experience Improvement Program.
If you disable this policy setting, all users are opted into the Windows Customer Experience Improvement Program.
If you do not configure this policy setting, the administrator can use the Problem Reports and Solutions component in Control Panel to enable Windows Customer Experience Improvement Program for all users.</string>
<string id="NoActiveProbe">Turn off Windows Network Connectivity Status Indicator active tests</string>
<string id="NoActiveProbeExp">This policy setting turns off the active tests performed by the Windows Network Connectivity Status Indicator (NCSI) to determine whether your computer is connected to the Internet or to a more limited network.
As part of determining the connectivity level, NCSI performs one of two active tests: downloading a page from a dedicated Web server or making a DNS request for a dedicated address.
If you enable this policy setting, NCSI does not run either of the two active tests. This may reduce the ability of NCSI, and of other components that use NCSI, to determine Internet access.
If you disable or do not configure this policy setting, NCSI runs one of the two active tests.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/IIS.adml
+13
View File
@@ -0,0 +1,13 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="IIS">Internet Information Services</string>
<string id="PreventIISInstall">Prevent IIS installation</string>
<string id="PreventIISInstall_Help">"This policy setting prevents installation of Internet Information Services (IIS) on this computer. If you enable this policy setting, Internet Information Services (IIS) cannot be installed, and you will not be able to install Windows components or applications that require IIS. Users installing Windows components or applications that require IIS might not receive a warning that IIS cannot be installed because of this Group Policy setting. Enabling this setting will not have any effect on IIS if IIS is already installed on the computer. If you disable or do not configure this policy setting, IIS can be installed, as well as all the programs and applications that require IIS to run."</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/InetRes.adml
+4914
View File
File diff suppressed because it is too large. Load diff
policy_templates/en-US/KDC.adml
+151
View File
@@ -0,0 +1,151 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>KDC Settings</displayName>
<description>Configuration settings for the Kerberos Key Distribution Center.</description>
<resources>
<stringTable>
<string id="KDC">KDC</string>
<string id="forestsearch">Use forest search order</string>
<string id="forestsearch_explain">This policy setting defines the list of trusting forests that the Key Distribution Center (KDC) searches when attempting to resolve two-part service principal names (SPNs).
If you enable this policy setting, the KDC will search the forests in this list if it is unable to resolve a two-part SPN in the local forest. The forest search is performed by using a global catalog or name suffix hints. If a match is found, the KDC will return a referral ticket to the client for the appropriate domain.
If you disable or do not configure this policy setting, the KDC will not search the listed forests to resolve the SPN. If the KDC is unable to resolve the SPN because the name is not found, NTLM authentication might be used.
To ensure consistent behavior, this policy setting must be supported and set identically on all domain controllers in the domain.</string>
<string id="emitlili">Provide information about previous logons to client computers</string>
<string id="emitlili_explain">This policy setting controls whether the domain controller provides information about previous logons to client computers.
If you enable this policy setting, the domain controller provides the information message about previous logons.
For Windows Logon to leverage this feature, the "Display information about previous logons during user logon" policy setting located in the Windows Logon Options node under Windows Components also needs to be enabled.
If you disable or do not configure this policy setting, the domain controller does not provide information about previous logons unless the "Display information about previous logons during user logon" policy setting is enabled.
Note: Information about previous logons is provided only if the domain functional level is Windows Server 2008. In domains with a domain functional level of Windows Server 2003, Windows 2000 native, or Windows 2000 mixed, domain controllers cannot provide information about previous logons, and enabling this policy setting does not affect anything.
</string>
<string id="CbacAndArmor">KDC support for claims, compound authentication and Kerberos armoring</string>
<string id="CbacAndArmor_explain">This policy setting allows you to configure a domain controller to support claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication.
If you enable this policy setting, client computers that support claims and compound authentication for Dynamic Access Control and are Kerberos armor-aware will use this feature for Kerberos authentication messages. This policy should be applied to all domain controllers to ensure consistent application of this policy in the domain.
If you disable or do not configure this policy setting, the domain controller does not support claims, compound authentication or armoring.
If you configure the "Not supported" option, the domain controller does not support claims, compound authentication or armoring which is the default behavior for domain controllers running Windows Server 2008 R2 or earlier operating systems.
Note: For the following options of this KDC policy to be effective, the Kerberos Group Policy "Kerberos client support for claims, compound authentication and Kerberos armoring" must be enabled on supported systems. If the Kerberos policy setting is not enabled, Kerberos authentication messages will not use these features.
If you configure "Supported", the domain controller supports claims, compound authentication and Kerberos armoring. The domain controller advertises to Kerberos client computers that the domain is capable of claims and compound authentication for Dynamic Access Control and Kerberos armoring.
Domain functional level requirements
For the options "Always provide claims" and "Fail unarmored authentication requests", when the domain functional level is set to Windows Server 2008 R2 or earlier then domain controllers behave as if the "Supported" option is selected.
When the domain functional level is set to Windows Server 2012 then the domain controller advertises to Kerberos client computers that the domain is capable of claims and compound authentication for Dynamic Access Control and Kerberos armoring, and:
- If you set the "Always provide claims" option, always returns claims for accounts and supports the RFC behavior for advertising the flexible authentication secure tunneling (FAST).
- If you set the "Fail unarmored authentication requests" option, rejects unarmored Kerberos messages.
Warning: When "Fail unarmored authentication requests" is set, then client computers which do not support Kerberos armoring will fail to authenticate to the domain controller.
To ensure this feature is effective, deploy enough domain controllers that support claims and compound authentication for Dynamic Access Control and are Kerberos armor-aware to handle the authentication requests. Insufficient number of domain controllers that support this policy result in authentication failures whenever Dynamic Access Control or Kerberos armoring is required (that is, the "Supported" option is enabled).
Impact on domain controller performance when this policy setting is enabled:
- Secure Kerberos domain capability discovery is required resulting in additional message exchanges.
- Claims and compound authentication for Dynamic Access Control increases the size and complexity of the data in the message which results in more processing time and greater Kerberos service ticket size.
- Kerberos armoring fully encrypts Kerberos messages and signs Kerberos errors which results in increased processing time, but does not change the service ticket size.
</string>
<string id="NoCbacAndArmor">Not supported</string>
<string id="MixModeCbacAndArmor">Supported</string>
<string id="FullModeCbacAndArmor">Always provide claims</string>
<string id="FullModeCbacAndRequireArmor">Fail unarmored authentication requests</string>
<string id="TicketSizeThreshold">Warning for large Kerberos tickets</string>
<string id="TicketSizeThreshold_explain">This policy setting allows you to configure at what size Kerberos tickets will trigger the warning event issued during Kerberos authentication. The ticket size warnings are logged in the System log.
If you enable this policy setting, you can set the threshold limit for Kerberos ticket which trigger the warning events. If set too high, then authentication failures might be occurring even though warning events are not being logged. If set too low, then there will be too many ticket warnings in the log to be useful for analysis. This value should be set to the same value as the Kerberos policy "Set maximum Kerberos SSPI context token buffer size" or the smallest MaxTokenSize used in your environment if you are not configuring using Group Policy.
If you disable or do not configure this policy setting, the threshold value defaults to 12,000 bytes, which is the default Kerberos MaxTokenSize for Windows 7, Windows Server 2008 R2 and prior versions.
</string>
<string id="RequestCompoundId">Request compound authentication</string>
<string id="RequestCompoundId_explain">This policy setting allows you to configure a domain controller to request compound authentication.
Note: For a domain controller to request compound authentication, the policy "KDC support for claims, compound authentication, and Kerberos armoring" must be configured and enabled.
If you enable this policy setting, domain controllers will request compound authentication. The returned service ticket will contain compound authentication only when the account is explicitly configured. This policy should be applied to all domain controllers to ensure consistent application of this policy in the domain.
If you disable or do not configure this policy setting, domain controllers will return service tickets that contain compound authentication any time the client sends a compound authentication request regardless of the account configuration.
</string>
<string id="PKINITFreshness">KDC support for PKInit Freshness Extension</string>
<string id="PKINITFreshness_explain">Support for PKInit Freshness Extension requires Windows Server 2016 domain functional level (DFL). If the domain controller’s domain is not at Windows Server 2016 DFL or higher this policy will not be applied.
This policy setting allows you to configure a domain controller (DC) to support the PKInit Freshness Extension.
If you enable this policy setting, the following options are supported:
Supported: PKInit Freshness Extension is supported on request. Kerberos clients successfully authenticating with the PKInit Freshness Extension will get the fresh public key identity SID.
Required: PKInit Freshness Extension is required for successful authentication. Kerberos clients which do not support the PKInit Freshness Extension will always fail when using public key credentials.
If you disable or not configure this policy setting, then the DC will never offer the PKInit Freshness Extension and accept valid authentication requests without checking for freshness. Users will never receive the fresh public key identity SID.
</string>
<string id="NoPKINITFreshness">Disabled</string>
<string id="SupportPKINITFreshness">Supported</string>
<string id="RequirePKINITFreshness">Required</string>
<string id="PKINITHashAlgorithmConfiguration">Configure hash algorithms for certificate logon</string>
<string id="PKINITHashAlgorithmConfiguration_explain">This policy setting controls hash or checksum algorithms used by the Kerberos client when performing certificate authentication.
If you enable this policy, you will be able to configure one of four states for each algorithm:
- “Default” sets the algorithm to the recommended state.
- “Supported” enables usage of the algorithm. Enabling algorithms that have been disabled by default may reduce your security.
- “Audited” enables usage of the algorithm and reports an event (ID 309) every time it is used. This state is intended to verify that the algorithm is not being used and can be safely disabled.
- “Not Supported” disables usage of the algorithm. This state is intended for algorithms that are deemed to be insecure.
If you disable or do not configure this policy, each algorithm will assume the “Default” state.
More information about the hash and checksum algorithms supported by the Windows Kerberos client and their default states can be found at https://go.microsoft.com/fwlink/?linkid=2169037.
Events generated by this configuration: 309, 310.
</string>
<string id="PKINITHashAlgorithm_Default">Default</string>
<string id="PKINITHashAlgorithm_Supported">Supported</string>
<string id="PKINITHashAlgorithm_Audited">Audited</string>
<string id="PKINITHashAlgorithm_NotSupported">Not Supported</string>
</stringTable>
<presentationTable>
<presentation id="emitlili">
<dropdownList refId="emitliliOp" oSort="true" defaultItem="0">Mode:</dropdownList>
</presentation>
<presentation id="ForestSearch">
<textBox refId="ForestSearchList">
<label>Forests to Search</label>
</textBox>
<text>Syntax:</text>
<text>Enter the list of forests to be searched when this policy is enabled.</text>
<text>Use the Fully Qualified Domain Name (FQDN) naming format.</text>
<text>Separate multiple search entries with a semi-colon ";".</text>
<text>Details:</text>
<text>The current forest need not be listed because Forest Search Order uses the global catalog first then searches in the order listed.</text>
<text>You do not need to separately list all the domains in the forest.</text>
<text>If a trusting forest is listed, all the domains in that forest will be searched.</text>
<text>For best performance, list the forests in probability of success order.</text>
</presentation>
<presentation id="CbacAndArmor">
<dropdownList refId="CbacAndArmor_Levels" noSort="true" defaultItem="1">Claims, compound authentication for Dynamic Access Control and Kerberos armoring options:</dropdownList>
</presentation>
<presentation id="TicketSizeThreshold">
<decimalTextBox refId="TicketSizeThreshold" defaultValue="12000" spinStep="1000">Ticket Size Threshold</decimalTextBox>
</presentation>
<presentation id="PKINITFreshness">
<dropdownList refId="PKINITFreshness_Levels" noSort="true" defaultItem="1">PKInit Freshness Extension options:</dropdownList>
</presentation>
<presentation id="PKINITHashAlgorithmConfiguration">
<dropdownList refId="PKINITHashAlgorithmSHA1" noSort="true" defaultItem="0">SHA-1 </dropdownList>
<dropdownList refId="PKINITHashAlgorithmSHA256" noSort="true" defaultItem="0">SHA-256</dropdownList>
<dropdownList refId="PKINITHashAlgorithmSHA384" noSort="true" defaultItem="0">SHA-384</dropdownList>
<dropdownList refId="PKINITHashAlgorithmSHA512" noSort="true" defaultItem="0">SHA-512</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/Kerberos.adml
+265
View File
@@ -0,0 +1,265 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Kerberos Settings</displayName>
<description>Configuration settings for the Kerberos authentication protocol.</description>
<resources>
<stringTable>
<string id="kerberos">Kerberos</string>
<string id="forestsearch">Use forest search order</string>
<string id="forestsearch_explain">This policy setting defines the list of trusting forests that the Kerberos client searches when attempting to resolve two-part service principal names (SPNs).
If you enable this policy setting, the Kerberos client searches the forests in this list, if it is unable to resolve a two-part SPN. If a match is found, the Kerberos client requests a referral ticket to the appropriate domain.
If you disable or do not configure this policy setting, the Kerberos client does not search the listed forests to resolve the SPN. If the Kerberos client is unable to resolve the SPN because the name is not found, NTLM authentication might be used.</string>
<string id="hosttorealm">Define host name-to-Kerberos realm mappings</string>
<string id="hosttorealm_explain">This policy setting allows you to specify which DNS host names and which DNS suffixes are mapped to a Kerberos realm.
If you enable this policy setting, you can view and change the list of DNS host names and DNS suffixes mapped to a Kerberos realm as defined by Group Policy. To view the list of mappings, enable the policy setting and then click the Show button. To add a mapping, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type a realm name. In the Value column, type the list of DNS host names and DNS suffixes using the appropriate syntax format. To remove a mapping from the list, click the mapping entry to be removed, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters.
If you disable this policy setting, the host name-to-Kerberos realm mappings list defined by Group Policy is deleted.
If you do not configure this policy setting, the system uses the host name-to-Kerberos realm mappings that are defined in the local registry, if they exist.</string>
<string id="MitRealms">Define interoperable Kerberos V5 realm settings</string>
<string id="MitRealms_explain">This policy setting configures the Kerberos client so that it can authenticate with interoperable Kerberos V5 realms, as defined by this policy setting.
If you enable this policy setting, you can view and change the list of interoperable Kerberos V5 realms and their settings. To view the list of interoperable Kerberos V5 realms, enable the policy setting and then click the Show button. To add an interoperable Kerberos V5 realm, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type the interoperable Kerberos V5 realm name. In the Value column, type the realm flags and host names of the host KDCs using the appropriate syntax format. To remove an interoperable Kerberos V5 realm Value Name or Value entry from the list, click the entry, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters.
If you disable this policy setting, the interoperable Kerberos V5 realm settings defined by Group Policy are deleted.
If you do not configure this policy setting, the system uses the interoperable Kerberos V5 realm settings that are defined in the local registry, if they exist.</string>
<string id="ValidateKDC">Require strict KDC validation</string>
<string id="ValidateKDC_explain">This policy setting controls the Kerberos client's behavior in validating the KDC certificate for smart card and system certificate logon.
If you enable this policy setting, the Kerberos client requires that the KDC's X.509 certificate contains the KDC key purpose object identifier in the Extended Key Usage (EKU) extensions, and that the KDC's X.509 certificate contains a dNSName subjectAltName (SAN) extension that matches the DNS name of the domain. If the computer is joined to a domain, the Kerberos client requires that the KDC's X.509 certificate must be signed by a Certificate Authority (CA) in the NTAuth store. If the computer is not joined to a domain, the Kerberos client allows the root CA certificate on the smart card to be used in the path validation of the KDC's X.509 certificate.
If you disable or do not configure this policy setting, the Kerberos client requires only that the KDC certificate contain the Server Authentication purpose object identifier in the EKU extensions which can be issued to any server.
</string>
<string id="StrictTarget">Require strict target SPN match on remote procedure calls</string>
<string id="StrictTarget_explain"> This policy setting allows you to configure this server so that Kerberos can decrypt a ticket that contains this system-generated SPN. When an application attempts to make a remote procedure call (RPC) to this server with a NULL value for the service principal name (SPN), computers running Windows 7 or later attempt to use Kerberos by generating an SPN.
If you enable this policy setting, only services running as LocalSystem or NetworkService are allowed to accept these connections. Services running as identities different from LocalSystem or NetworkService might fail to authenticate.
If you disable or do not configure this policy setting, any service is allowed to accept incoming connections by using this system-generated SPN.</string>
<string id="KdcProxyServer">Specify KDC proxy servers for Kerberos clients</string>
<string id="KdcProxyServer_explain">This policy setting configures the Kerberos client's mapping to KDC proxy servers for domains based on their DNS suffix names.
If you enable this policy setting, the Kerberos client will use the KDC proxy server for a domain when a domain controller cannot be located based on the configured mappings. To map a KDC proxy server to a domain, enable the policy setting, click Show, and then map the KDC proxy server name(s) to the DNS name for the domain using the syntax described in the options pane. In the Show Contents dialog box in the Value Name column, type a DNS suffix name. In the Value column, type the list of proxy servers using the appropriate syntax format. To view the list of mappings, enable the policy setting and then click the Show button. To remove a mapping from the list, click the mapping entry to be removed, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters.
If you disable or do not configure this policy setting, the Kerberos client does not have KDC proxy servers settings defined by Group Policy.
</string>
<string id="KdcProxyDisableServerRevocationCheck">Disable revocation checking for the SSL certificate of KDC proxy servers</string>
<string id="KdcProxyDisableServerRevocationCheck_explain">This policy setting allows you to disable revocation check for the SSL certificate of the targeted KDC proxy server.
If you enable this policy setting, revocation check for the SSL certificate of the KDC proxy server is ignored by the Kerberos client. This policy setting should only be used in troubleshooting KDC proxy connections.
Warning: When revocation check is ignored, the server represented by the certificate is not guaranteed valid.
If you disable or do not configure this policy setting, the Kerberos client enforces the revocation check for the SSL certificate. The connection to the KDC proxy server is not established if the revocation check fails.
</string>
<string id="ClientRequireFast">Fail authentication requests when Kerberos armoring is not available</string>
<string id="ClientRequireFast_explain">This policy setting controls whether a computer requires that Kerberos message exchanges be armored when communicating with a domain controller.
Warning: When a domain does not support Kerberos armoring by enabling "Support Dynamic Access Control and Kerberos armoring", then all authentication for all its users will fail from computers with this policy setting enabled.
If you enable this policy setting, the client computers in the domain enforce the use of Kerberos armoring in only authentication service (AS) and ticket-granting service (TGS) message exchanges with the domain controllers.
Note: The Kerberos Group Policy "Kerberos client support for claims, compound authentication and Kerberos armoring" must also be enabled to support Kerberos armoring.
If you disable or do not configure this policy setting, the client computers in the domain enforce the use of Kerberos armoring when possible as supported by the target domain.
</string>
<string id="ServerAcceptsCompound">Support compound authentication</string>
<string id="ServerAcceptsCompound_explain">This policy setting controls configuring the device's Active Directory account for compound authentication.
Support for providing compound authentication which is used for access control will require enough domain controllers in the resource account domains to support the requests. The Domain Administrator must configure the policy "Support Dynamic Access Control and Kerberos armoring" on all the domain controllers to support this policy.
If you enable this policy setting, the device's Active Directory account will be configured for compound authentication by the following options:
Never: Compound authentication is never provided for this computer account.
Automatic: Compound authentication is provided for this computer account when one or more applications are configured for Dynamic Access Control.
Always: Compound authentication is always provided for this computer account.
If you disable this policy setting, Never will be used.
If you do not configure this policy setting, Automatic will be used.
</string>
<string id="CompoundIdEnable_No">Never</string>
<string id="CompoundIdEnable_Auto">Automatic</string>
<string id="CompoundIdEnable_Yes">Always</string>
<string id="MaxTokenSize">Set maximum Kerberos SSPI context token buffer size</string>
<string id="MaxTokenSize_explain">This policy setting allows you to set the value returned to applications which request the maximum size of the SSPI context token buffer size.
The size of the context token buffer determines the maximum size of SSPI context tokens an application expects and allocates. Depending upon authentication request processing and group memberships, the buffer might be smaller than the actual size of the SSPI context token.
If you enable this policy setting, the Kerberos client or server uses the configured value, or the locally allowed maximum value, whichever is smaller.
If you disable or do not configure this policy setting, the Kerberos client or server uses the locally configured value or the default value.
Note: This policy setting configures the existing MaxTokenSize registry value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters, which was added in Windows XP and Windows Server 2003, with a default value of 12,000 bytes. Beginning with Windows 8 the default is 48,000 bytes. Due to HTTP's base64 encoding of authentication context tokens, it is not advised to set this value more than 48,000 bytes.
</string>
<string id="EnableCbacAndArmor">Kerberos client support for claims, compound authentication and Kerberos armoring</string>
<string id="EnableCbacAndArmor_explain">This policy setting controls whether a device will request claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication with domains that support these features.
If you enable this policy setting, the client computers will request claims, provide information required to create compounded authentication and armor Kerberos messages in domains which support claims and compound authentication for Dynamic Access Control and Kerberos armoring.
If you disable or do not configure this policy setting, the client devices will not request claims, provide information required to create compounded authentication and armor Kerberos messages. Services hosted on the device will not be able to retrieve claims for clients using Kerberos protocol transition.
</string>
<string id="AlwaysSendCompoundId">Always send compound authentication first</string>
<string id="AlwaysSendCompoundId_explain">This policy setting controls whether a device always sends a compound authentication request when the resource domain requests compound identity.
Note: For a domain controller to request compound authentication, the policies "KDC support for claims, compound authentication, and Kerberos armoring" and "Request compound authentication" must be configured and enabled in the resource account domain.
If you enable this policy setting and the resource domain requests compound authentication, devices that support compound authentication always send a compound authentication request.
If you disable or do not configure this policy setting and the resource domain requests compound authentication, devices will send a non-compounded authentication request first then a compound authentication request when the service requests compound authentication.
</string>
<string id="DevicePKInitEnabled">Support device authentication using certificate</string>
<string id="DevicePKInitEnabled_explain">Support for device authentication using certificate will require connectivity to a DC in the device account domain which supports certificate authentication for computer accounts.
This policy setting allows you to set support for Kerberos to attempt authentication using the certificate for the device to the domain.
If you enable this policy setting, the device’s credentials will be selected based on the following options:
Automatic: Device will attempt to authenticate using its certificate. If the DC does not support computer account authentication using certificates then authentication with password will be attempted.
Force: Device will always authenticate using its certificate. If a DC cannot be found which support computer account authentication using certificates then authentication will fail.
If you disable this policy setting, certificates will never be used.
If you do not configure this policy setting, Automatic will be used.
</string>
<string id="DevicePKInitBehavior_Automatic">Automatic</string>
<string id="DevicePKInitBehavior_Force">Force</string>
<string id="CloudKerberosTicketRetrievalEnabled">Allow retrieving the Azure AD Kerberos Ticket Granting Ticket during logon</string>
<string id="CloudKerberosTicketRetrievalEnabled_explain">This policy setting allows retrieving the Azure AD Kerberos Ticket Granting Ticket during logon.
If you disable or do not configure this policy setting, the Azure AD Kerberos Ticket Granting Ticket is not retrieved during logon.
If you enable this policy setting, the Azure AD Kerberos Ticket Granting Ticket is retrieved during logon.</string>
<string id="PKInitHashAlgorithmConfiguration">Configure hash algorithms for certificate logon</string>
<string id="PKInitHashAlgorithmConfiguration_explain">This policy setting controls hash or checksum algorithms used by the Kerberos client when performing certificate authentication.
If you enable this policy, you will be able to configure one of four states for each algorithm:
- “Default” sets the algorithm to the recommended state.
- “Supported” enables usage of the algorithm. Enabling algorithms that have been disabled by default may reduce your security.
- “Audited” enables usage of the algorithm and reports an event (ID 206) every time it is used. This state is intended to verify that the algorithm is not being used and can be safely disabled.
- “Not Supported” disables usage of the algorithm. This state is intended for algorithms that are deemed to be insecure.
If you disable or do not configure this policy, each algorithm will assume the “Default” state.
More information about the hash and checksum algorithms supported by the Windows Kerberos client and their default states can be found at https://go.microsoft.com/fwlink/?linkid=2169037.
Events generated by this configuration: 205, 206, 207, 208.
</string>
<string id="PKInitHashAlgorithm_Default">Default</string>
<string id="PKInitHashAlgorithm_Supported">Supported</string>
<string id="PKInitHashAlgorithm_Audited">Audited</string>
<string id="PKInitHashAlgorithm_NotSupported">Not Supported</string>
</stringTable>
<presentationTable>
<presentation id="hosttorealm">
<listBox refId="hosttorealm">Define host name-to-realm mappings:</listBox>
<text></text>
<text>Syntax:</text>
<text>Enter the Kerberos realm name as the Value Name.</text>
<text>Enter the host names and DNS suffixes, that you want to</text>
<text>map to the Kerberos realm, as the Value. To add multiple</text>
<text>names, separate entries with ";".</text>
<text></text>
<text>Note: To specify a DNS suffix prepend the entry with a '.' period.</text>
<text>For a host name entry do not specify a leading '.' period.</text>
<text></text>
<text>Example:</text>
<text>Value Name: MICROSOFT.COM</text>
<text>Value: .microsoft.com; .ms.com; computer1.fabrikam.com;</text>
<text></text>
<text>In the example above. All principals with either the DNS suffix</text>
<text>of *.microsoft.com or *.ms.com will be mapped to the</text>
<text>MICROSOFT.COM Kerberos realm. In addition the host name</text>
<text>computer1.fabrikam.com will also be mapped to the </text>
<text>MICROSOFT.COM Kerberos realm.</text>
</presentation>
<presentation id="MitRealms">
<listBox refId="MitRealms">Define interoperable Kerberos V5 realm settings:</listBox>
<text></text>
<text>Syntax:</text>
<text>Enter the interoperable Kerberos V5 realm name as the Value Name.</text>
<text>Enter the realm flags and the host names of the KDCs as</text>
<text>the Value. Enclose the realm flags with the following</text>
<text>tags &lt;f&gt; &lt;/f&gt;. Enclose the list of KDCs with the tags &lt;k&gt; &lt;/k&gt;</text>
<text>To add multiple KDC names, separate entries with</text>
<text>a semi-colon ";".</text>
<text></text>
<text>Example:</text>
<text>Value Name: TEST.COM</text>
<text>Value: &lt;f&gt;0x00000004&lt;/f&gt;&lt;k&gt;kdc1.test.com; kdc2.test.com&lt;/k&gt;</text>
<text></text>
<text>Another Example:</text>
<text>Value Name: REALM.FABRIKAM.COM</text>
<text>Value: &lt;f&gt;0x0000000E&lt;/f&gt;</text>
</presentation>
<presentation id="ValidateKDC">
<dropdownList refId="ValidateKDCOp" noSort="true" defaultItem="0">Mode:</dropdownList>
</presentation>
<presentation id="ForestSearch">
<textBox refId="ForestSearchList">
<label>Forests to Search</label>
</textBox>
<text>Syntax:</text>
<text>Enter the list of forests to be searched when this policy is enabled.</text>
<text>Use the Fully Qualified Domain Name (FQDN) naming format.</text>
<text>Separate multiple search entries with a semi-colon ";".</text>
<text>Details:</text>
<text>The current forest need not be listed because Forest Search Order uses the global catalog first then searches in the order listed.</text>
<text>You do not need to separately list all the domains in the forest.</text>
<text>If a trusting forest is listed, all the domains in that forest will be searched.</text>
<text>For best performance, list the forests in probability of success order. </text>
</presentation>
<presentation id="KdcProxyServer">
<listBox refId="KdcProxyServer">Define KDC proxy servers settings:</listBox>
<text></text>
<text>Syntax:</text>
<text></text>
<text>Enter the DNS suffix name as the Value Name.</text>
<text>DNS suffix name allows three formats with decreasing preference order:</text>
<text>Full Match: host.contoso.com</text>
<text>Suffix Match: .contoso.com</text>
<text>Default Match: *</text>
<text></text>
<text>Enter the proxy server names as the Value.</text>
<text>The proxy server names must be enclosed with tags &lt;https /&gt;</text>
<text>To add multiple proxy server names, separate entries with a space or comma ","</text>
<text></text>
<text>Example:</text>
<text>Value Name: .contoso.com</text>
<text>Value: &lt;https proxy1.contoso.com proxy2.contoso.com /&gt;</text>
<text></text>
<text>Another Example:</text>
<text>Value Name: *</text>
<text>Value: &lt;https proxy.contoso.com /&gt;</text>
</presentation>
<presentation id="ClientRequireFast">
</presentation>
<presentation id="ServerAcceptsCompound">
<dropdownList refId="CompoundIdEnabled" noSort="true" defaultItem="2">Support authorization with client device information:</dropdownList>
</presentation>
<presentation id="MaxTokenSize">
<decimalTextBox refId="MaxTokenSize" defaultValue="48000" spinStep="1000">Maximum size</decimalTextBox>
</presentation>
<presentation id="EnableCbacAndArmor">
</presentation>
<presentation id="DevicePKInitBehavior">
<dropdownList refId="DevicePKInitBehavior" noSort="true" defaultItem="0">Device authentication behavior using certificate:</dropdownList>
</presentation>
<presentation id="PKInitHashAlgorithmConfiguration">
<dropdownList refId="PKInitHashAlgorithmSHA1" noSort="true" defaultItem="0">SHA-1 </dropdownList>
<dropdownList refId="PKInitHashAlgorithmSHA256" noSort="true" defaultItem="0">SHA-256</dropdownList>
<dropdownList refId="PKInitHashAlgorithmSHA384" noSort="true" defaultItem="0">SHA-384</dropdownList>
<dropdownList refId="PKInitHashAlgorithmSHA512" noSort="true" defaultItem="0">SHA-512</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/LAPS.adml
+188
View File
@@ -0,0 +1,188 @@
<policyDefinitionResources revision="1.0" schemaVersion="1.0">
<displayName>
</displayName>
<description>
</description>
<resources>
<stringTable>
<string id="LAPS">LAPS</string>
<string id="LAPS_BackupDirectory">Configure password backup directory</string>
<string id="LAPS_BackupDirectory_Help">Use this setting to configure which directory the local admin account password is backed up to.
The allowable settings are:
0=Disabled (password will not be backed up)
1=Backup the password to Azure Active Directory
2=Backup the password to Active Directory
If not specified, this setting will default to 0 (Disabled).
If this setting is configured to 1, and the managed device is not joined to Azure Active Directory, the local administrator password will not be managed.
If this setting is configured to 2, and the managed device is not joined to Active Directory, the local administrator password will not be managed.
If this setting is disabled or not configured, the local administrator password is not managed.
See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.
</string>
<string id="LAPS_BackupDirectoryDisabled">Disabled</string>
<string id="LAPS_BackupDirectoryAzure">Azure Active Directory</string>
<string id="LAPS_BackupDirectoryAD">Active Directory</string>
<string id="LAPS_PasswordSettings">Password Settings</string>
<string id="LAPS_PasswordSettings_Help">Configures password parameters
Password complexity: which characters are used when generating a new password
Default: Large letters + small letters + numbers + special characters
Password length
Minimum: 8 characters
Maximum: 64 characters
Default: 14 characters
Password age in days
Minimum: 1 day (7 days when backup directory is configured to be Azure AD)
Maximum: 365 days
Default: 30 days
See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.
</string>
<string id="LAPS_PwdComplexity_Item_1">Large letters</string>
<string id="LAPS_PwdComplexity_Item_2">Large letters + small letters</string>
<string id="LAPS_PwdComplexity_Item_3">Large letters + small letters + numbers</string>
<string id="LAPS_PwdComplexity_Item_4">Large letters + small letters + numbers + specials</string>
<string id="LAPS_AdminName">Name of administrator account to manage</string>
<string id="LAPS_AdminName_Help">This policy setting specifies a custom Administrator account name to manage the password for.
If this policy setting is enabled, LAPS will manage the password for a local account with this name.
If this policy setting is disabled or not configured, LAPS will manage the password for the well known Administrator account.
DO NOT enable this policy setting to manage the built-in administrator account. The built-in administrator account is auto-detected by well-known SID and does not depend on the account name.
See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.
</string>
<string id="LAPS_DontAllowPwdExpirationBehindPolicy">Do not allow password expiration time longer than required by policy</string>
<string id="LAPS_DontAllowPwdExpirationBehindPolicy_Help">If this setting is enabled or not configured, planned password expiration longer than the password age dictated by the "Password Settings" policy is NOT allowed. When such expiration is detected, the password is changed immediately and password expiration is set according to policy.
If this setting is disabled, password expiration time may be longer than required by "Password Settings" policy.
See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.
</string>
<string id="LAPS_ADPasswordEncryptionEnabled">Enable password encryption</string>
<string id="LAPS_ADPasswordEncryptionEnabled_Help">When you enable this setting, the managed password is encrypted before being sent to Active Directory.
Enabling this setting has no effect unless 1) the password has been configured to be backed up to Active Directory and 2) the Active Directory domain functional level is at Windows Server 2016 or above.
If this setting is enabled, and the domain functional level is at or above Windows Server 2016, the managed account password is encrypted.
If this setting is enabled, and the domain functional level is less than Windows Server 2016, the managed account password is not backed up to the directory.
If this setting is disabled, the managed account password is not encrypted.
This setting will default to enabled if not configured.
See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.
</string>
<string id="LAPS_ADPasswordEncryptionPrincipal">Configure authorized password decryptors</string>
<string id="LAPS_ADPasswordEncryptionPrincipal_Help">Configure this setting to control the specific user or group who is authorized to decrypt encrypted passwords.
Configuring this setting has no effect unless password encryption has been enabled.
If this setting is enabled, encrypted passwords will be decryptable by the specified group.
If this setting is disabled or not configured, encrypted passwords will be decryptable by the Domain Admins group.
This setting must be configured with either a SID in string format ("S-1-5-21-2127521184-1604012920-1887927527-35197") or the name of a group or user in "domain\(group or user)" format. The specified user or group must be resolvable by the managed device, otherwise passwords will not be backed up.
See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.
</string>
<string id="LAPS_ADEncryptedPasswordHistorySize">Configure size of encrypted password history</string>
<string id="LAPS_ADEncryptedPasswordHistorySize_Help">Use this setting to configure how many previous encrypted passwords will be stored in Active Directory.
Configuring this setting has no effect unless 1) the password has been configured to be backed up to Active Directory and 2) password encryption has been enabled.
If this setting is enabled, the specified number of older passwords will be stored in Active Directory.
If this setting is disabled or not configured, zero older passwords will be stored in Active Directory.
This setting has a minimum allowed value of 0 passwords.
This setting has a maximum allowed value of 12 passwords.
See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.
</string>
<string id="LAPS_ADBackupDSRMPassword">Enable password backup for DSRM accounts</string>
<string id="LAPS_ADBackupDSRMPassword_Help">When you enable this setting, the DSRM administrator account password will be managed and backed up to Active Directory.
Enabling this setting has no effect unless the managed device is a domain controller and password encryption is also enabled.
If this setting is enabled, the password for the DSRM administrator account on the domain controller will be backed up to Active Directory.
If this setting is disabled or not configured, the password for the DSRM administrator account on the domain controller will not be backed up to Active Directory.
See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.
</string>
<string id="LAPS_PostAuthenticationActions">Post-authentication actions</string>
<string id="LAPS_PostAuthenticationActions_Help">This policy configures post-authentication actions which will be executed after detecting an authentication by the managed account.
Grace period: specifies the amount of time (in hours) to wait after an authentication before executing the specified post-authentication actions.
If this setting is enabled and greater than zero, the specified post-authentication actions will be executed upon expiry of the grace period.
If this setting is disabled or not configured, the specified post-authentication actions will be executed after a default 24 hour grace period.
If this setting is equal to zero, no post-authentication actions will be executed.
Actions: specifies the actions to take upon expiry of the grace period.
Reset password: upon expiry of the grace period, the managed account password will be reset.
Reset the password and logoff the managed account: upon expiry of the grace period, the managed account password will be reset and any interactive logon sessions using the managed account will terminated.
(NOTE: after any interactive logon sessions are terminated there may still be other authenticated sessions in use by the managed account. The only robust way to ensure that the previous password is longer in use is to reboot the device.)
Reset the password and reboot: upon expiry of the grace period, the managed account password will be reset and the managed device will be immediately rebooted.
If this setting is disabled or not configured, post-authentication actions will default to "Reset the password and logoff the managed account".
Note: the DSRM account on domain controllers cannot be configured for post-authentication actions. This policy has no effect on domain controllers and will be ignored even if configured for a DC.
See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.
</string>
<string id="PostAuthenticationActions_Item0">Disabled - take no actions</string>
<string id="PostAuthenticationActions_Item1">Reset the password</string>
<string id="PostAuthenticationActions_Item3">Reset the password and logoff the managed account</string>
<string id="PostAuthenticationActions_Item5">Reset the password and reboot the device</string>
<string id="SUPPORTED_Windows10">At least Microsoft Windows 10 or later</string>
</stringTable>
<presentationTable>
<presentation id="LAPS_BackupDirectory">
<dropdownList refId="LAPS_BackupDirectory" defaultItem="1">Backup directory</dropdownList>
</presentation>
<presentation id="LAPS_PasswordSettings">
<dropdownList refId="LAPS_PasswordComplexity" defaultItem="3">Password Complexity</dropdownList>
<decimalTextBox refId="LAPS_PasswordLength" defaultValue="14">Password Length</decimalTextBox>
<decimalTextBox refId="LAPS_PasswordAgeDays" defaultValue="30">Password Age (Days)</decimalTextBox>
</presentation>
<presentation id="LAPS_AdminName">
<textBox refId="TEXT_AdminAccountName">
<label>Administrator account name</label>
</textBox>
</presentation>
<presentation id="LAPS_ADPasswordEncryptionPrincipal">
<textBox refId="TEXT_ADPasswordEncryptionPrincipal">
<label>Authorized password decryptor</label>
</textBox>
</presentation>
<presentation id="LAPS_ADEncryptedPasswordHistorySize">
<decimalTextBox refId="LAPS_ADEncryptedPasswordHistorySize_INT" defaultValue="0">Encrypted password history size</decimalTextBox>
</presentation>
<presentation id="LAPS_PostAuthenticationActions">
<decimalTextBox refId="LAPS_PostAuthenticationResetDelay_INT" defaultValue="24">Grace period (hours):</decimalTextBox>
<dropdownList refId="LAPS_PostAuthenticationActions" defaultItem="3">Actions:</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/LanmanServer.adml
+142
View File
@@ -0,0 +1,142 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="Cat_LanmanServer">Lanman Server</string>
<string id="Lbl_FollowShare">Allow hash publication only for shared folders on which BranchCache is enabled</string>
<string id="Lbl_DisableOnAllShares">Disallow hash publication on all shared folders</string>
<string id="Lbl_EnableOnAllShares">Allow hash publication for all shared folders</string>
<string id="Pol_HashPublication">Hash Publication for BranchCache</string>
<string id="Pol_HashPublication_Help">This policy setting specifies whether a hash generation service generates hashes, also called content information, for data that is stored in shared folders. This policy setting must be applied to server computers that have the File Services role and both the File Server and the BranchCache for Network Files role services installed.
Policy configuration
Select one of the following:
- Not Configured. With this selection, hash publication settings are not applied to file servers. In the circumstance where file servers are domain members but you do not want to enable BranchCache on all file servers, you can specify Not Configured for this domain Group Policy setting, and then configure local machine policy to enable BranchCache on individual file servers. Because the domain Group Policy setting is not configured, it will not over-write the enabled setting that you use on individual servers where you want to enable BranchCache.
- Enabled. With this selection, hash publication is turned on for all file servers where Group Policy is applied. For example, if Hash Publication for BranchCache is enabled in domain Group Policy, hash publication is turned on for all domain member file servers to which the policy is applied. The file servers are then able to create content information for all content that is stored in BranchCache-enabled file shares.
- Disabled. With this selection, hash publication is turned off for all file servers where Group Policy is applied.
In circumstances where this policy setting is enabled, you can also select the following configuration options:
- Allow hash publication for all shared folders. With this option, BranchCache generates content information for all content in all shares on the file server.
- Allow hash publication only for shared folders on which BranchCache is enabled. With this option, content information is generated only for shared folders on which BranchCache is enabled. If you use this setting, you must enable BranchCache for individual shares in Share and Storage Management on the file server.
- Disallow hash publication on all shared folders. With this option, BranchCache does not generate content information for any shares on the computer and does not send content information to client computers that request content.
</string>
<string id="Lbl_SupportV1">Supports V1 hash version only</string>
<string id="Lbl_SupportV2">Supports V2 hash version only</string>
<string id="Lbl_SupportV1andV2">Supports V1 as well as V2 versions</string>
<string id="Pol_HashSupportVersion">Hash Version support for BranchCache</string>
<string id="Pol_HashSupportVersion_Help">This policy setting specifies whether the BranchCache hash generation service supports version 1 (V1) hashes, version 2 (V2) hashes, or both V1 and V2 hashes. Hashes, also called content information, are created based on the data in shared folders where BranchCache is enabled.
If you specify only one version that is supported, content information for that version is the only type that is generated by BranchCache, and it is the only type of content information that can be retrieved by client computers. For example, if you enable support for V1 hashes, BranchCache generates only V1 hashes and client computers can retrieve only V1 hashes.
Policy configuration
Select one of the following:
- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy setting. In this circumstance, which is the default, both V1 and V2 hash generation and retrieval are supported.
- Enabled. With this selection, the policy setting is applied and the hash version(s) that are specified in "Hash version supported" are generated and retrieved.
- Disabled. With this selection, both V1 and V2 hash generation and retrieval are supported.
In circumstances where this setting is enabled, you can also select and configure the following option:
Hash version supported:
- To support V1 content information only, configure "Hash version supported" with the value of 1.
- To support V2 content information only, configure "Hash version supported" with the value of 2.
- To support both V1 and V2 content information, configure "Hash version supported" with the value of 3.</string>
<string id="Pol_CipherSuiteOrder_Name">Cipher suite order</string>
<string id="Pol_CipherSuiteOrder_Help">This policy setting determines the cipher suites used by the SMB server.
If you enable this policy setting, cipher suites are prioritized in the order specified.
If you enable this policy setting and do not specify at least one supported cipher suite, or if you disable or do not configure this policy setting, the default cipher suite order is used.
SMB 3.11 cipher suites:
AES_128_GCM
AES_128_CCM
AES_256_GCM
AES_256_CCM
SMB 3.0 and 3.02 cipher suites:
AES_128_CCM
How to modify this setting:
Arrange the desired cipher suites in the edit box, one cipher suite per line, in order from most to least preferred, with the most preferred cipher suite at the top. Remove any cipher suites you don't want to use.
Note: When configuring this security setting, changes will not take effect until you restart Windows.</string>
<string id="HonorCipherSuiteOrder_Name">Honor cipher suite order</string>
<string id="HonorCipherSuiteOrder_Help">This policy setting determines how the SMB server selects a cipher suite when negotiating a new connection with an SMB client.
If you enable this policy setting, the SMB server will select the cipher suite it most prefers from the SMB client's cipher suites, ignoring the client's cipher suite preferences.
If you disable or do not configure this policy setting, the SMB server will select the cipher suite the SMB client most prefers from the server's cipher suites.
Note: When configuring this security setting, changes will not take effect until you restart Windows.</string>
<string id="Pol_HonorCipherSuiteOrder_Name">Honor cipher suite order</string>
<string id="Pol_HonorCipherSuiteOrder_Help">This policy setting determines how the SMB server selects a cipher suite when negotiating a new connection with an SMB client.
If you enable this policy setting, the SMB server will select the cipher suite it most prefers from the list of client-supported cipher suites, ignoring the client's preferences.
If you disable or do not configure this policy setting, the SMB server will select the cipher suite the client most prefers from the list of server-supported cipher suites.
Note: When configuring this security setting, changes will not take effect until you restart Windows.</string>
<string id="SUPPORTED_Windows_Server_2022_Windows_11_0">At least Windows Server 2022, Windows 11</string>
<string id="Pol_EnableCompressedTraffic_Name">Request traffic compression for all shares</string>
<string id="Pol_EnableCompressedTraffic_Help">This policy controls whether the SMB server requests SMB client to use traffic compression for all SMB shares.
If you enable this policy setting, the SMB server will by default request the SMB client to compress traffic when SMB compression is enabled. See notes below.
If you disable or do not configure this policy setting, the SMB server will not by default request the SMB client to compress traffic. However traffic compression may be requested by other means. See notes below.
Note: If this policy is disabled, traffic compression may be requested by server-side per-share properties or by the SMB Client. If this is undesired, and one wishes to completely disable compression, configure the accompanying 'Disable SMB compression' policy instead.
Note: Traffic compression can only be used when both the SMB client and SMB server support and enable traffic compression.
</string>
<string id="Pol_DisableCompression_Name">Disable SMB compression</string>
<string id="Pol_DisableCompression_Help">This policy controls whether the SMB server will disable (completely prevent) traffic compression.
If you enable this policy setting, the SMB server will never compress data, irrespective of other policies (such as the 'Use SMB compression by default' policy or per-share property).
If you disable or do not configure this policy setting, the SMB server may compress traffic (depending on a combination of other policies and conditions).
</string>
</stringTable>
<presentationTable>
<presentation id="Pol_HashPublication">
<text>Values:</text>
<text>0 = Allow hash publication only for shared folders on which BranchCache is enabled</text>
<text>1 = Disallow hash publication on all shared folders</text>
<text>2 = Allow hash publication for all shared folders</text>
<dropdownList refId="Lbl_HashPublicationActionCombo" defaultItem="0">Hash publication actions: </dropdownList>
<text> </text>
</presentation>
<presentation id="Pol_HashSupportVersion">
<text>Values:</text>
<text>1 = Support V1 hashes</text>
<text>2 = Support V2 hashes</text>
<text>3 = Support V1 and V2 hashes</text>
<dropdownList refId="Lbl_HashVersionSupportActionCombo" defaultItem="0">Hash version supported: </dropdownList>
<text> </text>
</presentation>
<presentation id="Pol_CipherSuiteOrder">
<text>Cipher suites:</text>
<multiTextBox refId="MultiText_CipherSuiteOrder"/>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/LanmanWorkstation.adml
+88
View File
@@ -0,0 +1,88 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="Cat_LanmanWorkstation">Lanman Workstation</string>
<string id="Pol_CipherSuiteOrder_Name">Cipher suite order</string>
<string id="Pol_CipherSuiteOrder_Help">This policy setting determines the cipher suites used by the SMB client.
If you enable this policy setting, cipher suites are prioritized in the order specified.
If you enable this policy setting and do not specify at least one supported cipher suite, or if you disable or do not configure this policy setting, the default cipher suite order is used.
SMB 3.11 cipher suites:
AES_128_GCM
AES_128_CCM
AES_256_GCM
AES_256_CCM
SMB 3.0 and 3.02 cipher suites:
AES_128_CCM
How to modify this setting:
Arrange the desired cipher suites in the edit box, one cipher suite per line, in order from most to least preferred, with the most preferred cipher suite at the top. Remove any cipher suites you don't want to use.
Note: When configuring this security setting, changes will not take effect until you restart Windows.</string>
<string id="Pol_EnableInsecureGuestLogons_Name">Enable insecure guest logons</string>
<string id="Pol_EnableInsecureGuestLogons_Help">This policy setting determines if the SMB client will allow insecure guest logons to an SMB server.
If you enable this policy setting or if you do not configure this policy setting, the SMB client will allow insecure guest logons.
If you disable this policy setting, the SMB client will reject insecure guest logons.
Insecure guest logons are used by file servers to allow unauthenticated access to shared folders. While uncommon in an enterprise environment, insecure guest logons are frequently used by consumer Network Attached Storage (NAS) appliances acting as file servers. Windows file servers require authentication and do not use insecure guest logons by default. Since insecure guest logons are unauthenticated, important security features such as SMB Signing and SMB Encryption are disabled. As a result, clients that allow insecure guest logons are vulnerable to a variety of man-in-the-middle attacks that can result in data loss, data corruption, and exposure to malware. Additionally, any data written to a file server using an insecure guest logon is potentially accessible to anyone on the network. Microsoft recommends disabling insecure guest logons and configuring file servers to require authenticated access."
</string>
<string id="Pol_EnableCSCforCAShares_Name">Offline Files Availability on Continuous Availability Shares</string>
<string id="Pol_EnableCSCforCAShares_Help">
This policy setting determines the behavior of Offline Files on clients connecting to an SMB share where the Continuous Availability (CA) flag is enabled.
If you enable this policy setting, the "Always Available offline" option will appear in the File Explorer menu on a Windows computer when connecting to a CA-enabled share. Pinning of files on CA-enabled shares using client-side caching will also be possible.
If you disable or do not configure this policy setting, Windows will prevent use of Offline Files with CA-enabled shares.
Note: Microsoft does not recommend enabling this group policy. Use of CA with Offline Files will lead to very long transition times between the online and offline states.
</string>
<string id="Pol_EnableHandleCachingForCAFiles_Name">Handle Caching on Continuous Availability Shares</string>
<string id="Pol_EnableHandleCachingForCAFiles_Help">
This policy setting determines the behavior of SMB handle caching for clients connecting to an SMB share where the Continuous Availability (CA) flag is enabled.
If you enable this policy setting, the SMB client will allow cached handles to files on CA shares. This may lead to better performance when repeatedly accessing a large number of unstructured data files on CA shares running in Microsoft Azure Files.
If you disable or do not configure this policy setting, Windows will prevent use of cached handles to files opened through CA shares.
Note: This policy has no effect when connecting Scale-out File Server shares provided by a Windows Server. Microsoft does not recommend enabling this policy for clients that routinely connect to files hosted on a Windows Failover Cluster with the File Server for General Use role, as it can lead to adverse failover times and increased memory and CPU usage.
</string>
<string id="SUPPORTED_Windows_Server_2022_Windows_11_0">At least Windows Server 2022, Windows 11</string>
<string id="Pol_EnableCompressedTraffic_Name">Use SMB compression by default</string>
<string id="Pol_EnableCompressedTraffic_Help">This policy controls whether the SMB client uses traffic compression by default.
If you enable this policy setting, the SMB client will attempt to compress traffic by default when SMB compression is enabled.
If you disable or do not configure this policy setting, the SMB client will not by default attempt to compress traffic. However traffic compression may be requested by other means. See notes below.
Note: This policy is combined with per-share and per-file handle properties, through which traffic compression may be requested. As well, the SMB server must support and enable compression. For example, should this policy be disabled (or not configured), the SMB client may still perform compression if an SMB server share has compression requested. If this is undesired, and one wishes to completely disable compression, configure the accompanying 'Disable SMB compression' policy instead.
</string>
<string id="Pol_DisableCompression_Name">Disable SMB compression</string>
<string id="Pol_DisableCompression_Help">This policy controls whether the SMB client will disable (completely prevent) traffic compression.
If you enable this policy setting, the SMB client will never compress data, irrespective of other policies (such as the 'Use SMB compression by default' policy or per-share property).
If you disable or do not configure this policy setting, the SMB client may compress traffic (depending on a combination of other policies and conditions).
</string>
</stringTable>
<presentationTable>
<presentation id="Pol_CipherSuiteOrder">
<text>Cipher suites:</text>
<multiTextBox refId="MultiText_CipherSuiteOrder"/>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/LeakDiagnostic.adml
+25
View File
@@ -0,0 +1,25 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="WdiScenarioCategory">Windows Memory Leak Diagnosis</string>
<string id="WdiScenarioExecutionPolicy">Configure Scenario Execution Level</string>
<string id="WdiScenarioExecutionPolicyExplain">This policy setting determines whether Diagnostic Policy Service (DPS) diagnoses memory leak problems.
If you enable or do not configure this policy setting, the DPS enables Windows Memory Leak Diagnosis by default.
If you disable this policy setting, the DPS is not able to diagnose memory leak problems.
This policy setting takes effect only under the following conditions:
-- If the diagnostics-wide scenario execution policy is not configured.
-- When the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed.
Note: The DPS can be configured with the Services snap-in to the Microsoft Management Console.
No operating system restart or service restart is required for this policy to take effect. Changes take effect immediately.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/LinkLayerTopologyDiscovery.adml
+40
View File
@@ -0,0 +1,40 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="LLTD_Category">Link-Layer Topology Discovery</string>
<string id="LLTD_Category_Help">Configures all Link-Layer Topology Discovery components.</string>
<string id="LLTD_EnableLLTDIO">Turn on Mapper I/O (LLTDIO) driver</string>
<string id="LLTD_EnableLLTDIO_Help">This policy setting changes the operational behavior of the Mapper I/O network protocol driver.
LLTDIO allows a computer to discover the topology of a network it's connected to. It also allows a computer to initiate Quality-of-Service requests such as bandwidth estimation and network health analysis.
If you enable this policy setting, additional options are available to fine-tune your selection. You may choose the "Allow operation while in domain" option to allow LLTDIO to operate on a network interface that's connected to a managed network. On the other hand, if a network interface is connected to an unmanaged network, you may choose the "Allow operation while in public network" and "Prohibit operation while in private network" options instead.
If you disable or do not configure this policy setting, the default behavior of LLTDIO will apply.</string>
<string id="LLTD_EnableRspndr">Turn on Responder (RSPNDR) driver</string>
<string id="LLTD_EnableRspndr_Help">This policy setting changes the operational behavior of the Responder network protocol driver.
The Responder allows a computer to participate in Link Layer Topology Discovery requests so that it can be discovered and located on the network. It also allows a computer to participate in Quality-of-Service activities such as bandwidth estimation and network health analysis.
If you enable this policy setting, additional options are available to fine-tune your selection. You may choose the "Allow operation while in domain" option to allow the Responder to operate on a network interface that's connected to a managed network. On the other hand, if a network interface is connected to an unmanaged network, you may choose the "Allow operation while in public network" and "Prohibit operation while in private network" options instead.
If you disable or do not configure this policy setting, the default behavior for the Responder will apply.</string>
</stringTable>
<presentationTable>
<presentation id="LLTD_EnableLLTDIO">
<checkBox refId="LLTD_EnableLLTDIO_AllowOnDomain">Allow operation while in domain</checkBox>
<checkBox refId="LLTD_EnableLLTDIO_AllowOnPublicNet">Allow operation while in public network</checkBox>
<checkBox refId="LLTD_EnableLLTDIO_ProhibitOnPrivateNet">Prohibit operation while in private network</checkBox>
</presentation>
<presentation id="LLTD_EnableRspndr">
<checkBox refId="LLTD_EnableRspndr_AllowOnDomain">Allow operation while in domain</checkBox>
<checkBox refId="LLTD_EnableRspndr_AllowOnPublicNet">Allow operation while in public network</checkBox>
<checkBox refId="LLTD_EnableRspndr_ProhibitOnPrivateNet">Prohibit operation while in private network</checkBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/LocalSecurityAuthority.adml
+39
View File
@@ -0,0 +1,39 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Local Security Authority Settings</displayName>
<description>Settings for the Local Security Authority</description>
<resources>
<stringTable>
<string id="LocalSecurityAuthority">Local Security Authority</string>
<string id="AllowCustomSSPsAPs">Allow Custom SSPs and APs to be loaded into LSASS</string>
<string id="AllowCustomSSPsAPs_Help">This policy controls the configuration under which LSASS loads custom SSPs and APs.
If you enable this setting or do not configure it, LSA allows custom SSPs and APs to be loaded.
If you disable this setting, LSA does not load custom SSPs and APs.</string>
<string id="ConfigureLsaProtectedProcess">Configures LSASS to run as a protected process</string>
<string id="ConfigureLsaProtectedProcess_Help">This policy controls the configuration under which LSASS is run.
If you do not configure this policy and there is no current setting in the registry, LSA will run as protected process for clean installed, HVCI capable, client SKUs that are domain or cloud domain joined devices. This configuration is not UEFI locked. This can be overridden if the policy is configured.
If you configure and set this policy setting to "Disabled", LSA will not run as a protected process.
If you configure and set this policy setting to "EnabledWithUEFILock," LSA will run as a protected process and this configuration is UEFI locked.
If you configure and set this policy setting to "EnabledWithoutUEFILock", LSA will run as a protected process and this configuration is not UEFI locked. </string>
<string id="ConfigureLsaProtectedProcess_Disabled">Disabled</string>
<string id="ConfigureLsaProtectedProcess_EnabledWithUEFILock">Enabled with UEFI Lock</string>
<string id="ConfigureLsaProtectedProcess_EnabledWithoutUEFILock">Enabled without UEFI Lock</string>
</stringTable>
<presentationTable>
<presentation id="ConfigureLsaProtectedProcess">
<dropdownList refId="ConfigureLsaProtectedProcess" noSort="true">Configure LSA to run as a protected process</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/LocationProviderAdm.adml
+18
View File
@@ -0,0 +1,18 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="DisableWindowsLocationProvider">Turn off Windows Location Provider</string>
<string id="DisableWindowsLocationProvider_Explain">
This policy setting turns off the Windows Location Provider feature for this computer.
If you enable this policy setting, the Windows Location Provider feature will be turned off, and all programs on this computer will not be able to use the Windows Location Provider feature.
If you disable or do not configure this policy setting, all programs on this computer can use the Windows Location Provider feature.</string>
<string id="WindowsLocationProvider">Windows Location Provider</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/Logon.adml
+180
View File
@@ -0,0 +1,180 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="UseOEMBackground">Always use custom logon background</string>
<string id="UseOEMBackground_Help">This policy setting ignores Windows Logon Background.
This policy setting may be used to make Windows give preference to a custom logon background.
If you enable this policy setting, the logon screen always attempts to load a custom background instead of the Windows-branded logon background.
If you disable or do not configure this policy setting, Windows uses the default Windows logon background or custom background.</string>
<string id="DisableExplorerRunLegacy">Do not process the legacy run list</string>
<string id="DisableExplorerRunLegacy_Help">This policy setting ignores the customized run list.
You can create a customized list of additional programs and documents that the system starts automatically when it runs on Windows Vista, Windows XP Professional, and Windows 2000 Professional. These programs are added to the standard run list of programs and services that the system starts.
If you enable this policy setting, the system ignores the run list for Windows Vista, Windows XP Professional, and Windows 2000 Professional.
If you disable or do not configure this policy setting, Windows Vista adds any customized run list configured to its run list.
This policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration.
Note: To create a customized run list by using a policy setting, use the ""Run these applications at startup"" policy setting.
Also, see the ""Do not process the run once list"" policy setting.</string>
<string id="DontDisplayNetworkSelectionUI">Do not display network selection UI</string>
<string id="DontDisplayNetworkSelectionUI_Help">This policy setting allows you to control whether anyone can interact with available networks UI on the logon screen.
If you enable this policy setting, the PC's network connectivity state cannot be changed without signing into Windows.
If you disable or don't configure this policy setting, any user can disconnect the PC from the network or can connect the PC to other available networks without signing into Windows.</string>
<string id="DisableExplorerRunOnceLegacy">Do not process the run once list</string>
<string id="DisableExplorerRunOnceLegacy_Help">This policy setting ignores customized run-once lists.
You can create a customized list of additional programs and documents that are started automatically the next time the system starts (but not thereafter). These programs are added to the standard list of programs and services that the system starts.
If you enable this policy setting, the system ignores the run-once list.
If you disable or do not configure this policy setting, the system runs the programs in the run-once list.
This policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration.
Note: Customized run-once lists are stored in the registry in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce.
Also, see the ""Do not process the legacy run list"" policy setting.</string>
<string id="DisableStatusMessages">Remove Boot / Shutdown / Logon / Logoff status messages</string>
<string id="DisableStatusMessages_Help">This policy setting suppresses system status messages.
If you enable this setting, the system does not display a message reminding users to wait while their system starts or shuts down, or while users log on or off.
If you disable or do not configure this policy setting, the system displays the message reminding users to wait while their system starts or shuts down, or while users log on or off.</string>
<string id="Logon">Logon</string>
<string id="LogonType">Always use classic logon</string>
<string id="LogonType_Help">This policy is not available in this version of Windows.</string>
<string id="NoWelcomeTips">Do not display the Getting Started welcome screen at logon</string>
<string id="NoWelcomeTips_Help">This policy setting hides the welcome screen that is displayed on Windows 2000 Professional each time the user logs on.
If you enable this policy setting, the welcome screen is hidden from the user logging on to a computer where this policy is applied.
Users can still display the welcome screen by selecting it on the Start menu or by typing ""Welcome"" in the Run dialog box.
If you disable or do not configure this policy, the welcome screen is displayed each time a user logs on to the computer.
This setting applies only to Windows 2000 Professional. It does not affect the ""Configure Your Server on a Windows 2000 Server"" screen on Windows 2000 Server.
Note: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.
Tip: To display the welcome screen, click Start, point to Programs, point to Accessories, point to System Tools, and then click ""Getting Started."" To suppress the welcome screen without specifying a setting, clear the ""Show this screen at startup"" check box on the welcome screen.</string>
<string id="Run">Run these programs at user logon</string>
<string id="Run_Help">This policy setting specifies additional programs or documents that Windows starts automatically when a user logs on to the system.
If you enable this policy setting, you can specify which programs can run at the time the user logs on to this computer that has this policy applied.
To specify values for this policy setting, click Show. In the Show Contents dialog box in the Value column, type the name of the executable program (.exe) file or document file. To specify another name, press ENTER, and type the name. Unless the file is located in the %Systemroot% directory, you must specify the fully qualified path to the file.
If you disable or do not configure this policy setting, the user will have to start the appropriate programs after logon.
Note: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the system starts the programs specified in the Computer Configuration setting just before it starts the programs specified in the User Configuration setting.
Also, see the ""Do not process the legacy run list"" and the ""Do not process the run once list"" settings.</string>
<string id="SyncForegroundPolicy">Always wait for the network at computer startup and logon</string>
<string id="SyncForegroundPolicy_Help">This policy setting determines whether Group Policy processing is synchronous (that is, whether computers wait for the network to be fully initialized during computer startup and user logon). By default, on client computers, Group Policy processing is not synchronous; client computers typically do not wait for the network to be fully initialized at startup and logon. Existing users are logged on using cached credentials, which results in shorter logon times. Group Policy is applied in the background after the network becomes available.
Note that because this is a background refresh, extensions such as Software Installation and Folder Redirection take two logons to apply changes. To be able to operate safely, these extensions require that no users be logged on. Therefore, they must be processed in the foreground before users are actively using the computer. In addition, changes that are made to the user object, such as adding a roaming profile path, home directory, or user object logon script, may take up to two logons to be detected.
If a user with a roaming profile, home directory, or user object logon script logs on to a computer, computers always wait for the network to be initialized before logging the user on. If a user has never logged on to this computer before, computers always wait for the network to be initialized.
If you enable this policy setting, computers wait for the network to be fully initialized before users are logged on. Group Policy is applied in the foreground, synchronously.
On servers running Windows Server 2008 or later, this policy setting is ignored during Group Policy processing at computer startup and Group Policy processing will be synchronous (these servers wait for the network to be initialized during computer startup).
If the server is configured as follows, this policy setting takes effect during Group Policy processing at user logon:
• The server is configured as a terminal server (that is, the Terminal Server role service is installed and configured on the server); and
• The “Allow asynchronous user Group Policy processing when logging on through Terminal Services” policy setting is enabled. This policy setting is located under Computer Configuration\Policies\Administrative templates\System\Group Policy\.
If this configuration is not implemented on the server, this policy setting is ignored. In this case, Group Policy processing at user logon is synchronous (these servers wait for the network to be initialized during user logon).
If you disable or do not configure this policy setting and users log on to a client computer or a server running Windows Server 2008 or later and that is configured as described earlier, the computer typically does not wait for the network to be fully initialized. In this case, users are logged on with cached credentials. Group Policy is applied asynchronously in the background.
Notes:
-If you want to guarantee the application of Folder Redirection, Software Installation, or roaming user profile settings in just one logon, enable this policy setting to ensure that Windows waits for the network to be available before applying policy.
-If Folder Redirection policy will apply during the next logon, security policies will be applied asynchronously during the next update cycle, if network connectivity is available.</string>
<string id="VerboseStatus">Display highly detailed status messages</string>
<string id="VerboseStatus_Help">This policy setting directs the system to display highly detailed status messages.
This policy setting is designed for advanced users who require this information.
If you enable this policy setting, the system displays status messages that reflect each step in the process of starting, shutting down, logging on, or logging off the system.
If you disable or do not configure this policy setting, only the default status messages are displayed to the user during these processes.
Note: This policy setting is ignored if the ""Remove Boot/Shutdown/Logon/Logoff status messages"" policy setting is enabled.</string>
<string id="HideFastUserSwitching">Hide entry points for Fast User Switching</string>
<string id="HideFastUserSwitching_Help">This policy setting allows you to hide the Switch User interface in the Logon UI, the Start menu and the Task Manager.
If you enable this policy setting, the Switch User interface is hidden from the user who is attempting to log on or is logged on to the computer that has this policy applied.
The locations that Switch User interface appear are in the Logon UI, the Start menu and the Task Manager.
If you disable or do not configure this policy setting, the Switch User interface is accessible to the user in the three locations.</string>
<string id="DisableStartupSound">Turn off Windows Startup sound</string>
<string id="DisableStartupSound_Help">This policy is not available in this version of Windows.</string>
<string id="EnableFirstLogonAnimation">Show first sign-in animation </string>
<string id="EnableFirstLogonAnimation_Help">This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users will be offered the opt-in prompt for services during their first sign-in.
If you enable this policy setting, Microsoft account users will see the opt-in prompt for services, and users with other accounts will see the sign-in animation.
If you disable this policy setting, users will not see the animation and Microsoft account users will not see the opt-in prompt for services.
If you do not configure this policy setting, the user who completes the initial Windows setup will see the animation during their first sign-in. If the first user had already completed the initial setup and this policy setting is not configured, users new to this computer will not see the animation.
Note: The first sign-in animation will not be shown on Server, so this policy will have no effect.
</string>
<string id="DontEnumerateConnectedUsers">Do not enumerate connected users on domain-joined computers</string>
<string id="DontEnumerateConnectedUsers_Help">This policy setting prevents connected users from being enumerated on domain-joined computers.
If you enable this policy setting, the Logon UI will not enumerate any connected users on domain-joined computers.
If you disable or do not configure this policy setting, connected users will be enumerated on domain-joined computers.</string>
<string id="EnumerateLocalUsers">Enumerate local users on domain-joined computers</string>
<string id="EnumerateLocalUsers_Help">This policy setting allows local users to be enumerated on domain-joined computers.
If you enable this policy setting, Logon UI will enumerate all local users on domain-joined computers.
If you disable or do not configure this policy setting, the Logon UI will not enumerate local users on domain-joined computers.</string>
<string id="BlockUserFromShowingAccountDetailsOnSignin">Block user from showing account details on sign-in</string>
<string id="BlockUserFromShowingAccountDetailsOnSignin_Help">This policy prevents the user from showing account details (email address or user name) on the sign-in screen.
If you enable this policy setting, the user cannot choose to show account details on the sign-in screen.
If you disable or do not configure this policy setting, the user may choose to show account details on the sign-in screen.</string>
<string id="DisableLockScreenAppNotifications">Turn off app notifications on the lock screen</string>
<string id="DisableLockScreenAppNotifications_Help">This policy setting allows you to prevent app notifications from appearing on the lock screen.
If you enable this policy setting, no app notifications are displayed on the lock screen.
If you disable or do not configure this policy setting, users can choose which apps display notifications on the lock screen.</string>
<string id="DisableAcrylicBackgroundOnLogon">Show clear logon background</string>
<string id="DisableAcrylicBackgroundOnLogon_Help">This policy setting disables the acrylic blur effect on logon background image.
If you enable this policy, the logon background image shows without blur.
If you disable or do not configure this policy, the logon background image adopts the acrylic blur effect.
</string>
</stringTable>
<presentationTable>
<presentation id="Run_1">
<listBox refId="RunListBox1">Items to run at logon</listBox>
</presentation>
<presentation id="Run_2">
<listBox refId="RunListBox2">Items to run at logon</listBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/MDM.adml
+44
View File
@@ -0,0 +1,44 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2016 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="MDM">MDM</string>
<string id="MDM_MDM_DisplayName">Disable MDM Enrollment</string>
<string id="MDM_MDM_Help">This policy setting specifies whether Mobile Device Management (MDM) Enrollment is allowed. When MDM is enabled, it allows the user to have the computer remotely managed by a MDM Server.
If you do not configure this policy setting, MDM Enrollment will be enabled.
If you enable this policy setting, MDM Enrollment will be disabled for all users. It will not unenroll existing MDM enrollments.
If you disable this policy setting, MDM Enrollment will be enabled for all users.
</string>
<string id="MDM_JoinMDM_DisplayName">Enable automatic MDM enrollment using default Azure AD credentials</string>
<string id="MDM_JoinMDM_Help">
This policy setting specifies whether to automatically enroll the device to the Mobile Device Management (MDM) service configured in Azure Active Directory (Azure AD). If the enrollment is successful, the device will remotely managed by the MDM service.
Important: The device must be registered in Azure AD for enrollment to succeed.
If you do not configure this policy setting, automatic MDM enrollment will not be initiated.
If you enable this policy setting, a task is created to initiate enrollment of the device to MDM service specified in the Azure AD.
If you disable this policy setting, MDM will be unenrolled.
</string>
<string id="UserCredential">User Credential</string>
<string id="DeviceCredential">Device Credential</string>
</stringTable>
<presentationTable>
<presentation id="AutoEnrollMDM">
<dropdownList refId="UseAADCredentialTypeDrop" defaultItem="1">Select Credential Type to Use:</dropdownList>
<textBox refId="MDMApplicationId">
<label>MDM Application ID:</label>
</textBox>
<text>MDM Application ID represents the ID of your MDM application that is configured in Azure AD. This is optional and only required for automatic MDM enrollment using device credentials when multiple MDM applications are configured in Azure AD.</text>
<text/>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/MMC.adml
+55
View File
@@ -0,0 +1,55 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="MMC">Microsoft Management Console</string>
<string id="MMC_ActiveXControl">ActiveX Control</string>
<string id="MMC_ExtendView">Extended View (Web View)</string>
<string id="MMC_ExtensionSnapins">Extension snap-ins</string>
<string id="MMC_LinkToWeb">Link to Web Address</string>
<string id="MMC_RESTRICT">Restricted/Permitted snap-ins</string>
<string id="MMC_Restrict_Author">Restrict the user from entering author mode</string>
<string id="MMC_restrict_Author_Explain">Prevents users from entering author mode.
This setting prevents users from opening the Microsoft Management Console (MMC) in author mode, explicitly opening console files in author mode, and opening any console files that open in author mode by default.
As a result, users cannot create console files or add or remove snap-ins. Also, because they cannot open author-mode console files, they cannot use the tools that the files contain.
This setting permits users to open MMC user-mode console files, such as those on the Administrative Tools menu in Windows 2000 Server family or Windows Server 2003 family. However, users cannot open a blank MMC console window on the Start menu. (To open the MMC, click Start, click Run, and type mmc.) Users also cannot open a blank MMC console window from a command prompt.
If you disable this setting or do not configure it, users can enter author mode and open author-mode console files.</string>
<string id="MMC_Restrict_Explain">Permits or prohibits use of this snap-in.
If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.
If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.
-- If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.
To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.
-- If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.
To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.
When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.</string>
<string id="MMC_Restrict_To_Permitted_Snapins">Restrict users to the explicitly permitted list of snap-ins</string>
<string id="MMC_restrict_To_Permitted_Snapins_Explain">Lets you selectively permit or prohibit the use of Microsoft Management Console (MMC) snap-ins.
-- If you enable this setting, all snap-ins are prohibited, except those that you explicitly permit. Use this setting if you plan to prohibit use of most snap-ins.
To explicitly permit a snap-in, open the Restricted/Permitted snap-ins setting folder and enable the settings representing the snap-in you want to permit. If a snap-in setting in the folder is disabled or not configured, the snap-in is prohibited.
-- If you disable this setting or do not configure it, all snap-ins are permitted, except those that you explicitly prohibit. Use this setting if you plan to permit use of most snap-ins.
To explicitly prohibit a snap-in, open the Restricted/Permitted snap-ins setting folder and then disable the settings representing the snap-ins you want to prohibit. If a snap-in setting in the folder is enabled or not configured, the snap-in is permitted.
When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.
Note: If you enable this setting, and you do not enable any settings in the Restricted/Permitted snap-ins folder, users cannot use any MMC snap-ins.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/MMCSnapins.adml
+131
View File
@@ -0,0 +1,131 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="MMC_ActiveDirDomTrusts">Active Directory Domains and Trusts</string>
<string id="MMC_ActiveDirSitesServices">Active Directory Sites and Services</string>
<string id="MMC_ActiveDirUsersComp">Active Directory Users and Computers</string>
<string id="MMC_ADMComputers">Administrative Templates (Computers)</string>
<string id="MMC_ADMUsers">Administrative Templates (Users)</string>
<string id="MMC_ADSI">ADSI Edit</string>
<string id="MMC_AppleTalkRouting">AppleTalk Routing</string>
<string id="MMC_AuthMan">Authorization Manager</string>
<string id="MMC_CertAuth">Certification Authority</string>
<string id="MMC_CertAuthPolSet">Certification Authority Policy Settings</string>
<string id="MMC_Certs">Certificates</string>
<string id="MMC_CertsTemplate">Certificate Templates</string>
<string id="MMC_ComponentServices">Component Services</string>
<string id="MMC_ComputerManagement">Computer Management</string>
<string id="MMC_ConnectionSharingNAT">Connection Sharing (NAT)</string>
<string id="MMC_DCOMCFG">DCOM Configuration Extension</string>
<string id="MMC_DeviceManager">Device Manager</string>
<string id="MMC_DFS">Distributed File System</string>
<string id="MMC_DHCPRelayMgmt">DHCP Relay Management</string>
<string id="MMC_DiskDefrag">Disk Defragmenter</string>
<string id="MMC_DiskMgmt">Disk Management</string>
<string id="MMC_EnterprisePKI">Enterprise PKI</string>
<string id="MMC_EventViewer">Event Viewer</string>
<string id="MMC_EventViewer_2">Event Viewer (Windows Vista)</string>
<string id="MMC_FailoverClusters">Failover Clusters Manager</string>
<string id="MMC_FAXService">FAX Service</string>
<string id="MMC_FolderRedirection">Folder Redirection</string>
<string id="MMC_FrontPageExt">FrontPage Server Extensions</string>
<string id="MMC_GroupPolicy">Group Policy</string>
<string id="MMC_GroupPolicy_GPSnapin">Group Policy snap-in extensions</string>
<string id="MMC_GroupPolicy_GPSnapin_Help">Allows you to permit and prohibit the use of the Group Policy Object Editor snap-in and its extensions.</string>
<string id="MMC_GroupPolicy_RSoPSnapin">Resultant Set of Policy snap-in extensions</string>
<string id="MMC_GroupPolicyManagementSnapIn">Group Policy Management</string>
<string id="MMC_GroupPolicySnapIn">Group Policy Object Editor</string>
<string id="MMC_GroupPolicyTab">Group Policy tab for Active Directory Tools</string>
<string id="MMC_GroupPolicyTab_Explain">Permits or prohibits use of the Group Policy tab in property sheets for the Active Directory Users and Computers and Active Directory Sites and Services snap-ins.
If you enable this setting, the Group Policy tab is displayed in the property sheet for a site, domain, or organizational unit displayed by the Active Directory Users and Computers and Active Directory Sites and Services snap-ins. If you disable the setting, the Group Policy tab is not displayed in those snap-ins.
If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this tab is displayed.
-- If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users will not have access to the Group Policy tab.
To explicitly permit use of the Group Policy tab, enable this setting. If this setting is not configured (or disabled), the Group Policy tab is inaccessible.
-- If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users will have access to the Group Policy tab.
To explicitly prohibit use of the Group Policy tab, disable this setting. If this setting is not configured (or enabled), the Group Policy tab is accessible.
When the Group Policy tab is inaccessible, it does not appear in the site, domain, or organizational unit property sheets.</string>
<string id="MMC_HRA">Health Registration Authority (HRA)</string>
<string id="MMC_IAS">Internet Authentication Service (IAS)</string>
<string id="MMC_IASLogging">IAS Logging</string>
<string id="MMC_IEMaintenance">Internet Explorer Maintenance</string>
<string id="MMC_IGMPRouting">IGMP Routing</string>
<string id="MMC_IIS">Internet Information Services</string>
<string id="MMC_IndexingService">Indexing Service</string>
<string id="MMC_IPRouting">IP Routing</string>
<string id="MMC_IpSecManage">IP Security Policy Management</string>
<string id="MMC_IpSecMonitor">IP Security Monitor</string>
<string id="MMC_IPXRIPRouting">IPX RIP Routing</string>
<string id="MMC_IPXRouting">IPX Routing</string>
<string id="MMC_IPXSAPRouting">IPX SAP Routing</string>
<string id="MMC_LocalUsersGroups">Local Users and Groups</string>
<string id="MMC_LogicalMappedDrives">Logical and Mapped Drives</string>
<string id="MMC_NapSnap">NAP Client Configuration</string>
<string id="MMC_NPSUI">Network Policy Server (NPS)</string>
<string id="MMC_Net_Framework">.Net Framework Configuration</string>
<string id="MMC_OCSP">Online Responder</string>
<string id="MMC_OSPFRouting">OSPF Routing</string>
<string id="MMC_PerfLogsAlerts">Performance Logs and Alerts</string>
<string id="MMC_PublicKey">Public Key Policies</string>
<string id="MMC_QoSAdmission">QoS Admission Control</string>
<string id="MMC_RAS_DialinUser">RAS Dialin - User Node</string>
<string id="MMC_RemoteAccess">Remote Access</string>
<string id="MMC_RemoteDesktop">Remote Desktops</string>
<string id="MMC_RemStore">Removable Storage</string>
<string id="MMC_Restrict_Explain">This policy setting permits or prohibits the use of this snap-in.
If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console.
If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in.
If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.
-- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited.
-- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted.
When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.</string>
<string id="MMC_ResultantSetOfPolicySnapIn">Resultant Set of Policy snap-in</string>
<string id="MMC_RIPRouting">RIP Routing</string>
<string id="MMC_RIS">Remote Installation Services</string>
<string id="MMC_Routing">Routing</string>
<string id="MMC_RRA">Routing and Remote Access</string>
<string id="MMC_RSM">Removable Storage Management</string>
<string id="MMC_SCA">Security Configuration and Analysis</string>
<string id="MMC_ScriptsMachine">Scripts (Startup/Shutdown)</string>
<string id="MMC_ScriptsUser">Scripts (Logon/Logoff)</string>
<string id="MMC_SecuritySettings">Security Settings</string>
<string id="MMC_SecurityTemplates">Security Templates</string>
<string id="MMC_SendConsoleMessage">Send Console Message</string>
<string id="MMC_ServerManager">Server Manager</string>
<string id="MMC_ServiceDependencies">Service Dependencies</string>
<string id="MMC_Services">Services</string>
<string id="MMC_SharedFolders">Shared Folders</string>
<string id="MMC_SharedFolders_Ext">Shared Folders Ext</string>
<string id="MMC_SMTPProtocol">SMTP Protocol</string>
<string id="MMC_SNMP">SNMP</string>
<string id="MMC_SoftwareInstalationComputers">Software Installation (Computers)</string>
<string id="MMC_SoftwareInstallationUsers">Software Installation (Users)</string>
<string id="MMC_SysInfo">System Information</string>
<string id="MMC_SysProp">System Properties</string>
<string id="MMC_Telephony">Telephony</string>
<string id="MMC_TerminalServices">Remote Desktop Services Configuration</string>
<string id="MMC_TPMManagement">TPM Management</string>
<string id="MMC_WindowsFirewall">Windows Firewall with Advanced Security</string>
<string id="MMC_WirelessMon">Wireless Monitor</string>
<string id="MMC_WirelessNetworkPolicy">Wireless Network (IEEE 802.11) Policies</string>
<string id="MMC_WiredNetworkPolicy">Wired Network (IEEE 802.3) Policies</string>
<string id="MMC_WMI">WMI Control</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/MSAPolicy.adml
+19
View File
@@ -0,0 +1,19 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Microsoft account</displayName>
<description>Configuration for Microsoft account</description>
<resources>
<stringTable>
<string id="MicrosoftAccountCategory">Microsoft account</string>
<string id="MicrosoftAccount_DisableUserAuth">Block all consumer Microsoft account user authentication</string>
<string id="MicrosoftAccount_DisableUserAuthExplain">This setting controls whether users can provide Microsoft accounts for authentication for applications or services. If this setting is enabled, all applications and services on the device are prevented from using Microsoft accounts for authentication.
This applies both to existing users of a device and new users who may be added. However, any application or service that has already authenticated a user will not be affected by enabling this setting until the authentication cache expires.
It is recommended to enable this setting before any user signs in to a device to prevent cached tokens from being present. If this setting is disabled or not configured, applications and services can use Microsoft accounts for authentication.
By default, this setting is Disabled. This setting does not affect whether users can sign in to devices by using Microsoft accounts, or the ability for users to provide Microsoft accounts via the browser for authentication with web-based applications.
</string>
<string id="MicrosoftAccount_RestrictToEnterpriseDeviceAuthenticationOnly">Only allow device authentication for the Microsoft Account Sign-In Assistant</string>
<string id="MicrosoftAccount_RestrictToEnterpriseDeviceAuthenticationOnlyExplain">This setting determines whether to only allow enterprise device authentication for the Microsoft Account Sign-in Assistant service (wlidsvc). By default, this setting is disabled and allows both user and device authentication. When the value is set to 1, only allow device authentication, and block user authentication.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/MSDT.adml
+99
View File
@@ -0,0 +1,99 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="WdiScenarioCategory">Microsoft Support Diagnostic Tool</string>
<string id="WdiScenarioExecutionPolicy">Microsoft Support Diagnostic Tool: Configure execution level</string>
<string id="WdiScenarioExecutionPolicyExplain">This policy setting determines the execution level for Microsoft Support Diagnostic Tool.
Microsoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals.
If you enable this policy setting, administrators can use MSDT to collect and send diagnostic data to a support professional to resolve a problem.
If you disable this policy setting, MSDT cannot gather diagnostic data.
If you do not configure this policy setting, MSDT is turned on by default.
This policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.
No reboots or service restarts are required for this policy setting to take effect. Changes take effect immediately.
This policy setting will only take effect when the Diagnostic Policy Service (DPS) is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console.</string>
<string id="MsdtToolDownloadPolicy">Microsoft Support Diagnostic Tool: Restrict tool download</string>
<string id="MsdtToolDownloadPolicyExplain">This policy setting restricts the tool download policy for Microsoft Support Diagnostic Tool.
Microsoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals. For some problems, MSDT may prompt the user to download additional tools for troubleshooting.
These tools are required to completely troubleshoot the problem. If tool download is restricted, it may not be possible to find the root cause of the problem.
If you enable this policy setting for remote troubleshooting, MSDT prompts the user to download additional tools to diagnose problems on remote computers only. If you enable this policy setting for local and remote troubleshooting, MSDT always prompts for additional tool downloading.
If you disable this policy setting, MSDT never downloads tools, and is unable to diagnose problems on remote computers.
If you do not configure this policy setting, MSDT prompts the user before downloading any additional tools.
No reboots or service restarts are required for this policy setting to take effect. Changes take effect immediately.
This policy setting will take effect only when MSDT is enabled.
This policy setting will only take effect when the Diagnostic Policy Service (DPS) is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console.</string>
<string id="MsdtToolDownloadPolicyLevelRemoteOnly">Remote troubleshooting only</string>
<string id="MsdtToolDownloadPolicyLevelAllowAll">Local and remote troubleshooting</string>
<string id="MsdtSupportProvider">Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider</string>
<string id="MsdtSupportProviderExplain">This policy setting configures Microsoft Support Diagnostic Tool (MSDT) interactive communication with the support provider. MSDT gathers diagnostic data for analysis by support professionals.
If you enable this policy setting, users can use MSDT to collect and send diagnostic data to a support professional to resolve a problem.
By default, the support provider is set to Microsoft Corporation.
If you disable this policy setting, MSDT cannot run in support mode, and no data can be collected or sent to the support provider.
If you do not configure this policy setting, MSDT support mode is enabled by default.
No reboots or service restarts are required for this policy setting to take effect. Changes take effect immediately.
</string>
<string id="TroubleshootingAllowRecommendations">Troubleshooting: Allow users to access recommended troubleshooting for known problems</string>
<string id="TroubleshootingAllowRecommendationsExplain">This policy setting configures how troubleshooting for known problems can be applied on the device and lets administrators configure how it's applied to their domains/IT environments.
Not configuring this policy setting will allow the user to configure how troubleshooting is applied.
Enabling this policy allows you to configure how troubleshooting is applied on the user's device. You can select from one of the following values:
0 = Do not allow users, system features, or Microsoft to apply troubleshooting.
1 = Only automatically apply troubleshooting for critical problems by system features and Microsoft.
2 = Automatically apply troubleshooting for critical problems by system features and Microsoft. Notify users when troubleshooting for other problems is available and allow users to choose to apply or ignore.
3 = Automatically apply troubleshooting for critical and other problems by system features and Microsoft. Notify users when troubleshooting has solved a problem.
4 = Automatically apply troubleshooting for critical and other problems by system features and Microsoft. Do not notify users when troubleshooting has solved a problem.
5 = Allow the user to choose their own troubleshooting settings.
After setting this policy, you can use the following instructions to check devices in your domain for available troubleshooting from Microsoft:
1. Create a bat script with the following contents:
rem The following batch script triggers Recommended Troubleshooting
schtasks /run /TN "\Microsoft\Windows\Diagnosis\RecommendedTroubleshootingScanner"
2. To create a new immediate task, navigate to the Group Policy Management Editor &gt; Computer Configuration &gt; Preferences and select Control Panel Settings.
3. Under Control Panel settings, right-click on Scheduled Tasks and select New. Select Immediate Task (At least Windows 7).
4. Provide name and description as appropriate, then under Security Options set the user account to System and select the Run with highest privileges checkbox.
5. In the Actions tab, create a new action, select Start a Program as its type, then enter the file created in step 1.
6. Configure the task to deploy to your domain.</string>
<string id="RecommendationsDropDown_DoNothing">Do not allow users, system features, or Microsoft to apply troubleshooting.</string>
<string id="RecommendationsDropDown_ApplyCoreSystemMitigationsOnly">Only automatically apply troubleshooting for critical problems by system features and Microsoft.</string>
<string id="RecommendationsDropDown_AskFirst">Automatically apply troubleshooting for critical problems by system features and Microsoft. Notify users when troubleshooting for other problems is available and allow users to choose to apply or ignore.</string>
<string id="RecommendationsDropDown_ApplyThenNotify">Automatically apply troubleshooting for critical and other problems by system features and Microsoft. Notify users when troubleshooting has solved a problem.</string>
<string id="RecommendationsDropDown_ApplySilently">Automatically apply troubleshooting for critical and other problems by system features and Microsoft. Do not notify users when troubleshooting has solved a problem.</string>
<string id="RecommendationsDropDown_DeferToUser">Allow the user to choose their own troubleshooting settings.</string>
</stringTable>
<presentationTable>
<presentation id="MsdtToolDownloadPolicy">
<dropdownList refId="MsdtToolDownloadPolicyLevel" noSort="true" defaultItem="1">Tool downloads allowed</dropdownList>
</presentation>
<presentation id="TroubleshootingAllowRecommendations">
<dropdownList refId="TroubleshootingAllowRecommendations_Dropdown" noSort="true" defaultItem="0">Allow recommended troubleshooting from Microsoft for known problems</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/MSI.adml
+330
View File
@@ -0,0 +1,330 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="AllowLockdownBrowse">Allow users to browse for source while elevated</string>
<string id="AllowLockdownBrowse_Help">This policy setting allows users to search for installation files during privileged installations.
If you enable this policy setting, the Browse button in the "Use feature from" dialog box is enabled. As a result, users can search for installation files even when the installation program is running with elevated system privileges.
Because the installation is running with elevated system privileges, users can browse through directories that their own permissions would not allow.
This policy setting does not affect installations that run in the user's security context. Also, see the "Remove browse dialog box for new source" policy setting.
If you disable or do not configure this policy setting, by default, only system administrators can browse during installations with elevated privileges, such as installations offered on the desktop or displayed in Add or Remove Programs.</string>
<string id="AllowLockdownMedia">Allow users to use media source while elevated</string>
<string id="AllowLockdownMedia_Help">This policy setting allows users to install programs from removable media during privileged installations.
If you enable this policy setting, all users are permitted to install programs from removable media, such as floppy disks and CD-ROMs, even when the installation program is running with elevated system privileges.
This policy setting does not affect installations that run in the user's security context. By default, users can install from removable media when the installation runs in their own security context.
If you disable or do not configure this policy setting, by default, users can install programs from removable media only when the installation runs in the user's security context. During privileged installations, such as those offered on the desktop or displayed in Add or Remove Programs, only system administrators can install from removable media.
Also, see the "Prevent removable media source for any install" policy setting.</string>
<string id="AllowLockdownPatch">Allow users to patch elevated products</string>
<string id="AllowLockdownPatch_Help">This policy setting allows users to patch elevated products.
If you enable this policy setting, all users are permitted to install patches, even when the installation program is running with elevated system privileges. Patches are updates or upgrades that replace only those program files that have changed. Because patches can easily be vehicles for malicious programs, some installations prohibit their use.
If you disable or do not configure this policy setting, by default, only system administrators can apply patches during installations with elevated privileges, such as installations offered on the desktop or displayed in Add or Remove Programs.
This policy setting does not affect installations that run in the user's security context. By default, users can install patches to programs that run in their own security context. Also, see the "Prohibit patching" policy setting.</string>
<string id="AlwaysInstallElevated">Always install with elevated privileges</string>
<string id="AlwaysInstallElevated_Help">This policy setting directs Windows Installer to use elevated permissions when it installs any program on the system.
If you enable this policy setting, privileges are extended to all programs. These privileges are usually reserved for programs that have been assigned to the user (offered on the desktop), assigned to the computer (installed automatically), or made available in Add or Remove Programs in Control Panel. This profile setting lets users install programs that require access to directories that the user might not have permission to view or change, including directories on highly restricted computers.
If you disable or do not configure this policy setting, the system applies the current user's permissions when it installs programs that a system administrator does not distribute or offer.
Note: This policy setting appears both in the Computer Configuration and User Configuration folders. To make this policy setting effective, you must enable it in both folders.
Caution: Skilled users can take advantage of the permissions this policy setting grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this policy setting is not guaranteed to be secure.</string>
<string id="AutomaticApplicationShutdownOn">Restart Manager On</string>
<string id="AutomaticApplicationShutdownOff">Restart Manager Off</string>
<string id="LegacyAutomaticApplicationShutdownOff">Restart Manager Off for Legacy App Setup</string>
<string id="DisableAlways">Always</string>
<string id="DisableAutomaticApplicationShutdown">Prohibit use of Restart Manager</string>
<string id="DisableAutomaticApplicationShutdown_Help">This policy setting controls Windows Installer's interaction with the Restart Manager. The Restart Manager API can eliminate or reduce the number of system restarts that are required to complete an installation or update.
If you enable this policy setting, you can use the options in the Prohibit Use of Restart Manager box to control file in use detection behavior.
-- The "Restart Manager On" option instructs Windows Installer to use Restart Manager to detect files in use and mitigate a system restart, when possible.
-- The "Restart Manager Off" option turns off Restart Manager for file in use detection and the legacy file in use behavior is used.
-- The "Restart Manager Off for Legacy App Setup" option applies to packages that were created for Windows Installer versions lesser than 4.0. This option lets those packages display the legacy files in use UI while still using Restart Manager for detection.
If you disable or do not configure this policy setting, Windows Installer will use Restart Manager to detect files in use and mitigate a system restart, when possible.</string>
<string id="DisableBrowse">Remove browse dialog box for new source</string>
<string id="DisableBrowse_Help">
This policy setting prevents users from searching for installation files when they add features or components to an installed program.
If you enable this policy setting, the Browse button beside the "Use feature from" list in the Windows Installer dialog box is disabled. As a result, users must select an installation file source from the "Use features from" list that the system administrator configures.
This policy setting applies even when the installation is running in the user's security context.
If you disable or do not configure this policy setting, the Browse button is enabled when an installation is running in the user's security context. But only system administrators can browse when an installation is running with elevated system privileges, such as installations offered on the desktop or in Add or Remove Programs.
This policy setting affects Windows Installer only. It does not prevent users from selecting other browsers, such as File Explorer or Network Locations, to search for installation files.
Also, see the "Enable user to browse for source while elevated" policy setting.</string>
<string id="DisableFlyweightPatching">Prohibit flyweight patching</string>
<string id="DisableFlyweightPatching_Help">This policy setting controls the ability to turn off all patch optimizations.
If you enable this policy setting, all Patch Optimization options are turned off during the installation.
If you disable or do not configure this policy setting, it enables faster application of patches by removing execution of unnecessary actions. The flyweight patching mode is primarily designed for patches that just update a few files or registry values. The Installer will analyze the patch for specific changes to determine if optimization is possible. If so, the patch will be applied using a minimal set of processing.</string>
<string id="DisableLoggingFromPackageOff">Disable logging via package settings off</string>
<string id="DisableLoggingFromPackageOn">Disable logging via package settings on</string>
<string id="DisableLoggingFromPackage">Turn off logging via package settings</string>
<string id="DisableLoggingFromPackage_Help">This policy setting controls Windows Installer's processing of the MsiLogging property. The MsiLogging property in an installation package can be used to enable automatic logging of all install operations for the package.
If you enable this policy setting, you can use the options in the Disable logging via package settings box to control automatic logging via package settings behavior.
-- The "Logging via package settings on" option instructs Windows Installer to automatically generate log files for packages that include the MsiLogging property.
-- The "Logging via package settings off" option turns off the automatic logging behavior when specified via the MsiLogging policy. Log files can still be generated using the logging command line switch or the Logging policy.
If you disable or do not configure this policy setting, Windows Installer will automatically generate log files for those packages that include the MsiLogging property.</string>
<string id="DisableMedia">Prevent removable media source for any installation</string>
<string id="DisableMedia_Help">This policy setting prevents users from installing any programs from removable media.
If you enable this policy setting, if a user tries to install a program from removable media, such as CD-ROMs, floppy disks, and DVDs, a message appears stating that the feature cannot be found.
This policy setting applies even when the installation is running in the user's security context.
If you disable or do not configure this policy setting, users can install from removable media when the installation is running in their own security context, but only system administrators can use removable media when an installation is running with elevated system privileges, such as installations offered on the desktop or in Add or Remove Programs.
Also, see the "Enable user to use media source while elevated" and "Hide the 'Add a program from CD-ROM or floppy disk' option" policy settings.</string>
<string id="DisableMSI">Turn off Windows Installer</string>
<string id="DisableMSI_Help">This policy setting restricts the use of Windows Installer.
If you enable this policy setting, you can prevent users from installing software on their systems or permit users to install only those programs offered by a system administrator. You can use the options in the Disable Windows Installer box to establish an installation setting.
-- The "Never" option indicates Windows Installer is fully enabled. Users can install and upgrade software. This is the default behavior for Windows Installer on Windows 2000 Professional, Windows XP Professional and Windows Vista when the policy is not configured.
-- The "For non-managed applications only" option permits users to install only those programs that a system administrator assigns (offers on the desktop) or publishes (adds them to Add or Remove Programs). This is the default behavior of Windows Installer on Windows Server 2003 family when the policy is not configured.
-- The "Always" option indicates that Windows Installer is disabled.
This policy setting affects Windows Installer only. It does not prevent users from using other methods to install and upgrade programs.</string>
<string id="DisableNever">Never</string>
<string id="DisableNonManaged">For non-managed applications only</string>
<string id="DisablePatch">Prevent users from using Windows Installer to install updates and upgrades</string>
<string id="DisablePatch_Help">This policy setting prevents users from using Windows Installer to install patches.
If you enable this policy setting, users are prevented from using Windows Installer to install patches. Patches are updates or upgrades that replace only those program files that have changed. Because patches can be easy vehicles for malicious programs, some installations prohibit their use.
Note: This policy setting applies only to installations that run in the user's security context.
If you disable or do not configure this policy setting, by default, users who are not system administrators cannot apply patches to installations that run with elevated system privileges, such as those offered on the desktop or in Add or Remove Programs.
Also, see the "Enable user to patch elevated products" policy setting.</string>
<string id="DisableRollback">Prohibit rollback</string>
<string id="DisableRollback_Help">This policy setting prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation.
If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete.
This policy setting is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this policy setting unless it is essential.
This policy setting appears in the Computer Configuration and User Configuration folders. If the policy setting is enabled in either folder, it is considered be enabled, even if it is explicitly disabled in the other folder.</string>
<string id="EnableUserControl">Allow user control over installs</string>
<string id="EnableUserControl_Help">This policy setting permits users to change installation options that typically are available only to system administrators.
If you enable this policy setting, some of the security features of Windows Installer are bypassed. It permits installations to complete that otherwise would be halted due to a security violation.
If you disable or do not configure this policy setting, the security features of Windows Installer prevent users from changing installation options typically reserved for system administrators, such as specifying the directory to which files are installed.
If Windows Installer detects that an installation package has permitted the user to change a protected option, it stops the installation and displays a message. These security features operate only when the installation program is running in a privileged security context in which it has access to directories denied to the user.
This policy setting is designed for less restrictive environments. It can be used to circumvent errors in an installation program that prevents software from being installed.</string>
<string id="MSI">Windows Installer</string>
<string id="MSI_AllowUser">Allow User Installs</string>
<string id="MSI_DisableLUAPatching">Prohibit non-administrators from applying vendor signed updates</string>
<string id="MSI_DisableLUAPatchingHelp">This policy setting controls the ability of non-administrators to install updates that have been digitally signed by the application vendor.
Non-administrator updates provide a mechanism for the author of an application to create digitally signed updates that can be applied by non-privileged users.
If you enable this policy setting, only administrators or users with administrative privileges can apply updates to Windows Installer based applications.
If you disable or do not configure this policy setting, users without administrative privileges can install non-administrator updates.</string>
<string id="MSI_DisablePatchUninstall">Prohibit removal of updates</string>
<string id="MSI_DisablePatchUninstallHelp">This policy setting controls the ability for users or administrators to remove Windows Installer based updates.
This policy setting should be used if you need to maintain a tight control over updates. One example is a lockdown environment where you want to ensure that updates once installed cannot be removed by users or administrators.
If you enable this policy setting, updates cannot be removed from the computer by a user or an administrator. The Windows Installer can still remove an update that is no longer applicable to the product.
If you disable or do not configure this policy setting, a user can remove an update from the computer only if the user has been granted privileges to remove the update. This can depend on whether the user is an administrator, whether "Disable Windows Installer" and "Always install with elevated privileges" policy settings are set, and whether the update was installed in a per-user managed, per-user unmanaged, or per-machine context."</string>
<string id="MSI_DisableSRCheckPoints">Turn off creation of System Restore checkpoints</string>
<string id="MSI_DisableSRCheckPoints_Help">This policy setting prevents Windows Installer from creating a System Restore checkpoint each time an application is installed. System Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files.
If you enable this policy setting, the Windows Installer does not generate System Restore checkpoints when installing applications.
If you disable or do not configure this policy setting, by default, the Windows Installer automatically creates a System Restore checkpoint each time an application is installed, so that users can restore their computer to the state it was in before installing the application.</string>
<string id="MSI_DisableUserInstalls">Prohibit User Installs</string>
<string id="MSI_DisableUserInstalls_Help">This policy setting allows you to configure user installs. To configure this policy setting, set it to enabled and use the drop-down list to select the behavior you want.
If you do not configure this policy setting, or if the policy setting is enabled and "Allow User Installs" is selected, the installer allows and makes use of products that are installed per user, and products that are installed per computer. If the installer finds a per-user install of an application, this hides a per-computer installation of that same product.
If you enable this policy setting and "Hide User Installs" is selected, the installer ignores per-user applications. This causes a per-computer installed application to be visible to users, even if those users have a per-user install of the product registered in their user profile.</string>
<string id="MSI_EnforceUpgradeComponentRules">Enforce upgrade component rules</string>
<string id="MSI_EnforceUpgradeComponentRulesHelp">This policy setting causes the Windows Installer to enforce strict rules for component upgrades.
If you enable this policy setting, strict upgrade rules will be enforced by the Windows Installer which may cause some upgrades to fail. Upgrades can fail if they attempt to do one of the following:
(1) Remove a component from a feature.
This can also occur if you change the GUID of a component. The component identified by the original GUID appears to be removed and the component as identified by the new GUID appears as a new component.
(2) Add a new feature to the top or middle of an existing feature tree.
The new feature must be added as a new leaf feature to an existing feature tree.
If you disable or do not configure this policy setting, the Windows Installer will use less restrictive rules for component upgrades.</string>
<string id="MSI_HideUser">Hide User Installs</string>
<string id="MSI_MaxPatchCacheSize">Control maximum size of baseline file cache</string>
<string id="MSI_MaxPatchCacheSizeHelp">
This policy controls the percentage of disk space available to the Windows Installer baseline file cache.
The Windows Installer uses the baseline file cache to save baseline files modified by binary delta difference updates. The cache is used to retrieve the baseline file for future updates. The cache eliminates user prompts for source media when new updates are applied.
If you enable this policy setting you can modify the maximum size of the Windows Installer baseline file cache.
If you set the baseline cache size to 0, the Windows Installer will stop populating the baseline cache for new updates. The existing cached files will remain on disk and will be deleted when the product is removed.
If you set the baseline cache to 100, the Windows Installer will use available free space for the baseline file cache.
If you disable or do not configure this policy setting, the Windows Installer will uses a default value of 10 percent for the baseline file cache maximum size.</string>
<string id="MSILogging">Specify the types of events Windows Installer records in its transaction log</string>
<string id="MSILogging_Help">
Specifies the types of events that Windows Installer records in its transaction log for each installation. The log, Msi.log, appears in the Temp directory of the system volume.
When you enable this policy setting, you can specify the types of events you want Windows Installer to record. To indicate that an event type is recorded, type the letter representing the event type. You can type the letters in any order and list as many or as few event types as you want.
To disable logging, delete all of the letters from the box.
If you disable or do not configure this policy setting, Windows Installer logs the default event types, represented by the letters "iweap."</string>
<string id="PatchOptimizationOff">Patch Optimization Off</string>
<string id="PatchOptimizationOn">Patch Optimization On</string>
<string id="SafeForScripting">Prevent Internet Explorer security prompt for Windows Installer scripts</string>
<string id="SafeForScripting_Help">This policy setting allows Web-based programs to install software on the computer without notifying the user.
If you disable or do not configure this policy setting, by default, when a script hosted by an Internet browser tries to install a program on the system, the system warns users and allows them to select or refuse the installation.
If you enable this policy setting, the warning is suppressed and allows the installation to proceed.
This policy setting is designed for enterprises that use Web-based tools to distribute programs to their employees. However, because this policy setting can pose a security risk, it should be applied cautiously.</string>
<string id="SearchOrder">Specify the order in which Windows Installer searches for installation files</string>
<string id="SearchOrder_Help">This policy setting specifies the order in which Windows Installer searches for installation files.
If you disable or do not configure this policy setting, by default, the Windows Installer searches the network first, then removable media (floppy drive, CD-ROM, or DVD), and finally, the Internet (URL).
If you enable this policy setting, you can change the search order by specifying the letters representing each file source in the order that you want Windows Installer to search:
-- "n" represents the network;
-- "m" represents media;
-- "u" represents URL, or the Internet.
To exclude a file source, omit or delete the letter representing that source type.</string>
<string id="SUPPORTED_MSI15">Microsoft Windows XP or Windows 2000 with Windows Installer v2.0</string>
<string id="SUPPORTED_MSI30">Windows Installer v3.0</string>
<string id="SUPPORTED_MSI40">Windows Installer v4.0</string>
<string id="SUPPORTED_MSI45">Windows Installer v4.5</string>
<string id="TransformsSecure">Save copies of transform files in a secure location on workstation</string>
<string id="TransformsSecure_Help">This policy setting saves copies of transform files in a secure location on the local computer.
Transform files consist of instructions to modify or customize a program during installation.
If you enable this policy setting, the transform file is saved in a secure location on the user's computer.
If you do not configure this policy setting on Windows Server 2003, Windows Installer requires the transform file in order to repeat an installation in which the transform file was used, therefore, the user must be using the same computer or be connected to the original or identical media to reinstall, remove, or repair the installation.
This policy setting is designed for enterprises to prevent unauthorized or malicious editing of transform files.
If you disable this policy setting, Windows Installer stores transform files in the Application Data directory in the user's profile.
If you do not configure this policy setting on Windows 2000 Professional, Windows XP Professional and Windows Vista, when a user reinstalls, removes, or repairs an installation, the transform file is available, even if the user is on a different computer or is not connected to the network.</string>
<string id="DisableSharedComponent">Turn off shared components</string>
<string id="DisableSharedComponent_Help">This policy setting controls the ability to turn off shared components.
If you enable this policy setting, no packages on the system get the shared component functionality enabled by the msidbComponentAttributesShared attribute in the Component Table.
If you disable or do not configure this policy setting, by default, the shared component functionality is allowed.</string>
<string id="MsiDisableEmbeddedUI">Prevent embedded UI</string>
<string id="MsiDisableEmbeddedUI_Help">This policy setting controls the ability to prevent embedded UI.
If you enable this policy setting, no packages on the system can run embedded UI.
If you disable or do not configure this policy setting, embedded UI is allowed to run.</string>
</stringTable>
<presentationTable>
<presentation id="AlwaysInstallElevated_1">
<text> </text>
<text>This policy setting must be set for the machine and the user to be enforced.</text>
</presentation>
<presentation id="AlwaysInstallElevated_2">
<text> </text>
<text>This policy setting must be set for the machine and the user to be enforced.</text>
</presentation>
<presentation id="DisableAutomaticApplicationShutdown">
<dropdownList refId="DisableAutomaticApplicationShutdown" noSort="true" defaultItem="1">Prohibit Usage of Restart Manager</dropdownList>
</presentation>
<presentation id="DisableFlyweightPatching">
<dropdownList refId="DisableFlyweightPatching" noSort="true" defaultItem="1">Prohibit Flyweight Patching</dropdownList>
</presentation>
<presentation id="DisableLoggingFromPackage">
<dropdownList refId="DisableLoggingFromPackage" nosort="true" defaultItem="1">Disable logging via package settings</dropdownList>
</presentation>
<presentation id="DisableMSI">
<dropdownList refId="DisableMSI" noSort="true" defaultItem="1">Disable Windows Installer</dropdownList>
</presentation>
<presentation id="DisableRollback_1">
<text> </text>
<text>This policy setting may be set for the machine or for the user.</text>
</presentation>
<presentation id="DisableRollback_2">
<text> </text>
<text>This policy setting may be set for the machine or for the user.</text>
</presentation>
<presentation id="MSI_DisableUserInstalls">
<dropdownList refId="MSI_DisableUserInstallsBox" noSort="true" defaultItem="1">User Install Behavior:</dropdownList>
</presentation>
<presentation id="MSI_MaxPatchCacheSize">
<decimalTextBox refId="MSI_MaxPatchCacheSize" defaultValue="10">Baseline file cache maximum size</decimalTextBox>
</presentation>
<presentation id="MSILogging">
<textBox refId="MSILogging">
<label>Logging</label>
<defaultValue>iweap</defaultValue>
</textBox>
<text>To activate logging, enter one or more of the modes below.</text>
<text>"iwearucmpvox" will log everything but adds time to the install.</text>
<text>i - Status messages</text>
<text>w - Non-fatal warnings</text>
<text>e - All error messages</text>
<text>a - Start up of actions</text>
<text>r - Action-specific records</text>
<text>u - User requests</text>
<text>c - Initial UI parameters</text>
<text>m - Out-of-memory</text>
<text>p - Terminal properties</text>
<text>v - Verbose output</text>
<text>o - Out of disk space messages</text>
<text>x - Extra debugging information</text>
</presentation>
<presentation id="SearchOrder">
<textBox refId="SearchOrder">
<label>Search order</label>
<defaultValue>nmu</defaultValue>
</textBox>
<text>n = network, m = media (CD), u = URL</text>
<text>A few valid examples: nmu, n, nu, mn</text>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/Messaging.adml
+13
View File
@@ -0,0 +1,13 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2010 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Messaging Service Group Policy Settings</displayName>
<description>Messaging Service Group Policy Settings</description>
<resources>
<stringTable>
<string id="Messaging_Category">Messaging</string>
<string id="AllowMessageSync">Allow Message Service Cloud Sync</string>
<string id="AllowMessageSync_Help">This policy setting allows backup and restore of cellular text messages to Microsoft's cloud services.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/MicrosoftEdge.adml
+627
View File
@@ -0,0 +1,627 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>Microsoft Edge Group Policies</displayName>
<description>Policies defined to manage Microsoft Edge settings via Group Policy Management services.</description>
<resources>
<stringTable>
<!-- Product -->
<string id="SUPPORTED_INTERNET_BROWSER_1_DisplayName">Only Microsoft Edge 1.0</string>
<string id="SUPPORTED_INTERNET_BROWSER_WIN10_DisplayName">Microsoft Edge on Windows 10 or later</string>
<string id="SUPPORTED_INTERNET_BROWSER_WIN10V1511_DisplayName">Microsoft Edge on Windows 10, Version 1511 or later</string>
<string id="SUPPORTED_INTERNET_BROWSER_WIN10V1607_DisplayName">Microsoft Edge on Windows 10, Version 1607 or later</string>
<string id="SUPPORTED_INTERNET_BROWSER_WIN10V1703_DisplayName">Microsoft Edge on Windows 10, Version 1703 or later</string>
<string id="SUPPORTED_INTERNET_BROWSER_WIN10RS3RELEASE_DisplayName">Microsoft Edge on Windows 10, Version 1709 or later</string>
<string id="SUPPORTED_INTERNET_BROWSER_RS3_DisplayName">Microsoft Edge on Windows 10, Version 1708 or later</string>
<string id="SUPPORTED_INTERNET_BROWSER_RS4_DisplayName">Microsoft Edge on Windows 10, Version 1803 or later</string>
<string id="SUPPORTED_INTERNET_BROWSER_RS5_DisplayName">Microsoft Edge on Windows 10, Version 1809 or later</string>
<string id="InternetBrowser_DisplayName">Microsoft Edge</string>
<string id="InternetBrowser_ExplainCat">Microsoft Edge Category</string>
<!-- Categories -->
<!-- NOTE: Please try to keep this list sorted by the string id="" field -->
<!-- Policies -->
<string id="HomePages">Configure Start pages</string>
<string id="HomePages_Explain">When you enable the Configure Open Microsoft Edge With policy, you can configure one or more Start pages. When you enable this policy, users are not allowed to make changes to their Start pages.
If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format:
&lt;support.contoso.com&gt;&lt;support.microsoft.com&gt;
If disabled or not configured, the webpages specified in App settings loads as the default Start pages.
Version 1703 or later:
If you do not want to send traffic to Microsoft, enable this policy and use the &lt;about:blank&gt; value, which honors domain- and non-domain-joined devices, when it is the only configured URL.
Version 1809:
If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy.
Supported devices: Domain-joined or MDM-enrolled
Related policy:
- Configure Open Microsoft Edge With
- Disable Lockdown of Start Pages</string>
<string id="DisableLockdownOfStartPages">Disable lockdown of Start pages</string>
<string id="DisableLockdownOfStartPages_Explain">You can configure Microsoft Edge to disable the lockdown of Start pages allowing users to change or customize their start pages. To do this, you must also enable the Configure Start Pages or Configure Open Microsoft With policy. When enabled, all configured start pages are editable. Any Start page configured using the Configure Start pages policy is not locked down allowing users to edit their Start pages.
If disabled or not configured, the Start pages configured in the Configure Start Pages policy cannot be changed and remain locked down.
Supported devices: Domain-joined or MDM-enrolled
Related policy:
- Configure Start Pages
- Configure Open Microsoft Edge With</string>
<string id="LockdownFavorites">Prevent changes to Favorites on Microsoft Edge</string>
<string id="LockdownFavorites_Explain">This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge.
If you enable this setting, employees won't be able to add, import, or change anything in the Favorites list. Also as part of this, Save a Favorite, Import settings, and the context menu items (such as, Create a new folder) are all turned off.
Important
Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge.
If you disable or don't configure this setting (default), employees can add, import and make changes to the Favorites list.</string>
<string id="PreventCertErrorOverrides">Prevent certificate error overrides</string>
<string id="PreventCertErrorOverrides_Explain">Web security certificates are used to ensure a site your users go to is legitimate, and in some circumstances encrypts the data. With this policy, you can specify whether to prevent users from bypassing the security warning to sites that have SSL errors.
If enabled, overriding certificate errors are not allowed.
If disabled or not configured, overriding certificate errors are allowed.</string>
<string id="AllowAddressBarDropdown">Allow Address bar drop-down list suggestions</string>
<string id="AllowAddressBarDropdown_Explain">This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services.
Note: Disabling this setting turns off the Address bar drop-down functionality. Therefore, because search suggestions are shown in the drop-down, this setting takes precedence over the "Configure search suggestions in Address bar" setting.
If you enable or don't configure this setting, employees can see the Address bar drop-down functionality in Microsoft Edge.
If you disable this setting, employees won't see the Address bar drop-down functionality in Microsoft Edge. This setting also disables the user-defined setting, "Show search and site suggestions as I type".</string>
<string id="AllowAutofill">Configure Autofill</string>
<string id="AllowAutofill_Explain">This policy setting lets you decide whether employees can use Autofill to automatically fill in form fields while using Microsoft Edge. By default, employees can choose whether to use Autofill.
If you enable this setting, employees can use Autofill to automatically fill in forms while using Microsoft Edge.
If you disable this setting, employees can't use Autofill to automatically fill in forms while using Microsoft Edge.
If you don't configure this setting, employees can choose whether to use Autofill to automatically fill in forms while using Microsoft Edge.</string>
<string id="AllowDeveloperTools">Allow Developer Tools</string>
<string id="AllowDeveloperTools_Explain">This policy setting lets you decide whether F12 Developer Tools are available on Microsoft Edge.
If you enable or don't configure this setting, the F12 Developer Tools are available in Microsoft Edge.
If you disable this setting, the F12 Developer Tools aren't available in Microsoft Edge.</string>
<string id="AllowDoNotTrack">Configure Do Not Track</string>
<string id="AllowDoNotTrack_Explain">This policy setting lets you decide whether employees can send Do Not Track requests to websites that ask for tracking info. By default, Do Not Track requests aren't sent, but employees can choose to turn on and send requests.
If you enable this setting, Do Not Tracker requests are always sent to websites asking for tracking info.
If you disable this setting, Do Not Track requests are never sent to websites asking for tracking info.
If you don't configure this setting, employees can choose whether to send Do Not Track requests to websites asking for tracking info.</string>
<string id="AllowFullScreenMode">Allow FullScreen Mode</string>
<string id="AllowFullScreenMode_Explain">With this policy, you can specify whether to allow full-screen mode, which shows only the web content and hides the Microsoft Edge UI.
If enabled or not configured, full-screen mode is available for use in Microsoft Edge. Your users and extensions must have the proper permissions.
If disabled, full-screen mode is unavailable for use in Microsoft Edge.</string>
<string id="AllowInPrivate">Allow InPrivate browsing</string>
<string id="AllowInPrivate_Explain">This policy setting lets you decide whether employees can browse using InPrivate website browsing.
If you enable or don't configure this setting, employees can use InPrivate website browsing.
If you disable this setting, employees can't use InPrivate website browsing.</string>
<string id="AllowPasswordManager">Configure Password Manager</string>
<string id="AllowPasswordManager_Explain">This policy setting lets you decide whether employees can save their passwords locally, using Password Manager. By default, Password Manager is turned on.
If you enable this setting, employees can use Password Manager to save their passwords locally.
If you disable this setting, employees can't use Password Manager to save their passwords locally.
If you don't configure this setting, employees can choose whether to use Password Manager to save their passwords locally.</string>
<string id="AllowPopups">Configure Pop-up Blocker</string>
<string id="AllowPopups_Explain">This policy setting lets you decide whether to turn on Pop-up Blocker. By default, Pop-up Blocker is turned on..
If you enable this setting, Pop-up Blocker is turned on, stopping pop-up windows from appearing.
If you disable this setting, Pop-up Blocker is turned off, letting pop-ups windows appear.
If you don't configure this setting, employees can choose whether to use Pop-up Blocker.</string>
<string id="AllowPrinting">Allow printing</string>
<string id="AllowPrinting_Explain">With this policy, you can restrict whether printing web content in Microsoft Edge is allowed.
If enabled, printing is allowed.
If disabled, printing is not allowed.</string>
<string id="AllowMixedModePrintingInPdf">For PDF files that have both landscape and portrait pages, print each in its own orientation.</string>
<string id="AllowMixedModePrintingInPdf_Explain">With this policy, you can print PDF files based on per page orientation in Microsoft Edge.
If enabled, mixed mode printing is allowed.
If disabled, mixed mode printing is not allowed.</string>
<string id="AllowSavingHistory">Allow Saving History</string>
<string id="AllowSavingHistory_Explain">Microsoft Edge saves your user's browsing history, which is made up of info about the websites they visit, on their devices.
If enabled or not configured, the browsing history is saved and visible in the History pane.
If disabled, the browsing history stops saving and is not visible in the History pane. If browsing history exists before this policy was disabled, the previous browsing history remains visible in the History pane. This policy, when disabled, does not stop roaming of existing history or history coming from other roamed devices.</string>
<string id="AllowSearchEngineCustomization">Allow search engine customization</string>
<string id="AllowSearchEngineCustomization_Explain">This policy setting lets you decide whether users can change their search engine. If you disable this setting, users can't add new search engines or change the default used in the address bar.
Important
This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy).
If you enable or don't configure this policy, users can add new search engines and change the default used in the address bar from within Microsoft Edge Settings.
If you disable this setting, users can't add search engines or change the default used in the address bar.</string>
<string id="AllowSearchSuggestionsinAddressBar">Configure search suggestions in Address bar</string>
<string id="AllowSearchSuggestionsinAddressBar_Explain">This policy setting lets you decide whether search suggestions appear in the Address bar of Microsoft Edge. By default, employees can choose whether search suggestions appear in the Address bar of Microsoft Edge.
If you enable this setting, employees can see search suggestions in the Address bar of Microsoft Edge.
If you disable this setting, employees can't see search suggestions in the Address bar of Microsoft Edge.
If you don't configure this setting, employees can choose whether search suggestions appear in the Address bar of Microsoft Edge.</string>
<string id="AllowSideloadingOfExtensions">Allow Sideloading of extension</string>
<string id="AllowSideloadingOfExtensions_Explain">Sideloading installs and runs unverified extensions in Microsoft Edge. With this policy, you can specify whether unverified extensions can be sideloaded in Microsoft Edge.
If enabled or not configured, sideloading of unverified extensions in Microsoft Edge is allowed.
If disabled, sideloading of unverified extensions in Microsoft Edge is not allowed. Extensions can be installed only through Microsoft store (including a store for business), enterprise storefront (such as Company Portal) or PowerShell (using Add-AppxPackage). When disabled, this policy does not prevent sideloading of extensions using Add-AppxPackage via PowerShell. To prevent this, in Group Policy Editor, enable Allows development of Windows Store apps and installing them from an integrated development environment (IDE), which is located at:
Computer Configuration &gt; Administrative Templates &gt; Windows Components &gt; App Package Deployment
Supported versions: Microsoft Edge on Windows 10, version 1809
Default setting: Disabled or not configured
Related policies:
- Allows development of Windows Store apps and installing them from an integrated development environment (IDE)
- Allow all trusted apps to install​</string>
<string id="AllowSmartScreen">Configure Windows Defender SmartScreen</string>
<string id="AllowSmartScreen_Explain">This policy setting lets you configure whether to turn on Windows Defender SmartScreen. Windows Defender SmartScreen provides warning messages to help protect your employees from potential phishing scams and malicious software. By default, Windows Defender SmartScreen is turned on.
If you enable this setting, Windows Defender SmartScreen is turned on and employees can't turn it off.
If you disable this setting, Windows Defender SmartScreen is turned off and employees can't turn it on.
If you don't configure this setting, employees can choose whether to use Windows Defender SmartScreen.</string>
<string id="AllowWebContentOnNewTabPage">Allow web content on New Tab page</string>
<string id="AllowWebContentOnNewTabPage_Explain">This policy setting lets you configure what appears when Microsoft Edge opens a new tab. By default, Microsoft Edge opens the New Tab page.
If you enable this setting, Microsoft Edge opens a new tab with the New Tab page.
If you disable this setting, Microsoft Edge opens a new tab with a blank page. If you use this setting, employees can't change it.
If you don't configure this setting, employees can choose how new tabs appears.</string>
<string id="ConfiguredFavorites">Provision Favorites</string>
<string id="ConfiguredFavorites_Explain">This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites.
If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites.
Important
Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge.
If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar.</string>
<string id="ConfigureFavoritesBar">Configure Favorites Bar</string>
<string id="ConfigureFavoritesBar_Explain">The favorites bar shows your user's links to sites they have added to it. With this policy, you can specify whether to set the favorites bar to always be visible or hidden on any page.
If enabled, favorites bar is always visible on any page, and the favorites bar toggle in Settings sets to On, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings. The show bar/hide bar option is hidden from the context menu.
If disabled, the favorites bar is hidden, and the favorites bar toggle resets to Off, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings.
If not configured, the favorites bar is hidden but is visible on the Start and New Tab pages, and the favorites bar toggle in Settings sets to Off but is enabled allowing the user to make changes.</string>
<string id="ConfigureHomeButton">Configure Home Button</string>
<string id="ConfigureHomeButton_Explain">The Home button loads either the default Start page, the New tab page, or a URL defined in the Set Home Button URL policy.
By default, this policy is disabled or not configured and clicking the home button loads the default Start page.
When enabled, the home button is locked down preventing your users from making changes in Microsoft Edge's UI settings. To let your users change the Microsoft Edge UI settings, enable the Unlock Home Button policy.
If Enabled AND:
- Show home button &amp; set to Start page is selected, clicking the home button loads the Start page.
- Show home button &amp; set to New tab page is selected, clicking the home button loads a New tab page.
- Show home button &amp; set a specific page is selected, clicking the home button loads the URL specified in the Set Home Button URL policy.
- Hide home button is selected, the home button is hidden in Microsoft Edge.
Default setting: Disabled or not configured
Related policies:
- Set Home Button URL
- Unlock Home Button</string>
<string id="ConfigureHomeButton_StartPage">Show home button &amp; set to Start page</string>
<string id="ConfigureHomeButton_NewTabPage">Show home button &amp; set to New tab page</string>
<string id="ConfigureHomeButton_SpecificPage">Show home button &amp; set a specific page</string>
<string id="ConfigureHomeButton_HideHomeButton">Hide home button</string>
<string id="ConfigureOpenEdgeWith">Configure Open Microsoft Edge With</string>
<string id="ConfigureOpenEdgeWith_Explain">You can configure Microsoft Edge to lock down the Start page, preventing users from changing or customizing it.
If enabled, you can choose one of the following options:
- Start page: the Start page loads ignoring the Configure Start Pages policy.
- New tab page: the New tab page loads ignoring the Configure Start Pages policy.
- Previous pages: all tabs the user had open when Microsoft Edge last closed loads ignoring the Configure Start Pages policy.
- A specific page or pages: the URL(s) specified with Configure Start Pages policy load(s). If selected, you must specify at least one URL in Configure Start Pages; otherwise, this policy is ignored.
When enabled, and you want to make changes, you must first set the Disable Lockdown of Start Pages to not configured, make the changes to the Configure Open Microsoft Edge With policy, and then enable the Disable Lockdown of Start Pages policy.
If disabled or not configured, and you enable the Disable Lockdown of Start Pages policy, your users can change or customize the Start page.
Default setting: A specific page or pages (default)
Related policies:
-Disable Lockdown of Start Pages
-Configure Start Pages</string>
<string id="ConfigureOpenEdgeWithList_EdgeStartPage">Start page</string>
<string id="ConfigureOpenEdgeWithList_NewTabPage">New tab page</string>
<string id="ConfigureOpenEdgeWithList_PreviousPages">Previous pages</string>
<string id="ConfigureOpenEdgeWithList_ProvisionedHomePages">A specific page or pages (default)</string>
<string id="AlwaysEnableBooksLibrary">Always show the Books Library in Microsoft Edge</string>
<string id="AlwaysEnableBooksLibrary_Explain">This policy setting helps you to decide whether to make the Books tab visible, regardless of a device's country or region setting, as configured in the Country or region area of Windows settings.
If you enable this setting, Microsoft Edge shows the Books Library, regardless of the device's country or region.
If you disable or don't configure this setting, Microsoft Edge shows the Books Library only in countries or regions where it's supported.</string>
<string id="EnableExtendedBooksTelemetry">Allow extended telemetry for the Books tab</string>
<string id="EnableExtendedBooksTelemetry_Explain">This policy setting lets you decide how much data to send to Microsoft about the book you're reading from the Books tab in Microsoft Edge.
If you enable this setting, Microsoft Edge sends additional telemetry data, on top of the basic telemetry data, from the Books tab.
If you disable or don't configure this setting, Microsoft Edge only sends basic telemetry data, depending on your device configuration.</string>
<string id="UseSharedFolderForBooks">Allow a shared Books folder</string>
<string id="UseSharedFolderForBooks_Explain">This policy setting lets you decide whether Microsoft Edge stores books from the Books tab to a default, shared folder for Windows.
If you enable this setting, Microsoft Edge automatically downloads book files to a common, shared folder and prevents students and teachers from removing the book from the Books tab. For this to work properly, your students and teachers must be signed in using a school account.
If you disable or don't configure this setting, Microsoft Edge downloads book files to a per-user folder for each student or teacher.</string>
<string id="AllowConfigurationUpdateForBooksLibrary">Allow configuration updates for the Books Library</string>
<string id="AllowConfigurationUpdateForBooksLibrary_Explain">This policy setting lets you decide whether Microsoft Edge can automatically update the configuration data for the Books Library.
If you enable (default) or don't configure this setting, Microsoft Edge automatically updates the configuration data for the Books Library.
If you disable this setting, Microsoft Edge won't automatically download updated configuration data for the Books Library.</string>
<string id="Cookies">Configure cookies</string>
<string id="Cookies_Explain">This setting lets you configure how to work with cookies.
If you enable this setting, you must also decide whether to:
Allow all cookies (default): Allows all cookies from all websites.
Block all cookies: Blocks all cookies from all websites.
Block only 3rd-party cookies: Blocks only cookies from 3rd-party websites.
If you disable or don't configure this setting, all cookies are allowed from all sites.</string>
<string id="CookiesList_Block_None">Allow all cookies (default)</string>
<string id="CookiesList_Block_ThirdParty">Block only 3rd-party cookies</string>
<string id="CookiesList_Block_All">Block all cookies</string>
<string id="EnterpriseModeSiteList">Configure the Enterprise Mode Site List</string>
<string id="EnterpriseModeSiteList_Explain">This policy setting lets you configure whether to use Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy apps.
If you enable this setting, Microsoft Edge looks for the Enterprise Mode Site List XML file. This file includes the sites and domains that need to be viewed using Internet Explorer 11 and Enterprise Mode.
If you disable or don't configure this setting, Microsoft Edge won't use the Enterprise Mode Site List XML file. In this case, employees might experience compatibility problems while using legacy apps.</string>
<string id="AllowExtensions">Allow Extensions</string>
<string id="AllowExtensions_Explain">This setting lets you decide whether employees can load extensions in Microsoft Edge.
If you enable or don't configure this setting, employees can use Microsoft Edge Extensions.
If you disable this setting, employees can't use Microsoft Edge Extensions.</string>
<string id="PreventTurningOffRequiredExtensions">Prevent turning off required extensions</string>
<string id="PreventTurningOffRequiredExtensions_Explain">You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically.
When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension.
When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel.
If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension.
If disabled or not configured, extensions defined as part of this policy get ignored.
Default setting: Disabled or not configured
Related policies: Allow Developer Tools
Related Documents:
- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn)
- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business)
- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy)
- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business)
- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows)</string>
<string id="HideLocalHostIPAddress">Prevent using Localhost IP address for WebRTC</string>
<string id="HideLocalHostIPAddress_Explain">This policy setting lets you decide whether an employee's LocalHost IP address shows while making calls using the WebRTC protocol.
If you enable this setting, LocalHost IP addresses are hidden while making calls using the WebRTC protocol.
If you disable or don't configure this setting, LocalHost IP addresses are shown while making calls using the WebRTC protocol.</string>
<string id="ItemNameDisable">Disable</string>
<string id="ItemNameEnable">Enable</string>
<string id="PreventSmartScreenPromptOverride">Prevent bypassing Windows Defender SmartScreen prompts for sites</string>
<string id="PreventSmartScreenPromptOverride_Explain">This policy setting lets you decide whether employees can override the Windows Defender SmartScreen warnings about potentially malicious websites.
If you enable this setting, employees can't ignore Windows Defender SmartScreen warnings and they are blocked from continuing to the site.
If you disable or don't configure this setting, employees can ignore Windows Defender SmartScreen warnings and continue to the site.</string>
<string id="PreventSmartScreenPromptOverrideForFiles">Prevent bypassing Windows Defender SmartScreen prompts for files</string>
<string id="PreventSmartScreenPromptOverrideForFiles_Explain">This policy setting lets you decide whether employees can override the Windows Defender SmartScreen warnings about downloading unverified files.
If you enable this setting, employees can't ignore Windows Defender SmartScreen warnings and they are blocked from downloading the unverified files.
If you disable or don't configure this setting, employees can ignore Windows Defender SmartScreen warnings and continue the download process.</string>
<string id="SetDefaultSearchEngine">Set default search engine</string>
<string id="SetDefaultSearchEngine_Explain">This policy setting lets you configure the default search engine for your employees. Your employees can change the default search engine at any time.
Important
This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy).
If you enable this setting, you can choose a default search engine for your employees. If this setting is enabled, you must also add the default engine to the “Set default search engine” setting, by adding a link to your OpenSearch XML file, including at least the short name and https: URL of the search engine. For more info about creating the OpenSearch XML file, see the Understanding OpenSearch Standards (https://msdn.microsoft.com/en-us/library/dd163546.aspx) topic. Use this format to specify the link you wish to add: &lt;https://fabrikam.com/opensearch.xml&gt;
Note
If you'd like your employees to use the default Microsoft Edge settings for each market, you can set the string to EDGEDEFAULT. If you'd like your employees to use Microsoft Bing as the default search engine, you can set the string to EDGEBING.
Employees can change the default search engine at any time, unless you disable the "Allow search engine customization" setting, which restricts any changes.
If you disable this setting, the policy-set default search engine is removed. If this is also the current in-use default, the engine changes to the Microsoft Edge specified engine for the market.
If you don't configure this setting, the default search engine is set to the one specified in App settings.</string>
<string id="ConfigureAdditionalSearchEngines">Configure additional search engines</string>
<string id="ConfigureAdditionalSearchEngines_Explain">This policy setting lets you add up to 5 additional search engines, which can't be removed by your employees, but can be made a personal default engine. This setting doesn't set the default search engine. For that, you must use the "Set default search engine" setting.
Important
This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy).
If you enable this setting, you can add up to 5 additional search engines. For each additional engine, you must also add a link to your OpenSearch XML file, including at least the short name and https: URL of the search engine. For more info about creating the OpenSearch XML file, see the Understanding OpenSearch Standards (https://msdn.microsoft.com/en-us/library/dd163546.aspx) topic. Use this format to specify the link(s) you wish to add: &lt;https://fabrikam.com/opensearch.xml&gt;&lt;https://www.contoso.com/opensearch.xml&gt;
If you disable this setting, any added search engines are removed from your employee's devices.
If you don't configure this setting, the search engine list is set to what is specified in App settings.</string>
<string id="ProvisionedFavorites">Configure Favorites</string>
<string id="ProvisionedFavorites_Explain">This policy setting lets you configure the default list of Favorites that appear for your employees. Employees can change their favorites by adding or removing items at any time.
If you enable this setting, you can configure what default Favorites appear for your employees. If this setting is enabled, you must also provide a list of Favorites in the Options section. This list is imported after your policy is deployed.
If you disable or don't configure this setting, employees will see the Favorites that they set in the Favorites hub.</string>
<string id="SetHomeButtonURL">Set Home Button URL</string>
<string id="SetHomeButtonURL_Explain">The home button can be configured to load a custom URL when your user clicks the home button.
If enabled, or configured, and the Configure Home Button policy is enabled, and the Show home button &amp; set a specific page is selected, a custom URL loads when your user clicks the home button.
Default setting: Blank or not configured
Related policy: Configure Home Button</string>
<string id="SendIntranetTraffictoInternetExplorer">Send all intranet sites to Internet Explorer 11</string>
<string id="SendIntranetTraffictoInternetExplorer_Explain">This policy setting lets you decide whether your intranet sites should all open using Internet Explorer 11. This setting should only be used if there are known compatibility problems with Microsoft Edge.
If you enable this setting, all intranet sites are automatically opened using Internet Explorer 11.
If you disable or don't configure this setting, all intranet sites are automatically opened using Microsoft Edge.</string>
<string id="SetNewTabPageURL">Set New Tab page URL</string>
<string id="SetNewTabPageURL_Explain">You can set the default New Tab page URL in Microsoft Edge. Enabling this policy prevents your users from changing the New tab page setting. When enabled and the Allow web content on New Tab page policy is disabled, Microsoft Edge ignores the URL specified in this policy and opens about:blank.
If enabled, you can set the default New Tab page URL.
If disabled or not configured, the default Microsoft Edge new tab page is used.
Default setting: Disabled or not configured
Related policy: Allow web content on New Tab page</string>
<string id="ShowMessageWhenOpeningSitesInInternetExplorer_Show_ContinueInEdge">Show Keep going in Microsoft Edge link</string>
<string id="ShowMessageWhenOpeningSitesInInternetExplorer_Hide_ContinueInEdge">Hide Keep going in Microsoft Edge link</string>
<string id="ShowMessageWhenOpeningSitesInInternetExplorer">Show message when opening sites in Internet Explorer</string>
<string id="ShowMessageWhenOpeningSitesInInternetExplorer_Explain">You can configure Microsoft Edge to open a site automatically in Internet Explorer 11 and choose to display a notification before the site opens. If you want to display a notification, you must enable Configure the Enterprise Mode Site List or Send all intranets sites to Internet Explorer 11 or both.
If enabled, the notification appears on a new page. If you want users to continue in Microsoft Edge, select the Show Keep going in Microsoft Edge option from the drop-down list under Options.
If disabled or not configured, the default app behavior occurs and no additional page displays.
Default setting: Disabled or not configured
Related policies:
-Configure the Enterprise Mode Site List
-Send all intranet sites to Internet Explorer 11</string>
<string id="PreventAccessToAboutFlagsInMicrosoftEdge">Prevent access to the about:flags page in Microsoft Edge</string>
<string id="PreventAccessToAboutFlagsInMicrosoftEdge_Explain">This policy settings lets you decide whether employees can access the about:flags page, which is used to change developer settings and to enable experimental features.
If you enable this policy setting, employees can't access the about:flags page.
If you disable or don't configure this setting, employees can access the about:flags page.</string>
<string id="PreventLiveTileDataCollection">Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start</string>
<string id="PreventLiveTileDataCollection_Explain">This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu.
If you enable this setting, Microsoft Edge won't gather the Live Tile metadata, providing a minimal experience when a user pins a Live Tile to the Start menu.
If you disable or don't configure this setting, Microsoft Edge gathers the Live Tile metadata, providing a fuller and more complete experience when a user pins a Live Tile to the Start menu.</string>
<string id="PreventFirstRunPage">Prevent the First Run webpage from opening on Microsoft Edge</string>
<string id="PreventFirstRunPage_Explain">
This policy setting lets you decide whether employees see Microsoft's First Run webpage when opening Microsoft Edge for the first time.
If you enable this setting, employees won't see the First Run page when opening Microsoft Edge for the first time.
If you disable or don't configure this setting, employees will see the First Run page when opening Microsoft Edge for the first time.</string>
<string id="SyncFavoritesBetweenIEAndMicrosoftEdge">Keep favorites in sync between Internet Explorer and Microsoft Edge</string>
<string id="SyncFavoritesBetweenIEAndMicrosoftEdge_Explain">This setting lets you decide whether people can sync their favorites between Internet Explorer and Microsoft Edge.
If you enable this setting, employees can sync their favorites between Internet Explorer and Microsoft Edge.
If you disable or don't configure this setting, employees can’t sync their favorites between Internet Explorer and Microsoft Edge.
</string>
<string id="UnlockHomeButton">Unlock Home Button</string>
<string id="UnlockHomeButton_Explain">By default, when enabling Configure Home Button or Set Home Button URL, the home button is locked down to prevent your users from changing what page loads when clicking the home button. Use this policy to let users change the home button even when Configure Home Button or Set Home Button URL are enabled.
If enabled, the UI settings for the home button are enabled allowing your users to make changes, including hiding and showing the home button as well as configuring a custom URL.
If disabled or not configured, the UI settings for the home button are disabled preventing your users from making changes.
Default setting: Disabled or not configured
Related policy:
-Configure Home Button
-Set Home Button URL</string>
<string id="AllowFlashClickToRun">Configure the Adobe Flash Click-to-Run setting</string>
<string id="AllowFlashClickToRun_Explain">
If you enable or don’t configure the Adobe Flash Click-to-Run setting, Microsoft Edge will require a user to click the Click-to-Run button, to click the content, or for the site to appear on the auto-allowed list, before loading and running the content.
Sites get onto the auto-allowed list based on user feedback, specifically by how often the content is allowed to load and run.
</string>
<string id="AllowClearingBrowsingDataOnExit">Allow clearing browsing data on exit</string>
<string id="AllowClearingBrowsingDataOnExit_Explain">This policy setting allows the automatic clearing of browsing data when Microsoft Edge closes.
If you enable this policy setting, clearing browsing history on exit is turned on.
If you disable or don't configure this policy setting, it can be turned on and configured by the employee in the Clear browsing data options under Settings.
</string>
<string id="AllowFlash">Allow Adobe Flash</string>
<string id="AllowFlash_Explain">This setting lets you decide whether employees can run Adobe Flash in Microsoft Edge.
If you enable or don't configure this setting, employees can use Adobe Flash.
If you disable this setting, employees can't use Adobe Flash.
</string>
<string id="AllowCVList">Allow Microsoft Compatibility List</string>
<string id="AllowCVList_Explain">This policy setting lets you decide whether to use the Microsoft Compatibility List (a Microsoft-provided list that helps sites with known compatibility issues to display properly) in Microsoft Edge. By default, the Microsoft Compatibility List is enabled and can be viewed by visiting about:compat.
If you enable or don’t configure this setting, Microsoft Edge periodically downloads the latest version of the list from Microsoft, applying the updates during browser navigation. Visiting any site on the Microsoft Compatibility List prompts the employee to use Internet Explorer 11, where the site is automatically rendered as though it’s in whatever version of IE is necessary for it to appear properly.
If you disable this setting, the Microsoft Compatibility List isn’t used during browser navigation.</string>
<string id="AllowTabPreloading">Allow Microsoft Edge to start and load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed</string>
<string id="AllowTabPreloading_Explain">This policy setting lets you decide whether Microsoft Edge can load the Start and New Tab page during Windows sign in and each time Microsoft Edge is closed. By default this setting is to allow preloading.
If you allow preloading, disable, or don’t configure this policy setting, Microsoft Edge loads the Start and New Tab page during Windows sign in and each time Microsoft Edge is closed; minimizing the amount of time required to start up Microsoft Edge and to start a new tab.
If you prevent preloading, Microsoft Edge won’t load the Start or New Tab page during Windows sign in and each time Microsoft Edge is closed.</string>
<string id="AllowTabPreloadingDropdown_AllowTabPreloading">Allow tab preloading</string>
<string id="AllowTabPreloadingDropdown_PreventTabPreloading">Prevent tab preloading</string>
<string id="ConfigureTelemetryForMicrosoft365Analytics">Configure collection of browsing data for Desktop Analytics</string>
<string id="ConfigureTelemetryForMicrosoft365Analytics_Explain">You can configure Microsoft Edge to send intranet history only, internet history only, or both to Desktop Analytics for enterprise devices with a configured Commercial ID. If disabled or not configured, Microsoft Edge does not send browsing history data to Desktop Analytics.
Supported versions: Microsoft Edge on Windows 10, version 1809
Default setting: Disabled or not configured (no data collected or sent)</string>
<string id="ZonesList_IntranetOnly">Allow sending intranet history only</string>
<string id="ZonesList_InternetOnly">Allow sending internet history only</string>
<string id="ZonesList_Both">Allow sending both intranet and internet history</string>
<string id="ZonesList_None">Do not allow sending intranet or internet history</string>
<string id="AllowPrelaunch">Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed</string>
<string id="AllowPrelaunch_Explain">This policy setting lets you decide whether Microsoft Edge can pre-launch during Windows sign in, when the system is idle, and each time Microsoft Edge is closed. By default this setting is to allow pre-launch.
If you allow pre-launch, disable, or don’t configure this policy setting, Microsoft Edge pre-launches during Windows sign in, when the system is idle, and each time Microsoft Edge is closed; minimizing the amount of time required to start up Microsoft Edge.
If you prevent pre-launch, Microsoft Edge won’t pre-launch during Windows sign in, when the system is idle, or each time Microsoft Edge is closed.</string>
<string id="AllowPrelaunchDropdown_AllowPrelaunch">Allow pre-launching</string>
<string id="AllowPrelaunchDropdown_PreventPrelaunch">Prevent pre-launching</string>
<string id="ConfigureKioskMode">Configure kiosk mode</string>
<string id="ConfigureKioskMode_Explain">Configure how Microsoft Edge behaves when it’s running in kiosk mode with assigned access, either as a single app or as one of multiple apps running on the kiosk device. You can control whether Microsoft Edge runs InPrivate full screen, InPrivate multi-tab with limited functionality, or normal Microsoft Edge.
You need to configure Microsoft Edge in assigned access for this policy to take effect; otherwise, these settings are ignored. To learn more about assigned access and kiosk configuration, see “Configure kiosk and shared devices running Windows desktop editions” (https://aka.ms/E489vw).
If enabled and set to 0 (Default or not configured):
- If it’s a single app, it runs InPrivate full screen for digital signage or interactive displays.
- If it’s one of many apps, Microsoft Edge runs as normal.
If enabled and set to 1:
- If it’s a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can’t minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking “End session.” You can configure Microsoft Edge to restart after a period of inactivity by using the “Configure kiosk reset after idle timeout” policy.
- If it’s one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can’t customize Microsoft Edge.</string>
<string id="ConfigureKioskResetAfterIdleTimeout">Configure kiosk reset after idle timeout</string>
<string id="ConfigureKioskResetAfterIdleTimeout_Explain">You can configure Microsoft Edge to reset to the configured start experience after a specified amount of idle time. The reset timer begins after the last user interaction. Resetting to the configured start experience deletes the current user’s browsing data.
If enabled, you can set the idle time in minutes (0-1440). You must set the Configure kiosk mode policy to 1 and configure Microsoft Edge in assigned access as a single app for this policy to work. Once the idle time meets the time specified, a confirmation message prompts the user to continue, and if no user action, Microsoft Edge resets after 30 seconds.
If you set this policy to 0, Microsoft Edge does not use an idle timer.
If disabled or not configured, the default value is 5 minutes.
If you do not configure Microsoft Edge in assigned access, then this policy does not take effect.</string>
<string id="SuppressEdgeDeprecationNotification">Suppress the display of Edge Deprecation Notification</string>
<string id="SuppressEdgeDeprecationNotification_Explain">You can configure Microsoft Edge to suppress the display of the notification that informs users that support of this version of Microsoft Edge ended on March 9th, 2021. If enabled, the notification will not show.
If disabled or not configured, the notification will show every time Edge is launched. </string>
</stringTable>
<!-- Presentation -->
<presentationTable>
<presentation id="ConfiguredFavorites_Presentation">
<textBox refId="ConfiguredFavoritesPrompt">
<label>Specify the URL which points to the file that has all the data for provisioning favorites (in html format). You can export a set of favorites from Microsoft Edge and use that html file for provisioning user machines.
URL can be specified as
1. HTTP location: http://localhost:8080/URLs.html
2. Local network: \\network\shares\URLs.html
3. Local file: file:///c:\\Users\\&lt;user&gt;\\Documents\\URLs.html or C:\\Users\\&lt;user&gt;\\Documents\\URLs.html
</label>
</textBox>
</presentation>
<presentation id="ConfigureOpenEdgeWith_Presentation">
<dropdownList refId="ConfigureOpenEdgeWithListBox" noSort="true" defaultItem="3">Configure Open Microsoft Edge With</dropdownList>
</presentation>
<presentation id="ConfigureHomeButton_Presentation">
<dropdownList refId="ConfigureHomeButtonDropdown" noSort="true" defaultItem="0">Configure the Home Button</dropdownList>
</presentation>
<presentation id="EnterpriseModeSiteList_Presentation">
<textBox refId="EnterSiteListPrompt">
<label>Type the location (URL) of your Enterprise Mode IE website list</label>
</textBox>
</presentation>
<presentation id="HomePageSite_Presentation">
<textBox refId="HomePageSitePrompt">
<label>Type the location (URL) of your Home Page website</label>
</textBox>
</presentation>
<presentation id="HomePages_Presentation">
<textBox refId="HomePagesPrompt">
<label>Use this format: &lt;support.contoso.com&gt;&lt;https://support.microsoft.com/&gt;</label>
</textBox>
</presentation>
<presentation id="SetDefaultSearchEngine_Presentation">
<textBox refId="SetDefaultSearchEngine_Prompt">
<label>Use this format to specify the link you wish to add: &lt;https://fabrikam.com/opensearch.xml&gt;</label>
</textBox>
</presentation>
<presentation id="SetHomeButtonURL_Presentation">
<textBox refId="SetHomeButtonURLPrompt">
<label>Enter a URL in string format. For example: https://www.bing.com</label>
</textBox>
</presentation>
<presentation id="SetNewTabPageURL_Presentation">
<textBox refId="SetNewTabPageURLPrompt">
<label>Enter a URL in string format. For example: https://www.bing.com</label>
</textBox>
</presentation>
<presentation id="ConfigureAdditionalSearchEngines_Presentation">
<textBox refId="ConfigureAdditionalSearchEngines_Prompt">
<label>Use this format to specify the link(s) you wish to add: &lt;https://fabrikam.com/opensearch.xml&gt;&lt;https://www.contoso.com/opensearch.xml&gt;</label>
</textBox>
</presentation>
<presentation id="ProvisionedFavorites_Presentation">
<listBox refId="ProvisionedFavorites_List">Enter the name of the favorite in the first column and the URL of the favorite in the other column like Contoso http://www.contoso.com/</listBox>
</presentation>
<presentation id="PreventTurningOffRequiredExtensions_Presentation">
<textBox refId="PreventTurningOffRequiredExtensions_Prompt">
<label>In the space below, enter extension package family names (PFNs) separated by semi-colons.</label>
</textBox>
</presentation>
<presentation id="Cookies">
<dropdownList refId="CookiesListBox" noSort="true" defaultItem="2">Configure Cookies </dropdownList>
</presentation>
<presentation id="AllowTabPreloading">
<dropdownList refId="AllowTabPreloadingDropdown" defaultItem="0">Configure tab preloading</dropdownList>
</presentation>
<presentation id="AllowPrelaunch">
<dropdownList refId="AllowPrelaunchDropdown" defaultItem="0">Configure pre-launch</dropdownList>
</presentation>
<presentation id="ConfigureTelemetryForMicrosoft365Analytics_Presentation">
<dropdownList refId="ZonesListBox" noSort="true" defaultItem="0">Configure telemetry collection</dropdownList>
</presentation>
<presentation id="ConfigureKioskMode_Presentation">
<text>Configure how Microsoft Edge behaves in kiosk mode.
For single app assigned access:
- 0 = Full-screen digital signage and interactive display
- 1 = InPrivate public browsing (limited features)
For multi-app assigned access:
- 0 = Normal Microsoft Edge running in assigned access
- 1 = InPrivate public browsing
</text>
<decimalTextBox refId="ConfigureKioskMode_TextBox" defaultValue="0"></decimalTextBox>
</presentation>
<presentation id="ConfigureKioskResetAfterIdleTimeout_Presentation">
<text>Specify the time in minutes from the last user activity before Microsoft Edge kiosk resets, you can choose:
- 0 to disable the idle timer
- 1-1440 minutes of inactivity since the last user interaction
</text>
<decimalTextBox refId="ConfigureKioskResetAfterIdleTimeout_TextBox" defaultValue="5"></decimalTextBox>
</presentation>
<presentation id="ShowMessageWhenOpeningSitesInInternetExplorer_Presentation">
<dropdownList refId="ShowMessageWhenOpeningSitesInInternetExplorer_Dropdown" noSort="true" defaultItem="0">Show Keep going in Microsoft Edge link</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/MobilePCMobilityCenter.adml
+19
View File
@@ -0,0 +1,19 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="MobilityCenterCat">Windows Mobility Center</string>
<string id="MobilityCenterEnable">Turn off Windows Mobility Center</string>
<string id="MobilityCenterEnableExplain">This policy setting turns off Windows Mobility Center.
If you enable this policy setting, the user is unable to invoke Windows Mobility Center. The Windows Mobility Center UI is removed from all shell entry points and the .exe file does not launch it.
If you disable this policy setting, the user is able to invoke Windows Mobility Center and the .exe file launches it.
If you do not configure this policy setting, Windows Mobility Center is on by default.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/MobilePCPresentationSettings.adml
+21
View File
@@ -0,0 +1,21 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="PresentationSettingsCat">Presentation Settings</string>
<string id="PresentationSettingsEnable">Turn off Windows presentation settings</string>
<string id="PresentationSettingsEnableExplain">This policy setting turns off Windows presentation settings.
If you enable this policy setting, Windows presentation settings cannot be invoked.
If you disable this policy setting, Windows presentation settings can be invoked. The presentation settings icon will be displayed in the notification area. This will give users a quick and easy way to configure their system settings before a presentation to block system notifications and screen blanking, adjust speaker volume, and apply a custom background image.
Note: Users will be able to customize their system settings for presentations in Windows Mobility Center.
If you do not configure this policy setting, Windows presentation settings can be invoked.</string>
</stringTable>
</resources>
</policyDefinitionResources>
policy_templates/en-US/Msi-FileRecovery.adml
+37
View File
@@ -0,0 +1,37 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="WdiScenarioCategory">MSI Corrupted File Recovery</string>
<string id="WdiScenarioExecutionPolicy">Configure MSI Corrupted File Recovery behavior</string>
<string id="WdiScenarioExecutionPolicyExplain">This policy setting allows you to configure the recovery behavior for corrupted MSI files to one of three states:
Prompt for Resolution: Detection, troubleshooting, and recovery of corrupted MSI applications will be turned on. Windows will prompt the user with a dialog box when application reinstallation is required. This is the default recovery behavior on Windows client.
Silent: Detection, troubleshooting, and notification of MSI application to reinstall will occur with no UI. Windows will log an event when corruption is determined and will suggest the application that should be re-installed. This behavior is recommended for headless operation and is the default recovery behavior on Windows server.
Troubleshooting Only: Detection and verification of file corruption will be performed without UI. Recovery is not attempted.
If you enable this policy setting, the recovery behavior for corrupted files is set to either the Prompt For Resolution (default on Windows client), Silent (default on Windows server), or Troubleshooting Only.
If you disable this policy setting, the troubleshooting and recovery behavior for corrupted files will be disabled. No troubleshooting or resolution will be attempted.
If you do not configure this policy setting, the recovery behavior for corrupted files will be set to the default recovery behavior.
No system or service restarts are required for changes to this policy setting to take immediate effect after a Group Policy refresh.
Note: This policy setting will take effect only when the Diagnostic Policy Service (DPS) is in the running state. When the service is stopped or disabled, system file recovery will not be attempted. The DPS can be configured with the Services snap-in to the Microsoft Management Console.</string>
<string id="WdiScenarioExecutionPolicyLevelResolution">Prompt for Resolution</string>
<string id="WdiScenarioExecutionPolicyLevelSilent">Silent</string>
<string id="WdiScenarioExecutionPolicyLevelTsOnly">Troubleshooting Only</string>
</stringTable>
<presentationTable>
<presentation id="WdiScenarioExecutionPolicy">
<dropdownList refId="WdiScenarioExecutionPolicyLevel" noSort="true" defaultItem="1">Scenario Execution Level</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
Loaded 100 of 481 files, more files were not shown because too many files have changed in this diff. Show more