windows server 2008 group policy settings

Group Policy Settings ReferenceWindows Server 2008

This spreadsheet lists the policy settings for computer and user configurations included in the administrative template files (.admx/.adml) delivered with

and Windows 2000. These files are used to expose policy settings when you edit Group Policy objects (GPOs) using Group Policy Object Editor (also known as GPEdit).

You can use the filtering capabilities included in this spreadsheet to view a specific subset of data based on one value or a combination of values that are available

To view a specific subset of data, click the drop-down arrow in the column heading of cells that contain the value or combination of values on which you want to filter,and then click the desired value in the drop-down list. For example, to view a subset of policy settings that are available for Windows Server 2008 in the “Administrative Templates” worksheet,

What's NewThe spreadsheet contains three new columns. These columns provide more information about each policy setting's behavior regarding reboots, logoffs, and schema extensions.These columns are:

(detailed documentation for schema changes will be available online after Microsoft releases Windows Server 2008).

Legal Notice

The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication.

Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot

guarantee the accuracy of any information presented after the date of publication.

The information contained in this document relates to a prerelease software product, which may be substantially modified before its first commercial release.

Accordingly, the information may not accurately describe or reflect the software product when first commercially released.

This document is provided for informational purposes only, and Microsoft makes no warranties, express or implied, with respect to this document or the information contained in it.

This is a preliminary document and may be changed substantially prior to final commercial release of the software described herein.

This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT.

Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in

or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording or otherwise), or for

any purpose, without the express written permission of Microsoft Corp.

Microsoft may have patents, patent applications, trademarks, copyrights or other intellectual property rights covering subject matter in this document.

Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these

patents, trademarks, copyrights or other intellectual property

Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places and events depicted herein are fictitious, and

no association with any real company, organization, product, domain name, e-mail address, logo, person, place or event is intended or should be inferred

© 2008 Microsoft Corp. All rights reserved.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

Windows Vista (RTM build 6001). The policy settings included in this spreadsheet cover Windows Server 2008, Windows Vista , Microsoft Windows Server 2003, Windows XP Professional,

in one or more of the columns. In addition, you can click Custom in the drop-down list of any of the column headings to add additional filtering criteria within that column.

click the drop-down arrow next to Supported On, and then click At least Microsoft Windows Server 2008.

Reboot Required: A "Yes" in this column means Windows requires a restart before it applies the described policy setting.Logoff Required: A "Yes" in this column means Windows requires the user to log off and log on again before it applies the described policy setting.Active Directory Schema or Domain Requirements: A "Yes" in this column means you extend your Active Directory Schema before deploying this policy setting

Microsoft, the Windows logo, Windows, Windows Media, Active Directory and Windows NT are either registered trademarks or trademarks of Microsoft Corp. in the United States and/or other countries.

File name

ActiveXInstallService.admx

AddRemovePrograms.admx











adfs.admx

AppCompat.admx

AppCompat.admx

AppCompat.admx

AppCompat.admx

AppCompat.admx

AppCompat.admx

AppCompat.admx

AttachmentManager.admx








AutoPlay.admx

AutoPlay.admx

AutoPlay.admx

AutoPlay.admx

AutoPlay.admx

AutoPlay.admx

Bits.admx

Bits.admx

Bits.admx

Bits.admx

Bits.admx

Bits.admx

Bits.admx

Bits.admx

Bits.admx

Bits.admx

Bits.admx

Bits.admx

Bits.admx

CaptureWizard.admx

CaptureWizard.admx

CEIPEnable.admx

CEIPEnable.admx

CipherSuiteOrder.admx

COM.admx

COM.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

Conf.admx

ControlPanel.admx

ControlPanel.admx

ControlPanel.admx

ControlPanel.admx

ControlPanelDisplay.admx















Cpls.admx

CredentialProviders.admx

CredentialProviders.admx

CredSsp.admx

CredSsp.admx

CredSsp.admx

CredSsp.admx

CredSsp.admx

CredSsp.admx

CredSsp.admx

CredSsp.admx

CredSsp.admx

CredUI.admx

CredUI.admx

CtrlAltDel.admx

CtrlAltDel.admx

CtrlAltDel.admx

CtrlAltDel.admx

DCOM.admx

DCOM.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

Desktop.admx

DeviceInstallation.admx




















DFS.admx

DigitalLocker.admx

DigitalLocker.admx

DiskDiagnostic.admx

DiskDiagnostic.admx

DiskNVCache.admx

DiskNVCache.admx

DiskNVCache.admx

DiskNVCache.admx

DiskQuota.admx

DiskQuota.admx

DiskQuota.admx

DiskQuota.admx

DiskQuota.admx

DiskQuota.admx

DistributedLinkTracking.admx

DnsClient.admx

DnsClient.admx

DnsClient.admx

DnsClient.admx

DnsClient.admx

DnsClient.admx

DnsClient.admx

DnsClient.admx

DnsClient.admx

DnsClient.admx

DnsClient.admx

DnsClient.admx

DnsClient.admx

DnsClient.admx

DnsClient.admx

DWM.admx

DWM.admx

DWM.admx

DWM.admx

DWM.admx

DWM.admx

DWM.admx

DWM.admx

DWM.admx

DWM.admx

EncryptFilesonMove.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

ErrorReporting.admx

EventForwarding.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventLog.admx

EventViewer.admx

EventViewer.admx

EventViewer.admx

Explorer.admx

Explorer.admx

Explorer.admx

Explorer.admx

FileRecovery.admx

FileSys.admx

FolderRedirection.admx



FramePanes.admx

FramePanes.admx

GameExplorer.admx

GameExplorer.admx

Globalization.admx

Globalization.admx

Globalization.admx

Globalization.admx

Globalization.admx

Globalization.admx

Globalization.admx

Globalization.admx

Globalization.admx

Globalization.admx

Globalization.admx

Globalization.admx

Globalization.admx

Globalization.admx

Globalization.admx

Globalization.admx

Globalization.admx

Globalization.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicy.admx

GroupPolicyPreferences.admx




































































GroupPolicy-Server.admx

Help.admx

Help.admx

Help.admx

HelpAndSupport.admx

HelpAndSupport.admx

HelpAndSupport.admx

HelpAndSupport.admx

HelpAndSupport.admx

HotStart.admx

HotStart.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

ICM.admx

IIS.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

inetres.admx

InkWatson.admx

InkWatson.admx

InputPersonalization.admx




iSCSI.admx

iSCSI.admx

iSCSI.admx

iSCSI.admx

iSCSI.admx

iSCSI.admx

iSCSI.admx

iSCSI.admx

iSCSI.admx

iSCSI.admx

kdc.admx

Kerberos.admx

Kerberos.admx

Kerberos.admx

LeakDiagnostic.admx

LinkLayerTopologyDiscovery.admx

LinkLayerTopologyDiscovery.admx

Logon.admx

Logon.admx

Logon.admx

Logon.admx

Logon.admx

Logon.admx

Logon.admx

Logon.admx

Logon.admx

Logon.admx

Logon.admx

Logon.admx

Logon.admx

Logon.admx

MediaCenter.admx

MediaCenter.admx

MMC.admx

MMC.admx

MMC.admx

MMC.admx

MMC.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapins.admx

MMCSnapIns2.admx

MMCSnapIns2.admx

MMCSnapIns2.admx

MMCSnapIns2.admx

MMCSnapIns2.admx

MMCSnapIns2.admx

MMCSnapIns2.admx

MMCSnapIns2.admx

MMCSnapIns2.admx

MMCSnapIns2.admx

MMCSnapIns2.admx

MobilePCMobilityCenter.admx

MobilePCMobilityCenter.admx

MobilePCPresentationSettings.admx

MobilePCPresentationSettings.admx

MovieMaker.admx

MovieMaker.admx

MovieMaker.admx

MovieMaker.admx

MovieMaker.admx

MovieMaker.admx

MovieMaker.admx

MovieMaker.admx

MSDT.admx

MSDT.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

MSI.admx

NAPXPQec.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

Netlogon.admx

NetworkConnections.admx

























NetworkProjection.admx

NetworkProjection.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

OfflineFiles.admx

P2P-pnrp.admx

P2P-pnrp.admx

P2P-pnrp.admx

P2P-pnrp.admx

P2P-pnrp.admx

P2P-pnrp.admx

P2P-pnrp.admx

P2P-pnrp.admx

P2P-pnrp.admx

P2P-pnrp.admx

P2P-pnrp.admx

P2P-pnrp.admx

P2P-pnrp.admx

P2P-pnrp.admx

ParentalControls.admx

pca.admx

pca.admx

pca.admx

pca.admx

pca.admx

PenTraining.admx

PenTraining.admx

PerfCenterCPL.admx

PerfCenterCPL.admx

PerfCenterCPL.admx

PerfCenterCPL.admx

PerfCenterCPL.admx

PerfCenterCPL.admx

PerformanceDiagnostics.admx




Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

Power.admx

PreviousVersions.admx












Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Printing.admx

Programs.admx

Programs.admx

Programs.admx

Programs.admx

Programs.admx

Programs.admx

Programs.admx

PswdSync.admx

PswdSync.admx

PswdSync.admx

PswdSync.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

QOS.admx

Radar.admx

Reliability.admx

Reliability.admx

Reliability.admx

Reliability.admx

RemoteAssistance.admx






RemovableStorage.admx





























RPC.admx

RPC.admx

RPC.admx

RPC.admx

RPC.admx

RPC.admx

Scripts.admx

Scripts.admx

Scripts.admx

Scripts.admx

Scripts.admx

Scripts.admx

Scripts.admx

Scripts.admx

Scripts.admx

Scripts.admx

Search.admx

Search.admx

Search.admx

Search.admx

Search.admx

Search.admx

Search.admx

Search.admx

Search.admx

Securitycenter.admx

ServerManager.admx

ServerManager.admx

ServerManager.admx

ServerManager.admx

Setup.admx

Setup.admx

SharedFolders.admx

SharedFolders.admx

Sharing.admx

Shell-CommandPrompt-RegEditTools.admx




ShellWelcomeCenter.admx

Sidebar.admx

Sidebar.admx

Sidebar.admx

Sidebar.admx

Sidebar.admx

Sidebar.admx

Sidebar.admx

Sidebar.admx

Sideshow.admx

Sideshow.admx

Sideshow.admx

Sideshow.admx

Sideshow.admx

Sideshow.admx

Sideshow.admx

Sideshow.admx

Smartcard.admx

Smartcard.admx

Smartcard.admx

Smartcard.admx

Smartcard.admx

Smartcard.admx

Smartcard.admx

Smartcard.admx

Smartcard.admx

Smartcard.admx

Smartcard.admx

Smartcard.admx

Smartcard.admx

Snis.admx

Snis.admx

Snmp.admx

Snmp.admx

Snmp.admx

SoundRec.admx

SoundRec.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

StartMenu.admx

SystemResourceManager.admx




SystemRestore.admx

SystemRestore.admx

TabletPCInputPanel.admx
















TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

TabletShell.admx

Taskbar.admx

Taskbar.admx

Taskbar.admx

Taskbar.admx

Taskbar.admx

Taskbar.admx

Taskbar.admx

Taskbar.admx

Taskbar.admx

Taskbar.admx

TaskScheduler.admx

TaskScheduler.admx

TaskScheduler.admx

TaskScheduler.admx

TaskScheduler.admx

TaskScheduler.admx

TaskScheduler.admx

TaskScheduler.admx

TaskScheduler.admx

TaskScheduler.admx

TaskScheduler.admx

TaskScheduler.admx

TaskScheduler.admx

TaskScheduler.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer.admx

TerminalServer-Server.admx












Thumbnails.admx

Thumbnails.admx

Thumbnails.admx

TouchInput.admx

TouchInput.admx

TPM.admx

TPM.admx

TPM.admx

TPM.admx

UserDataBackup.admx

UserDataBackup.admx

UserDataBackup.admx

UserDataBackup.admx

UserDataBackup.admx

UserDataBackup.admx

UserDataBackup.admx

UserDataBackup.admx

UserDataBackup.admx

UserDataBackup.admx

UserDataBackup.admx

UserDataBackup.admx

UserDataBackup.admx

UserDataBackup.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

UserProfiles.admx

VolumeEncryption.admx







W32Time.admx

W32Time.admx

W32Time.admx

W32Time.admx

WDI.admx

WDI.admx

WinCal.admx

WinCal.admx

WindowsBackup.admx

WindowsBackup.admx

WindowsBackup.admx

WindowsBackup.admx

WindowsBackup.admx

WindowsCollaboration.admx




WindowsColorSystem.admx

WindowsColorSystem.admx

WindowsConnectNow.admx



WindowsDefender.admx








WindowsExplorer.admx


































WindowsFileProtection.admx




WindowsFirewall.admx





























WindowsMail.admx

WindowsMail.admx

WindowsMail.admx

WindowsMail.admx

WindowsMediaDRM.admx

WindowsMediaPlayer.admx





















WindowsMessenger.admx




WindowsRemoteManagement.admx











WindowsRemoteShell.admx







WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WindowsUpdate.admx

WinInit.admx

WinInit.admx

WinLogon.admx

WinLogon.admx

WinLogon.admx

WinLogon.admx

WinLogon.admx

WinLogon.admx

WinLogon.admx

Winsrv.admx

WordWheel.admx

Policy Setting name Scope

Approved Installation Sites for ActiveX Controls Machine

Go directly to Components Wizard User

Hide Add New Programs page User

Hide Add/Remove Windows Components page User

Hide Change or Remove Programs page User

Hide the "Add a program from CD-ROM or floppy disk" option User

Hide the "Add programs from Microsoft" option User

Hide the "Add programs from your network" option User

Hide the Set Program Access and Defaults page User

Remove Add or Remove Programs User

Remove Support Information User

Specify default category for Add New Programs User

Turn off Federation Service Machine

Prevent access to 16-bit applications Machine

Prevent access to 16-bit applications User

Remove Program Compatibility Property Page Machine

Turn Off Application Compatibility Engine Machine

Turn Off Program Compatibility Assistant Machine

Turn Off Program Compatibility Assistant User

Turn Off Program Compatibility Wizard Machine

Default risk level for file attachments User

Do not preserve zone information in file attachments User

Hide mechanisms to remove zone information User

Inclusion list for high risk file types User

Inclusion list for low file types User

Inclusion list for moderate risk file types User

Notify antivirus programs when opening attachments User

Trust logic for file attachments User

Default behavior for AutoRun machine

Default behavior for AutoRun user

Don't set the always do this checkbox machine

Don't set the always do this checkbox user

Turn off Autoplay machine

Turn off Autoplay user

Allow BITS Peercaching Machine

Do not allow the computer to act as a BITS Peercaching client Machine

Do not allow the computer to act as a BITS Peercaching server Machine

Limit age of items in the BITS Peercache Machine

Limit the BITS Peercache size Machine

Maximum BITS job download time Machine

Maximum network bandwidth for BITS background transfers Machine

Maximum network bandwidth used for Peercaching Machine

Maximum number of BITS jobs for each user Machine

Maximum number of BITS jobs for this computer Machine

Maximum number of files allowed in a BITS job Machine

Maximum number of ranges that can be added to the file in a BITS job Machine

Timeout for inactive BITS jobs Machine

Do not allow Import Video to run Machine

Do not allow Import Video to run User

Allow Corporate redirection of Customer Experience Improvement uploads Machine

Tag Windows Customer Experience Improvement data with Study Identifier Machine

SSL Cipher Suite Order Machine

Download missing COM components Machine

Download missing COM components User

Allow persisting automatic acceptance of Calls User

Disable application Sharing User

Disable Audio User

Disable Chat User

Disable Directory services User

Disable full duplex Audio User

Disable NetMeeting 2.x Whiteboard User

Disable remote Desktop Sharing Machine

Disable the Advanced Calling button User

Disable Whiteboard User

Enable Automatic Configuration User

Hide the Audio page User

Hide the General page User

Hide the Security page User

Hide the Video page User

Limit the bandwidth of Audio and Video User

Limit the size of sent files User

Prevent adding Directory servers User

Prevent Application Sharing in true color User

Prevent automatic acceptance of Calls User

Prevent changing Call placement method User

Prevent changing DirectSound Audio setting User

Prevent Control User

Prevent Desktop Sharing User

Prevent receiving files User

Prevent receiving Video User

Prevent sending files User

Prevent sending Video User

Prevent Sharing User

Prevent Sharing Command Prompts User

Prevent Sharing Explorer windows User

Prevent viewing Web directory User

Set Call Security options User

Set the intranet support Web page User

Force classic Control Panel view User

Hide specified Control Panel items User

Prohibit access to the Control Panel User

Show only specified Control Panel items User

Hide Appearance and Themes tab User

Hide Desktop tab User

Hide Screen Saver tab User

Hide Settings tab User

Load a specific visual style file or force Windows Classic User

Password protect the screen saver User

Prevent changing wallpaper User

Prevent selection of windows and buttons styles User

Prohibit selection of font size User

Prohibit Theme color selection User

Remove Display in Control Panel User

Remove Theme option User

Screen Saver User

Screen Saver executable name User

Screen Saver timeout User

Apply the default user logon picture to all users Machine

Assign a default domain for logon Machine

Exclude credential providers Machine

Allow Default Credentials with NTLM-only Server Authentication Machine

Allow Delegating Default Credentials Machine

Allow Delegating Fresh Credentials Machine

Allow Delegating Saved Credentials Machine

Allow Fresh Credentials with NTLM-only Server Authentication Machine

Allow Saved Credentials with NTLM-only Server Authentication Machine

Deny Delegating Default Credentials Machine

Deny Delegating Fresh Credentials Machine

Deny Delegating Saved Credentials Machine

Enumerate administrator accounts on elevation Machine

Require trusted path for credential entry. Machine

Remove Change Password User

Remove Lock Computer User

Remove Logoff User

Remove Task Manager User

Allow local activation security check exemptions Machine

Define Activation Security Check exemptions Machine

Add/Delete items User

Allow only bitmapped wallpaper User

Desktop Wallpaper User

Disable Active Desktop User

Disable all items User

Do not add shares of recently opened documents to Network Locations User

Don't save settings at exit User

Enable Active Desktop User

Enable filter in Find dialog box User

Hide Active Directory folder User

Hide and disable all items on the desktop User

Hide Internet Explorer icon on desktop User

Hide Network Locations icon on desktop User

Maximum size of Active Directory searches User

Prevent adding, dragging, dropping and closing the Taskbar's toolbars User

Prohibit adding items User

Prohibit adjusting desktop toolbars User

Prohibit changes User

Prohibit closing items User

Prohibit deleting items User

Prohibit editing items User

Prohibit User from manually redirecting Profile Folders User

Remove Computer icon on the desktop User

Remove My Documents icon on the desktop User

Remove Properties from the Computer icon context menu User

Remove Properties from the Documents icon context menu User

Remove Properties from the Recycle Bin context menu User

Remove Recycle Bin icon from desktop User

Remove the Desktop Cleanup Wizard User

Allow administrators to override Device Installation Restriction policies Machine

Allow installation of devices that match any of these device IDs Machine

Allow installation of devices using drivers that match these device setup classes Machine

Allow non-administrators to install drivers for these device setup classes Machine

Allow remote access to the PnP interface Machine

Code signing for device drivers User

Configure device installation timeout Machine

Configure driver search locations User

Display a custom message when installation is prevented by policy (balloon text) Machine

Display a custom message when installation is prevented by policy (balloon title) Machine

Do not create system restore point when new device driver installed Machine

Do not send a Windows Error Report when a generic driver is installed on a device Machine

Prevent installation of devices not described by other policy settings Machine

Prevent installation of devices that match any of these device IDs Machine

Prevent installation of devices using drivers that match these device setup classes Machine

Prevent installation of removable devices Machine

Treat all digitally signed drivers equally in the driver ranking and selection process Machine

Turn off "Found New Hardware" balloons during device installation Machine

Turn off Windows Update device driver search prompt Machine

Turn off Windows Update device driver search prompt User

Sets how often a DFS Client discovers DC's Machine

Do not allow Digital Locker to run Machine

Do not allow Digital Locker to run User

Disk Diagnostic: Configure custom alert text Machine

Disk Diagnostic: Configure execution level Machine

Turn Off Boot and Resume Optimizations Machine

Turn Off Cache Power Mode Machine

Turn Off Non Volatile Cache Feature Machine

Turn Off Solid State Mode Machine

Apply policy to removable media Machine

Default quota limit and warning level Machine

Enable disk quotas Machine

Enforce disk quota limit Machine

Log event when quota limit exceeded Machine

Log event when quota warning level exceeded Machine

Allow Distributed Link Tracking clients to use domain resources Machine

Allow DNS Suffix Appending to Unqualified Multi-Label Name Queries Machine

Connection-Specific DNS Suffix Machine

DNS Servers Machine

DNS Suffix Search List Machine

Dynamic Update Machine

Primary DNS Suffix Machine

Primary DNS Suffix Devolution Machine

Register DNS records with connection-specific DNS suffix Machine

Register PTR Records Machine

Registration Refresh Interval Machine

Replace Addresses In Conflicts Machine

TTL Set in the A and PTR records Machine

Turn off Multicast Name Resolution Machine

Update Security Level Machine

Update Top Level Domain Zones Machine

Do not allow color changes Machine

Do not allow color changes User

Do not allow desktop composition Machine

Do not allow desktop composition User

Do not allow Flip3D invocation Machine

Do not allow Flip3D invocation User

Do not allow window animations Machine

Do not allow window animations User

Specify a default color Machine

Specify a default color User

Do not automatically encrypt files moved to encrypted folders Machine

Configure Corporate Windows Error Reporting Machine

Configure Default consent Machine

Configure Default consent User

Configure Error Reporting Machine

Configure Report Archive Machine

Configure Report Archive User

Configure Report Queue Machine

Configure Report Queue User

Customize consent settings Machine

Customize consent settings User

Default application reporting settings Machine

Disable Logging Machine

Disable Logging User

Disable Windows Error Reporting Machine

Disable Windows Error Reporting User

Display Error Notification Machine

Do not send additional data Machine

Do not send additional data User

Ignore custom consent settings Machine

Ignore custom consent settings User

List of applications to always report errors for Machine

List of applications to be excluded Machine

List of applications to be excluded User

List of applications to never report errors for Machine

Prevent display of the user interface for critical errors Machine

Report operating system errors Machine

Configure the server address, refresh interval, and issuer certificate authority of a target Subscription Manager Machine

Backup log automatically when full Machine




Log Access Machine

Log Access Machine

Log Access Machine

Log Access Machine

Log File Path Machine




Maximum Log Size (KB) Machine




Retain old events Machine




Turn on logging Machine

Events.asp program Machine

Events.asp program command line parameters Machine

Events.asp URL Machine

Display the menu bar in Windows Explorer User

Prevent users from adding files to the root of their Users Files folder. User

Turn off common control and window animations User

Turn off heap termination on corruption Machine

Configure Corrupted File Recovery Behavior Machine

Selectively allow the evaluation of a symbolic link. Machine

Do not automatically make redirected folders available offline User

Use localized subfolder names when redirecting Start and My Documents Machine

Use localized subfolder names when redirecting Start and My Documents User

Turn off Details Pane User

Turn off Preview Pane User

Turn off downloading of game information Machine

Turn off tracking of last play time of games in the Games folder Machine

Century interpretation for Year 2000 User

Disallow changing of geographic location Machine

Disallow changing of geographic location User

Disallow selection of Custom Locales Machine

Disallow selection of Custom Locales User

Disallow user override of locale settings Machine

Disallow user override of locale settings User

Force selected system UI language to overwrite the user UI language Machine

Hide Regional and Language Options administrative options User

Hide the geographic location option User

Hide the select language group options User

Hide user locale selection and customization options User

Restrict selection of Windows menus and dialogs language User

Restrict system locales Machine

Restrict user locales Machine

Restrict user locales User

Restricts the UI language Windows uses for all logged users Machine

Restricts the UI languages Windows should use for the selected user User

Allow Cross-Forest User Policy and Roaming User Profiles Machine

Always use local ADM files for Group Policy Object Editor Machine

Create new Group Policy object links disabled by default User

Default name for new Group Policy objects User

Disallow Interactive Users from generating Resultant Set of Policy data Machine

Disallow Interactive Users from generating Resultant Set of Policy data User

Disk Quota policy processing Machine

EFS recovery policy processing Machine

Enforce Show Policies Only User

Folder Redirection policy processing Machine

Group Policy domain controller selection User

Group Policy refresh interval for computers Machine

Group Policy refresh interval for domain controllers Machine

Group Policy refresh interval for users User

Group Policy slow link detection Machine

Group Policy slow link detection User

Internet Explorer Maintenance policy processing Machine

IP Security policy processing Machine

Registry policy processing Machine

Remove users ability to invoke machine policy refresh Machine

Scripts policy processing Machine

Security policy processing Machine

Software Installation policy processing Machine

Startup policy processing wait time Machine

Turn off automatic update of ADM files User

Turn off background refresh of Group Policy Machine

Turn off Local Group Policy objects processing Machine

Turn off Resultant Set of Policy logging Machine

User Group Policy loopback processing mode Machine

Wired policy processing Machine

Wireless policy processing Machine

Applications Policy Processing Machine

Applications Policy Processing Machine

Computer Control Panel (GPOE) User

Data Sources (GPOE) User

Data Sources Policy Processing Machine

Data Sources Policy Processing Machine

Devices (GPOE) User

Devices Policy Processing Machine

Devices Policy Processing Machine

Drive Maps (GPOE) User

Drive Maps Policy Processing Machine

Drive Maps Policy Processing Machine

Environment (GPOE) User

Environment Policy Processing Machine

Environment Policy Processing Machine

Files (GPOE) User

Files Policy Processing Machine

Files Policy Processing Machine

Folder Options (GPOE) User

Folder Options Policy Processing Machine

Folder Options Policy Processing Machine

Folders (GPOE) User

Folders Policy Processing Machine

Folders Policy Processing Machine

Ini Files (GPOE) User

Ini Files Policy Processing Machine

Ini Files Policy Processing Machine

Internet Settings (GPOE) User

Internet Settings Policy Processing Machine

Internet Settings Policy Processing Machine

Local Users and Groups (GPOE) User

Local Users and Groups Policy Processing Machine

Local Users and Groups Policy Processing Machine

Network Options (GPOE) User

Network Options Policy Processing Machine

Network Options Policy Processing Machine

Network Shares (GPOE) User

Network Shares Policy Processing Machine

Network Shares Policy Processing Machine

Power Options (GPOE) User

Power Options Policy Processing Machine

Power Options Policy Processing Machine

Preference Application Plugins User

Preference Applications (GPOE) User

Preference View Extension - Application Extension (GPOE) User

Preference View Extension (GPOE) User

Printers (GPOE) User

Printers Policy Processing Machine

Printers Policy Processing Machine

Regional Options (GPOE) User

Regional Options Policy Processing Machine

Regional Options Policy Processing Machine

Registry (GPOE) User

Registry Policy Processing Machine

Registry Policy Processing Machine

Scheduled Tasks (GPOE) User

Scheduled Tasks Policy Processing Machine

Scheduled Tasks Policy Processing Machine

Services (GPOE) User

Services Policy Processing Machine

Services Policy Processing Machine

Shortcuts (GPOE) User

Shortcuts Policy Processing Machine

Shortcuts Policy Processing Machine

Start Menu (GPOE) User

Start Menu Policy Processing Machine

Start Menu Policy Processing Machine

User Control Panel (GPOE) User

Allow asynchronous user Group Policy processing when logging on through Terminal Services Machine

Restrict potentially unsafe HTML Help functions to specified folders Machine

Restrict these programs from being launched from Help Machine

Restrict these programs from being launched from Help User

Turn off Active Help Machine

Turn off Help Experience Improvement Program User

Turn off Help Ratings User

Turn off Untrusted Content Machine

Turn off Windows Online User

Turn off Windows HotStart Machine

Turn off Windows HotStart User

Restrict Internet communication Machine

Restrict Internet communication User

Turn off access to all Windows Update features Machine

Turn off Automatic Root Certificates Update Machine

Turn off downloading of print drivers over HTTP Machine

Turn off downloading of print drivers over HTTP User

Turn off Event Viewer "Events.asp" links Machine

Turn off Help and Support Center "Did you know?" content Machine

Turn off Help and Support Center Microsoft Knowledge Base search Machine

Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com Machine

Turn off Internet download for Web publishing and online ordering wizards Machine

Turn off Internet download for Web publishing and online ordering wizards User

Turn off Internet File Association service Machine

Turn off Internet File Association service User

Turn off printing over HTTP Machine

Turn off printing over HTTP User

Turn off Registration if URL connection is referring to Microsoft.com Machine

Turn off Search Companion content file updates Machine

Turn off the "Order Prints" picture task Machine

Turn off the "Order Prints" picture task User

Turn off the "Publish to Web" task for files and folders Machine

Turn off the "Publish to Web" task for files and folders User

Turn off the Windows Messenger Customer Experience Improvement Program Machine

Turn off the Windows Messenger Customer Experience Improvement Program User

Turn off Windows Customer Experience Improvement Program Machine

Turn off Windows Error Reporting Machine

Turn off Windows Network Connectivity Status Indicator active tests Machine

Turn off Windows Update device driver searching Machine

Prevent IIS installation Machine

Access data sources across domains Machine










Access data sources across domains User










Add a specific list of search providers to the user's search provider list Machine

Add a specific list of search providers to the user's search provider list User

Add-on List Machine

Add-on List User

Admin-approved behaviors Machine

Admin-approved behaviors User

All Processes Machine














All Processes User

All Processes User

All Processes User

All Processes User

All Processes User

All Processes User

All Processes User

All Processes User

All Processes User

All Processes User

All Processes User

All Processes User

All Processes User

All Processes User

Allow active content from CDs to run on user machines Machine

Allow active content from CDs to run on user machines User

Allow active content over restricted protocols to access my computer Machine





Allow active content over restricted protocols to access my computer User





Allow active scripting Machine










Allow active scripting User










Allow binary and script behaviors Machine










Allow binary and script behaviors User










Allow cut, copy or paste operations from the clipboard via script Machine










Allow cut, copy or paste operations from the clipboard via script User










Allow drag and drop or copy and paste files Machine










Allow drag and drop or copy and paste files User










Allow file downloads Machine










Allow file downloads User










Allow font downloads Machine










Allow font downloads User










Allow Install On Demand (except Internet Explorer) Machine

Allow Install On Demand (except Internet Explorer) User

Allow Install On Demand (Internet Explorer) Machine

Allow Install On Demand (Internet Explorer) User

Allow installation of desktop items Machine










Allow installation of desktop items User










Allow META REFRESH Machine










Allow META REFRESH User










Allow scripting of Internet Explorer web browser control Machine










Allow scripting of Internet Explorer web browser control User










Allow script-initiated windows without size or position constraints Machine










Allow script-initiated windows without size or position constraints User










Allow Scriptlets Machine










Allow Scriptlets User










Allow software to run or install even if the signature is invalid Machine

Allow software to run or install even if the signature is invalid User

Allow status bar updates via script Machine










Allow status bar updates via script User










Allow the display of image download placeholders User

Allow the printing of background colors and images User

Allow third-party browser extensions Machine

Allow third-party browser extensions User

Allow video and animation on a webpage that does not use external media player (through dynsrc attribute) Machine










Allow video and animation on a webpage that does not use external media player (through dynsrc attribute) User










Allow websites to open windows without address or status bars Machine










Allow websites to open windows without address or status bars User










Allow websites to prompt for information using scripted windows Machine










Allow websites to prompt for information using scripted windows User










Audio/Video Player User

Automatic prompting for ActiveX controls Machine










Automatic prompting for ActiveX controls User










Automatic prompting for file downloads Machine










Automatic prompting for file downloads User










Automatically check for Internet Explorer updates Machine

Automatically check for Internet Explorer updates User

Carpoint User

Check for server certificate revocation Machine

Check for server certificate revocation User

Check for signatures on downloaded programs Machine

Check for signatures on downloaded programs User

Configure Media Explorer Bar User

Configure Outlook Express User

Configure Toolbar Buttons User

Customize User Agent String Machine

Customize User Agent String User

Deny all add-ons unless specifically allowed in the Add-on List Machine

Deny all add-ons unless specifically allowed in the Add-on List User

DHTML Edit Control User

Disable "Configuring History" Machine

Disable "Configuring History" User

Disable adding channels User

Disable adding schedules for offline pages User

Disable all scheduled offline pages User

Disable AutoComplete for forms User

Disable Automatic Install of Internet Explorer components Machine

Disable caching of Auto-Proxy scripts User

Disable changing accessibility settings User

Disable changing Advanced page settings User

Disable changing Automatic Configuration settings Machine

Disable changing Automatic Configuration settings User

Disable changing Calendar and Contact settings User

Disable changing certificate settings User

Disable changing color settings User

Disable changing connection settings Machine

Disable changing connection settings User

Disable changing default browser check User

Disable changing font settings User

Disable changing home page settings User

Disable changing language settings User

Disable changing link color settings User

Disable changing Messaging settings User

Disable changing Profile Assistant settings User

Disable changing proxy settings Machine

Disable changing proxy settings User

Disable changing ratings settings User

Disable changing Temporary Internet files settings User

Disable channel user interface completely User

Disable Context menu User

Disable customizing browser toolbar buttons User

Disable customizing browser toolbars User

Disable downloading of site subscription content User

Disable editing and creating of schedule groups User

Disable editing schedules for offline pages User

Disable external branding of Internet Explorer User

Disable importing and exporting of favorites and feeds User

Disable Internet Connection wizard User

Disable offline page hit logging User

Disable Open in New Window menu option User

Disable Periodic Check for Internet Explorer software updates Machine

Disable removing channels User

Disable removing schedules for offline pages User

Disable Save this program to disk option User

Disable showing the splash screen Machine

Disable software update shell notifications on program launch Machine

Disable the Advanced page Machine

Disable the Advanced page User

Disable the Connections page Machine

Disable the Connections page User

Disable the Content page Machine

Disable the Content page User

Disable the General page Machine

Disable the General page User

Disable the Privacy page Machine

Disable the Privacy page User

Disable the Programs page Machine

Disable the Programs page User

Disable the Reset Web Settings feature User

Disable the Security page Machine

Disable the Security page User

Disable WinFX Runtime Components Setup Machine










Disable WinFX Runtime Components Setup User










Display error message on proxy script download failure User

Display mixed content Machine










Display mixed content User










Do not allow resetting Internet Explorer settings Machine

Do not allow resetting Internet Explorer settings User

Do not allow users to enable or disable add-ons Machine

Do not allow users to enable or disable add-ons User

Do not prompt for client certificate selection when no certificates or only one certificate exists. Machine










Do not prompt for client certificate selection when no certificates or only one certificate exists. User










Do not save encrypted pages to disk Machine

Do not save encrypted pages to disk User

Download signed ActiveX controls Machine










Download signed ActiveX controls User










Download unsigned ActiveX controls Machine










Download unsigned ActiveX controls User










Empty Temporary Internet Files folder when browser is closed Machine

Empty Temporary Internet Files folder when browser is closed User

Enable Native XMLHttp Support Machine

Enable Native XMLHttp Support User

Enforce Full Screen Mode Machine

Enforce Full Screen Mode User

File menu: Disable closing the browser and Explorer windows User

File menu: Disable New menu option User

File menu: Disable Open menu option User

File menu: Disable Save As Web Page Complete User

File menu: Disable Save As... menu option User

File size limits for Internet zone User

File size limits for Intranet zone User

File size limits for Local Machine zone User

File size limits for Restricted Sites zone User

File size limits for Trusted Sites zone User

Help menu: Remove 'For Netscape Users' menu option User

Help menu: Remove 'Send Feedback' menu option User

Help menu: Remove 'Tip of the Day' menu option User

Help menu: Remove 'Tour' menu option User

Hide Favorites menu User

Identity Manager: Prevent users from using Identities User

Include local directory path when uploading files to a server Machine










Include local directory path when uploading files to a server User










Initialize and script ActiveX controls not marked as safe Machine










Initialize and script ActiveX controls not marked as safe User










Internet Explorer Processes Machine













Internet Explorer Processes User













Internet Zone Restricted Protocols Machine

Internet Zone Restricted Protocols User

Internet Zone Template Machine

Internet Zone Template User

Intranet Sites: Include all local (intranet) sites not listed in other zones Machine

Intranet Sites: Include all local (intranet) sites not listed in other zones User

Intranet Sites: Include all network paths (UNCs) Machine

Intranet Sites: Include all network paths (UNCs) User

Intranet Sites: Include all sites that bypass the proxy server Machine

Intranet Sites: Include all sites that bypass the proxy server User

Intranet Zone Restricted Protocols Machine

Intranet Zone Restricted Protocols User

Intranet Zone Template Machine

Intranet Zone Template User

Investor User

Java permissions Machine










Java permissions User










Launching applications and files in an IFRAME Machine










Launching applications and files in an IFRAME User










Launching programs and unsafe files Machine










Launching programs and unsafe files User










Local Machine Zone Restricted Protocols Machine

Local Machine Zone Restricted Protocols User

Local Machine Zone Template Machine

Local Machine Zone Template User

Locked-Down Internet Zone Template Machine

Locked-Down Internet Zone Template User

Locked-Down Intranet Zone Template Machine

Locked-Down Intranet Zone Template User

Locked-Down Local Machine Zone Template Machine

Locked-Down Local Machine Zone Template User

Locked-Down Restricted Sites Zone Template Machine

Locked-Down Restricted Sites Zone Template User

Locked-Down Trusted Sites Zone Template Machine

Locked-Down Trusted Sites Zone Template User

Logon options Machine










Logon options User

Logon options User

Logon options User

Logon options User

Logon options User

Logon options User

Logon options User

Logon options User

Logon options User

Logon options User

Loose or un-compiled XAML files Machine










Loose or un-compiled XAML files User










Make proxy settings per-machine (rather than per-user) Machine

Menu Controls User

Microsoft Agent User

Microsoft Chat User

Microsoft Scriptlet Component User

Microsoft Survey Control User

Moving the menu bar above the navigation bar User

MSNBC User

Navigate sub-frames across different domains Machine










Navigate sub-frames across different domains User










NetShow File Transfer Control User

Open files based on content, not file extension Machine










Open files based on content, not file extension User










Play animations in web pages Machine

Play animations in web pages User

Play sounds in web pages Machine

Play sounds in web pages User

Play videos in web pages Machine

Play videos in web pages User

Pop-up allow list Machine

Pop-up allow list User

Prevent "Fix settings" functionality Machine

Prevent "Fix settings" functionality User

Prevent configuration of search from the Address bar User

Prevent ignoring certificate errors Machine

Prevent ignoring certificate errors User

Prevent participation in the Customer Experience Improvement Program Machine

Prevent participation in the Customer Experience Improvement Program User

Prevent performance of First Run Customize settings Machine

Prevent performance of First Run Customize settings User

Prevent setting of the code download path for each machine Machine

Prevent the configuration of cipher strength update information URLs Machine

Prevent the deletion of temporary Internet files and cookies Machine

Prevent the deletion of temporary Internet files and cookies User

Prevent the Internet Explorer search box from displaying Machine

Prevent the Internet Explorer search box from displaying User

Prevent the use of Windows colors User

Prevent users from choosing default text size User

Prevent users from configuring background color User

Prevent users from configuring text color User

Prevent users from configuring the color of links that have already been clicked User

Prevent users from configuring the color of links that have not yet been clicked User

Prevent users from configuring the hover color User

Process List Machine














Process List User

Process List User

Process List User

Process List User

Process List User

Process List User

Process List User

Process List User

Process List User

Process List User

Process List User

Process List User

Process List User

Process List User

Restrict changing the default search provider Machine

Restrict changing the default search provider User

Restrict search providers to a specific list of providers Machine

Restrict search providers to a specific list of providers User

Restricted Sites Zone Restricted Protocols Machine

Restricted Sites Zone Restricted Protocols User

Restricted Sites Zone Template Machine

Restricted Sites Zone Template User

Run .NET Framework-reliant components not signed with Authenticode Machine










Run .NET Framework-reliant components not signed with Authenticode User










Run .NET Framework-reliant components signed with Authenticode Machine










Run .NET Framework-reliant components signed with Authenticode User










Run ActiveX controls and plugins Machine










Run ActiveX controls and plugins User










Script ActiveX controls marked safe for scripting Machine










Script ActiveX controls marked safe for scripting User










Scripting of Java applets Machine










Scripting of Java applets User










Search: Disable Find Files via F3 within the browser User

Search: Disable Search Customization User

Security Zones: Do not allow users to add/delete sites Machine

Security Zones: Do not allow users to change policies Machine

Security Zones: Use only machine settings Machine

Send internationalized domain names Machine

Send internationalized domain names User

Shockwave Flash User

Site to Zone Assignment List Machine

Site to Zone Assignment List User

Software channel permissions Machine










Software channel permissions User










Submit non-encrypted form data Machine










Submit non-encrypted form data User










Subscription Limits User

Tools menu: Disable Internet Options... menu option User

Trusted Sites Zone Restricted Protocols Machine

Trusted Sites Zone Restricted Protocols User

Trusted Sites Zone Template Machine

Trusted Sites Zone Template User

Turn off "Delete Browsing History" functionality Machine

Turn off "Delete Browsing History" functionality User

Turn off "Delete Forms" functionality Machine

Turn off "Delete Forms" functionality User

Turn off "Delete Passwords" functionality Machine

Turn off "Delete Passwords" functionality User

Turn off addition and removal of feeds Machine

Turn off addition and removal of feeds User

Turn off automatic image resizing User

Turn off background sync for feeds Machine

Turn off background sync for feeds User

Turn off changing the URL to be displayed for checking updates to Internet Explorer and Internet Tools Machine

Turn off ClearType Machine

Turn off ClearType User

Turn off configuration of default behavior of new tab creation Machine

Turn off configuration of default behavior of new tab creation User

Turn off configuration of tabbed browsing pop-up behavior Machine

Turn off configuration of tabbed browsing pop-up behavior User

Turn off configuration of window reuse Machine

Turn off configuration of window reuse User

Turn off configuring the update check interval (in days) Machine

Turn off configuring underline links User

Turn off Crash Detection Machine

Turn off Crash Detection User

Turn off displaying the Internet Explorer Help Menu Machine

Turn off displaying the Internet Explorer Help Menu User

Turn off downloading of enclosures Machine

Turn off downloading of enclosures User

Turn off feed discovery Machine

Turn off feed discovery User

Turn Off First-Run Opt-In Machine










Turn Off First-Run Opt-In User










Turn off friendly http error messages User

Turn off inline AutoComplete in Windows Explorer User

Turn off Managing Phishing filter Machine

Turn off Managing Phishing filter User

Turn off Managing Pop-up Allow list Machine

Turn off Managing Pop-up Allow list User

Turn off managing Pop-up filter level Machine

Turn off managing Pop-up filter level User

Turn off page transitions User

Turn off page zooming functionality Machine

Turn off page zooming functionality User

Turn off picture display User

Turn off pop-up management Machine

Turn off pop-up management User

Turn off Profile Assistant Machine

Turn off Profile Assistant User

Turn off Quick Tabs functionality Machine

Turn off Quick Tabs functionality User

Turn off sending URLs as UTF-8(requires restart) User

Turn off smart image dithering User

Turn off smooth scrolling User

Turn off tabbed browsing Machine

Turn off tabbed browsing User

Turn off the auto-complete feature for web addresses User

Turn off the feed list Machine

Turn off the feed list User

Turn off the Security Settings Check feature Machine

Turn off the Security Settings Check feature User

Turn off toolbar upgrade tool Machine

Turn off toolbar upgrade tool User

Turn on automatic detection of the intranet Machine

Turn on automatic detection of the intranet User

Turn on Automatic Signup User

Turn on Compatibility Logging Machine

Turn on Compatibility Logging User

Turn on Information bar notification for intranet content Machine

Turn on Information bar notification for intranet content User

Turn on inline AutoComplete for Web addresses User

Turn on menu bar by default Machine

Turn on menu bar by default User

Turn on Protected Mode Machine










Turn on Protected Mode User










Turn on script debugging User

Turn on the auto-complete feature for user names and passwords on forms User

Turn on the display of a notification about every script error User

Turn on the hover color option User

Turn on the Internet Connection Wizard Auto Detect User

Use Automatic Detection for dial-up connections User

Use phishing filter Machine










Use phishing filter User










Use Pop-up Blocker Machine










Use Pop-up Blocker User










Use UTF-8 for mailto links Machine

Use UTF-8 for mailto links User

Userdata persistence Machine










Userdata persistence User










View menu: Disable Full Screen menu option User

View menu: Disable Source menu option User

Web Browser Applications Machine










Web Browser Applications User










Web sites in less privileged Web content zones can navigate into this zone Machine










Web sites in less privileged Web content zones can navigate into this zone User










XPS files Machine

XPS files Machine

XPS files Machine

XPS files Machine

XPS files Machine

XPS files Machine

XPS files Machine

XPS files Machine

XPS files Machine

XPS files Machine

XPS files User

XPS files User

XPS files User

XPS files User

XPS files User

XPS files User

XPS files User

XPS files User

XPS files User

XPS files User

Turn off handwriting recognition error reporting Machine

Turn off handwriting recognition error reporting User

Turn off automatic learning Machine

Turn off automatic learning User

Turn off handwriting personalization Machine

Turn off handwriting personalization User

Do not allow adding new targets via manual configuration Machine

Do not allow additional session logins Machine

Do not allow changes to initiator CHAP secret Machine

Do not allow changes to initiator iqn name Machine

Do not allow connections without IPSec Machine

Do not allow manual configuration of discovered targets Machine

Do not allow manual configuration of iSNS servers Machine

Do not allow manual configuration of target portals Machine

Do not allow sessions without mutual CHAP Machine

Do not allow sessions without one way CHAP Machine

Provide information about previous logons to client computers Machine

Define host name-to-Kerberos realm mappings Machine

Define interoperable Kerberos V5 realm settings Machine

Require strict KDC validation Machine

Configure Scenario Execution Level Machine

Turn on Mapper I/O (LLTDIO) driver Machine

Turn on Responder (RSPNDR) driver Machine

Always use classic logon Machine

Always wait for the network at computer startup and logon Machine

Do not process the legacy run list Machine

Do not process the legacy run list User

Do not process the run once list Machine

Do not process the run once list User

Don't display the Getting Started welcome screen at logon Machine

Don't display the Getting Started welcome screen at logon User

Hide entry points for Fast User Switching Machine

Remove Boot / Shutdown / Logon / Logoff status messages Machine

Run these programs at user logon Machine

Run these programs at user logon User

Turn off Windows Startup Sound Machine

Verbose vs normal status messages Machine

Do not allow Windows Media Center to run Machine

Do not allow Windows Media Center to run User

ActiveX Control User

Extended View (Web View) User

Link to Web Address User

Restrict the user from entering author mode User

Restrict users to the explicitly permitted list of snap-ins User

.Net Framework Configuration User

Active Directory Domains and Trusts User

Active Directory Sites and Services User

Active Directory Users and Computers User

Administrative Templates (Computers) User

Administrative Templates (Computers) User

Administrative Templates (Users) User

Administrative Templates (Users) User

ADSI Edit User

AppleTalk Routing User

Authorization Manager User

Certificate Templates User

Certificates User

Certification Authority User

Certification Authority Policy Settings User

Component Services User

Computer Management User

Connection Sharing (NAT) User

DCOM Configuration Extension User

Device Manager User

Device Manager User

DHCP Relay Management User

Disk Defragmenter User

Disk Management User

Distributed File System User

Enterprise PKI User

Event Viewer User

Event Viewer User

Event Viewer (Windows Vista) User

Event Viewer (Windows Vista) User

Failover Clusters Manager User

FAX Service User

Folder Redirection User

Folder Redirection User

FrontPage Server Extensions User

Group Policy Management User

Group Policy Object Editor User

Group Policy tab for Active Directory Tools User

Health Registration Authority (HRA) User

IAS Logging User

IGMP Routing User

Indexing Service User

Internet Authentication Service (IAS) User

Internet Explorer Maintenance User

Internet Explorer Maintenance User

Internet Information Services User

IP Routing User

IP Security Monitor User

IP Security Policy Management User

IP Security Policy Management User

IPX RIP Routing User

IPX Routing User

IPX SAP Routing User

Local Users and Groups User

Logical and Mapped Drives User

NAP Client Configuration User

NAP Client Configuration User

Network Policy Server (NPS) User

Online Responder User

OSPF Routing User

Performance Logs and Alerts User

Public Key Policies User

QoS Admission Control User

RAS Dialin - User Node User

Remote Access User

Remote Desktops User

Remote Installation Services User

Removable Storage User

Removable Storage Management User

Resultant Set of Policy snap-in User

RIP Routing User

Routing User

Routing and Remote Access User

Scripts (Logon/Logoff) User

Scripts (Logon/Logoff) User

Scripts (Startup/Shutdown) User

Scripts (Startup/Shutdown) User

Security Configuration and Analysis User

Security Settings User

Security Settings User

Security Templates User

Send Console Message User

Server Manager User

Service Dependencies User

Services User

Shared Folders User

Shared Folders Ext User

SMTP Protocol User

SNMP User

Software Installation (Computers) User

Software Installation (Computers) User

Software Installation (Users) User

Software Installation (Users) User

System Information User

System Properties User

Telephony User

Terminal Services Configuration User

TPM Management User

Windows Firewall with Advanced Security User

Windows Firewall with Advanced Security User

Wired Network (IEEE 802.3) Policies User

Wireless Monitor User

Wireless Network (IEEE 802.11) Policies User

WMI Control User

DFS Management User

DFS Management Extension User

Disk Management Extension User

File Server Resource Manager User

File Server Resource Manager Extension User

Group Policy Management Editor User

Group Policy Starter GPO Editor User

Share and Storage Management User

Share and Storage Management Extension User

Storage Manager for SANs User

Storage Manager for SANS Extension User

Turn off Windows Mobility Center Machine

Turn off Windows Mobility Center User

Turn off Windows presentation settings Machine

Turn off Windows presentation settings User

Do not allow Windows Movie Maker to run Machine

Do not allow Windows Movie Maker to run User

Turn off Windows Movie Maker automatic codec downloads machine

Turn off Windows Movie Maker automatic codec downloads user

Turn off Windows Movie Maker online Web links Machine

Turn off Windows Movie Maker online Web links User

Turn off Windows Movie Maker saving to online video hosting provider machine

Turn off Windows Movie Maker saving to online video hosting provider user

Microsoft Support Diagnostic Tool: Configure execution level Machine

Microsoft Support Diagnostic Tool: Restrict tool download Machine

Allow admin to install from Terminal Services session Machine

Always install with elevated privileges Machine

Always install with elevated privileges User

Baseline file cache maximum size Machine

Cache transforms in secure location on workstation Machine

Disable IE security prompt for Windows Installer scripts Machine

Disable logging via package settings Machine

Disable Windows Installer Machine

Enable user control over installs Machine

Enable user to browse for source while elevated Machine

Enable user to patch elevated products Machine

Enable user to use media source while elevated Machine

Enforce upgrade component rules Machine

Logging Machine

Prevent removable media source for any install User

Prohibit Flyweight Patching Machine

Prohibit non-administrators from applying vendor signed updates Machine

Prohibit patching Machine

Prohibit removal of updates Machine

Prohibit rollback Machine

Prohibit rollback User

Prohibit Use of Restart Manager Machine

Prohibit User Installs Machine

Remove browse dialog box for new source Machine

Search order User

Turn off creation of System Restore Checkpoints Machine

Allow the Network Access Protection client to support the 802.1x Enforcement Client component Machine

Allow cryptography algorithms compatible with Windows NT 4.0 Machine

Automated Site Coverage by the DC Locator DNS SRV Records Machine

Contact PDC on logon failure Machine

DC Locator DNS records not registered by the DCs Machine

Do not process incoming mailslot messages used for domain controller location based on NetBIOS domain names Machine

Domain Controller Address Type Returned Machine

Dynamic Registration of the DC Locator DNS Records Machine

Expected dial-up delay on logon Machine

Final DC Discovery Retry Setting for Background Callers Machine

Force Rediscovery Interval Machine

Initial DC Discovery Retry Setting for Background Callers Machine

Location of the DCs hosting a domain with single label DNS name Machine

Log File Debug Output Level Machine

Maximum DC Discovery Retry Interval Setting for Background Callers Machine

Maximum Log File Size Machine

Negative DC Discovery Cache Setting Machine

Netlogon share compatibility Machine

Positive Periodic DC Cache Refresh for Background Callers Machine

Positive Periodic DC Cache Refresh for Non-Background Callers Machine

Priority Set in the DC Locator DNS SRV Records Machine

Refresh Interval of the DC Locator DNS Records Machine

Scavenge Interval Machine

Site Name Machine

Sites Covered by the Application Directory Partition Locator DNS SRV Records Machine

Sites Covered by the DC Locator DNS SRV Records Machine

Sites Covered by the GC Locator DNS SRV Records Machine

Sysvol share compatibility Machine

Try Next Closest Site Machine

TTL Set in the DC Locator DNS Records Machine

Weight Set in the DC Locator DNS SRV Records Machine

Ability to change properties of an all user remote access connection User

Ability to delete all user remote access connections User

Ability to Enable/Disable a LAN connection User

Ability to rename all user remote access connections User

Ability to rename LAN connections User

Ability to rename LAN connections or remote access connections available to all users User

Enable Windows 2000 Network Connections settings for Administrators User

Prohibit access to properties of a LAN connection User

Prohibit access to properties of components of a LAN connection User

Prohibit access to properties of components of a remote access connection User

Prohibit access to the Advanced Settings item on the Advanced menu User

Prohibit access to the New Connection Wizard User

Prohibit access to the Remote Access Preferences item on the Advanced menu User

Prohibit adding and removing components for a LAN or remote access connection User

Prohibit changing properties of a private remote access connection User

Prohibit connecting and disconnecting a remote access connection User

Prohibit deletion of remote access connections User

Prohibit Enabling/Disabling components of a LAN connection User

Prohibit installation and configuration of Network Bridge on your DNS domain network Machine

Prohibit renaming private remote access connections User

Prohibit TCP/IP advanced configuration User

Prohibit use of Internet Connection Firewall on your DNS domain network Machine

Prohibit use of Internet Connection Sharing on your DNS domain network Machine

Prohibit viewing of status for an active connection User

Turn off notifications when a connection has only limited or no connectivity User

Turn off Connect to a Network Projector Machine

Turn off Connect to a Network Projector User

Action on server disconnect Machine

Action on server disconnect User

Administratively assigned offline files Machine

Administratively assigned offline files User

Allow or Disallow use of the Offline Files feature Machine

At logoff, delete local copy of user’s offline files Machine

Configure Slow link speed Machine

Configure slow-link mode Machine

Default cache size Machine

Encrypt the Offline Files cache Machine

Event logging level Machine

Event logging level User

Files not cached Machine

Initial reminder balloon lifetime Machine

Initial reminder balloon lifetime User

Limit disk space used by offline files Machine

Non-default server disconnect actions Machine

Non-default server disconnect actions User

Prevent use of Offline Files folder Machine

Prevent use of Offline Files folder User

Prohibit 'Make Available Offline' for these file and folders Machine

Prohibit 'Make Available Offline' for these file and folders User

Prohibit user configuration of Offline Files Machine

Prohibit user configuration of Offline Files User

Reminder balloon frequency Machine

Reminder balloon frequency User

Reminder balloon lifetime Machine

Reminder balloon lifetime User

Remove 'Make Available Offline' Machine

Remove 'Make Available Offline' User

Subfolders always available offline Machine

Synchronize all offline files before logging off Machine

Synchronize all offline files before logging off User

Synchronize all offline files when logging on Machine

Synchronize all offline files when logging on User

Synchronize offline files before suspend Machine

Synchronize offline files before suspend User

Turn off reminder balloons Machine

Turn off reminder balloons User

Turn on economical application of administratively assigned Offline Files Machine

Disable password strength validation for Peer Grouping Machine

Set PNRP cloud to resolve only Machine



Set the Seed Server Machine



Turn off Microsoft Peer-to-Peer Networking Services Machine

Turn off Multicast Bootstrap Machine



Turn off PNRP cloud creation Machine



Make Parental Controls control panel visible on a Domain Machine

Detect application failures caused by deprecated Windows DLLs or COM objects Machine

Detect application install failures Machine

Detect application installers that need to be run as administrator Machine

Detect applications unable to launch installers under UAC Machine

Notify blocked drivers Machine

Turn off Tablet PC Pen Training Machine

Turn off Tablet PC Pen Training User

Turn off access to the OEM and Microsoft branding section machine

Turn off access to the OEM and Microsoft branding section user

Turn off access to the performance center core section machine

Turn off access to the performance center core section user

Turn off access to the solutions to performance problems section machine

Turn off access to the solutions to performance problems section user





Allow Standby States (S1-S3) When Sleeping (On Battery) Machine

Allow Standby States (S1-S3) When Sleeping (Plugged In) Machine

Critical Battery Notification Action Machine

Critical Battery Notification Level Machine

Do not turn off system power after a Windows system shutdown has occurred. Machine

Low Battery Notification Action Machine

Low Battery Notification Level Machine

Prompt for password on resume from hibernate / suspend User

Require a Password When a Computer Wakes (On Battery) Machine

Require a Password When a Computer Wakes (Plugged In) Machine

Select an Active Power Plan Machine

Select the Lid Switch Action (On Battery) Machine

Select the Lid Switch Action (Plugged In) Machine

Select the Power Button Action (On Battery) Machine

Select the Power Button Action (Plugged In) Machine

Select the Sleep Button Action (On Battery) Machine

Select the Sleep Button Action (Plugged In) Machine

Select the Start Menu Power Button Action (On Battery) Machine

Select the Start Menu Power Button Action (Plugged In) Machine

Specify a Custom Active Power Plan Machine

Specify the System Hibernate Timeout (On Battery) Machine

Specify the System Hibernate Timeout (Plugged In) Machine

Specify the System Sleep Timeout (On Battery) Machine

Specify the System Sleep Timeout (Plugged In) Machine

Turn Off Adaptive Display Timeout (On Battery) Machine

Turn Off Adaptive Display Timeout (Plugged In) Machine

Turn Off Hybrid Sleep (On Battery) Machine

Turn Off Hybrid Sleep (Plugged In) Machine

Turn Off Low Battery User Notification Machine

Turn Off the Display (On Battery) Machine

Turn Off the Display (Plugged In) Machine

Turn Off the Hard Disk (On Battery) Machine

Turn Off the Hard Disk (Plugged In) Machine

Turn on Applications to Prevent Sleep Transitions (On Battery) Machine

Turn on Applications to Prevent Sleep Transitions (Plugged In) Machine

Hide previous versions list for local files Machine

Hide previous versions list for local files User

Hide previous versions list for remote files Machine

Hide previous versions list for remote files User

Hide previous versions of files on backup location Machine

Hide previous versions of files on backup location User

Prevent restoring local previous versions Machine

Prevent restoring local previous versions User

Prevent restoring previous versions from backups Machine

Prevent restoring previous versions from backups User

Prevent restoring remote previous versions Machine

Prevent restoring remote previous versions User

Add Printer wizard - Network scan page (Managed network) Machine

Add Printer wizard - Network scan page (Unmanaged network) Machine

Allow Print Spooler to accept client connections Machine

Allow printers to be published Machine

Allow pruning of published printers Machine

Always render print jobs on the server Machine

Automatically publish new printers in Active Directory Machine

Browse a common web site to find printers User

Browse the network to find printers User

Check published state Machine

Computer location Machine

Custom support URL in the Printers folder's left pane Machine

Default Active Directory path when searching for printers User

Directory pruning interval Machine

Directory pruning priority Machine

Directory pruning retry Machine

Disallow installation of printers using kernel-mode drivers Machine

Log directory pruning retry events Machine

Only use Package Point and print User

Package Point and print - Approved servers User

Point and Print Restrictions User

Pre-populate printer search location text Machine

Prevent addition of printers User

Prevent deletion of printers User

Printer browsing Machine

Prune printers that are not automatically republished Machine

Web-based printing Machine

Hide "Get Programs" page User

Hide "Installed Updates" page User

Hide "Programs and Features" page User

Hide "Set Program Access and Computer Defaults" page User

Hide "Windows Features" User

Hide "Windows Marketplace" User

Hide the Programs Control Panel User

Set the number of retries for Password sync Servers Machine

Set the retry interval for Password sync Servers Machine

Turn On Extensive logging for Password sync Servers Machine

Turn on the Windows to NIS password sync for migrated users for Password sync Servers Machine

Best effort service type Machine



Controlled load service type Machine



Guaranteed service type Machine



Limit outstanding packets Machine

Limit reservable bandwidth Machine

Network control service type Machine



Non-conforming packets Machine

Qualitative service type Machine



Set timer resolution Machine


Activate Shutdown Event Tracker System State Data feature Machine

Display Shutdown Event Tracker Machine

Enable Persistent Time Stamp Machine

Report unplanned shutdown events Machine

Allow only Vista or later connections Machine

Customize Warning Messages Machine

Offer Remote Assistance Machine

Solicited Remote Assistance Machine

Turn on bandwidth optimization Machine

Turn on session logging Machine

All Removable Storage classes: Deny all access Machine

All Removable Storage classes: Deny all access User

All Removable Storage: Allow direct access in remote sessions Machine

CD and DVD: Deny read access Machine

CD and DVD: Deny read access User

CD and DVD: Deny write access Machine

CD and DVD: Deny write access User

Custom Classes: Deny read access Machine

Custom Classes: Deny read access User

Custom Classes: Deny write access Machine

Custom Classes: Deny write access User

Floppy Drives: Deny read access Machine

Floppy Drives: Deny read access User

Floppy Drives: Deny write access Machine

Floppy Drives: Deny write access User

Removable Disks: Deny read access Machine

Removable Disks: Deny read access User

Removable Disks: Deny write access Machine

Removable Disks: Deny write access User

Tape Drives: Deny read access Machine

Tape Drives: Deny read access User

Tape Drives: Deny write access Machine

Tape Drives: Deny write access User

Time (in seconds) to force reboot Machine

Time (in seconds) to force reboot User

WPD Devices: Deny read access Machine

WPD Devices: Deny read access User

WPD Devices: Deny write access Machine

WPD Devices: Deny write access User

Ignore Delegation Failure Machine

Minimum Idle Connection Timeout for RPC/HTTP connections Machine

Propagation of extended error information Machine

Restrictions for Unauthenticated RPC clients Machine

RPC Endpoint Mapper Client Authentication Machine

RPC Troubleshooting State Information Machine

Allow logon scripts when NetBIOS or WINS is disabled Machine

Maximum wait time for Group Policy scripts Machine

Run legacy logon scripts hidden User

Run logoff scripts visible User

Run logon scripts synchronously Machine

Run logon scripts synchronously User

Run logon scripts visible User

Run shutdown scripts visible Machine

Run startup scripts asynchronously Machine

Run startup scripts visible Machine

Allow indexing of encrypted files Machine

Allow using diacritics Machine

Indexer data location Machine

Prevent displaying advanced indexing options in the Control Panel Machine

Prevent indexing e-mail attachments Machine

Prevent indexing files in Offline Files cache Machine

Prevent indexing Microsoft Office Outlook Machine

Prevent indexing public folders Machine

Prevent indexing uncached Exchange folders Machine

Turn on Security Center (Domain PCs only) Machine

Configure the refresh interval for Server Manager Machine

Do not display Initial Configuration Tasks window automatically at logon Machine

Do not display Manage Your Server page at logon Machine

Do not display Server Manager automatically at logon Machine

Specify Windows installation file location Machine

Specify Windows Service Pack installation file location Machine

Allow DFS roots to be published User

Allow shared folders to be published User

Prevent users from sharing files within their profile. User

Don't run specified Windows applications User

Prevent access to registry editing tools User

Prevent access to the command prompt User

Run only specified Windows applications User

Do not display the Welcome Center at user logon User

Disable unpacking and installation of gadgets that are not digitally signed. Machine

Disable unpacking and installation of gadgets that are not digitally signed. User

Override the More Gadgets Link Machine

Override the More Gadgets Link User

Turn Off User Installed Windows Sidebar Gadgets Machine

Turn Off User Installed Windows Sidebar Gadgets User

Turn off Windows Sidebar Machine

Turn off Windows Sidebar User

Delete data from devices running Microsoft firmware when a user logs off from the computer. Machine

Delete data from devices running Microsoft firmware when a user logs off from the computer. User

Require a PIN to access data on devices running Microsoft firmware Machine

Require a PIN to access data on devices running Microsoft firmware User

Turn off automatic wake Machine

Turn off automatic wake User

Turn off Windows SideShow Machine

Turn off Windows SideShow User

Allow certificates with no extended key usage certificate attribute Machine

Allow Integrated Unblock screen to be displayed at the time of logon Machine

Allow signature keys valid for Logon Machine

Allow time invalid certificates Machine

Allow user name hint Machine

Configure root certificate clean up Machine

Display string when smart card is blocked Machine

Filter duplicate logon certificates Machine

Force the reading of all certificates from the smart card Machine

Prevent plaintext PINs from being returned by Credential Manager Machine

Reverse the subject name stored in a certificate when displaying Machine

Turn on certificate propagation from smart card Machine

Turn on root certificate propagation from smart card Machine

Set update interval for NIS subordinate servers Machine

Turn on extensive logging for domain controllers running Server for NIS Machine

Communities Machine

Permitted Managers Machine

Traps for public community Machine

Do not allow Sound Recorder to run Machine

Do not allow Sound Recorder to run User

Add "Run in Separate Memory Space" check box to Run dialog box User

Add Logoff to the Start Menu User

Add the Run command to the Start Menu User

Clear history of recently opened documents on exit User

Clear the recent programs list for new users User

Do not display any custom toolbars in the taskbar User

Do not keep history of recently opened documents User

Do not search communications User

Do not search files User

Do not search Internet User

Do not search programs User

Do not use the search-based method when resolving shell shortcuts User

Do not use the tracking-based method when resolving shell shortcuts User

Force classic Start Menu User

Gray unavailable Windows Installer programs Start Menu shortcuts User

Hide the notification area User

Lock the Taskbar User

Prevent changes to Taskbar and Start Menu Settings User

Prevent grouping of taskbar items User

Remove access to the context menus for the taskbar User

Remove All Programs list from the Start menu User

Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands User

Remove Balloon Tips on Start Menu items User

Remove Clock from the system notification area User

Remove common program groups from Start Menu User

Remove Default Programs link from the Start menu. User

Remove Documents icon from Start Menu User

Remove Drag-and-drop context menus on the Start Menu User

Remove Favorites menu from Start Menu User

Remove frequent programs list from the Start Menu User

Remove Games link from Start Menu User

Remove Help menu from Start Menu User

Remove links and access to Windows Update User

Remove Logoff on the Start Menu User

Remove Music icon from Start Menu User

Remove Network Connections from Start Menu User

Remove Network icon from Start Menu User

Remove Pictures icon from Start Menu User

Remove pinned programs list from the Start Menu User

Remove programs on Settings menu User

Remove Recent Items menu from Start Menu User

Remove Run menu from Start Menu User

Remove Search Computer link User

Remove Search link from Start Menu User

Remove the "Undock PC" button from the Start Menu User

Remove user folder link from Start Menu User

Remove user name from Start Menu User

Remove user's folders from the Start Menu User

Show QuickLaunch on Taskbar User

Turn off notification area cleanup User

Turn off personalized menus User

Turn off user tracking User

Use folders instead of library User

Set the Email IDs to which notifications are to be sent Machine

Set the SMTP Server used to send notifications Machine

Set the Time interval in minutes for logging accounting data Machine

Turn on Accounting for WSRM Machine

Turn off Configuration Machine

Turn off System Restore Machine

For tablet pen input, don’t show the Input Panel icon Machine

For tablet pen input, don’t show the Input Panel icon User

For touch input, don’t show the Input Panel icon Machine

For touch input, don’t show the Input Panel icon User

Include rarely used Chinese, Kanji, or Hanja characters Machine

Include rarely used Chinese, Kanji, or Hanja characters User

Prevent Input Panel tab from appearing Machine

Prevent Input Panel tab from appearing User

Switch to the Simplified Chinese (PRC) gestures Machine

Switch to the Simplified Chinese (PRC) gestures User

Turn off AutoComplete integration with Input Panel Machine

Turn off AutoComplete integration with Input Panel User

Turn off password security in Input Panel Machine

Turn off password security in Input Panel User

Turn off tolerant and Z-shaped scratch-out gestures Machine

Turn off tolerant and Z-shaped scratch-out gestures User

Do not allow Inkball to run Machine

Do not allow Inkball to run User

Do not allow printing to Journal Note Writer Machine

Do not allow printing to Journal Note Writer User

Do not allow Snipping Tool to run Machine

Do not allow Snipping Tool to run User

Do not allow Sticky Notes to be run Machine

Do not allow Sticky Notes to be run User

Do not allow Windows Journal to be run Machine

Do not allow Windows Journal to be run User

Prevent Back-ESC mapping Machine

Prevent Back-ESC mapping User

Prevent flicks Machine

Prevent flicks User

Prevent Flicks Learning Mode Machine

Prevent Flicks Learning Mode User

Prevent launch an application Machine

Prevent launch an application User

Prevent press and hold Machine

Prevent press and hold User

Turn off hardware buttons Machine

Turn off hardware buttons User

Turn off pen feedback Machine

Turn off pen feedback User

Lock all taskbar settings User

Prevent users from adding or removing toolbars User

Prevent users from moving taskbar to another screen dock location User

Prevent users from rearranging toolbars User

Prevent users from resizing the taskbar User

Remove the battery meter User

Remove the networking icon User

Remove the volume control icon User

Turn off all balloon notifications User

Turn off taskbar thumbnails User

Hide Advanced Properties Checkbox in Add Scheduled Task Wizard Machine

Hide Advanced Properties Checkbox in Add Scheduled Task Wizard User

Hide Property Pages Machine

Hide Property Pages User

Prevent Task Run or End Machine

Prevent Task Run or End User

Prohibit Browse Machine

Prohibit Browse User

Prohibit Drag-and-Drop Machine

Prohibit Drag-and-Drop User

Prohibit New Task Creation Machine

Prohibit New Task Creation User

Prohibit Task Deletion Machine

Prohibit Task Deletion User

Allow .rdp files from unknown publishers Machine

Allow .rdp files from unknown publishers User

Allow .rdp files from valid publishers and user's default .rdp settings Machine

Allow .rdp files from valid publishers and user's default .rdp settings User

Allow audio redirection Machine

Allow time zone redirection Machine

Allow users to connect remotely using Terminal Services Machine

Always prompt for password upon connection Machine

Always show desktop on connection Machine

Automatic reconnection Machine

Configure keep-alive connection interval Machine

Configure server authentication for client Machine

Configure TS Session Broker farm name Machine

Configure TS Session Broker server name Machine

Deny logoff of an administrator logged in to the console session Machine

Do not allow client printer redirection Machine

Do not allow clipboard redirection Machine

Do not allow COM port redirection Machine

Do not allow drive redirection Machine

Do not allow local administrators to customize permissions Machine

Do not allow LPT port redirection Machine

Do not allow passwords to be saved Machine

Do not allow passwords to be saved User

Do not allow smart card device redirection Machine

Do not allow supported Plug and Play device redirection Machine

Do not delete temp folder upon exit Machine

Do not set default client printer to be default printer in a session Machine

Do not use temporary folders per session Machine

Enable connection through TS Gateway User

Enforce Removal of Remote Desktop Wallpaper Machine

Hide notifications about TS Licensing problems that affect the terminal server Machine

Join TS Session Broker Machine

License server security group Machine

Limit maximum color depth Machine

Limit number of connections Machine

Prevent license upgrade Machine

Prompt for credentials on the client computer Machine

Remove "Disconnect" option from Shut Down dialog Machine

Remove Windows Security item from Start menu Machine

Require secure RPC communication Machine

Require use of specific security layer for remote (RDP) connections Machine

Require user authentication for remote connections by using Network Level Authentication Machine

Restrict Terminal Services users to a single remote session Machine

Server Authentication Certificate Template Machine

Set client connection encryption level Machine

Set compression algorithm for RDP data Machine

Set path for TS Roaming User Profile Machine

Set rules for remote control of Terminal Services user sessions Machine

Set rules for remote control of Terminal Services user sessions User

Set the Terminal Services licensing mode Machine

Set time limit for active but idle Terminal Services sessions Machine

Set time limit for active but idle Terminal Services sessions User

Set time limit for active Terminal Services sessions Machine

Set time limit for active Terminal Services sessions User

Set time limit for disconnected sessions Machine

Set time limit for disconnected sessions User

Set TS Gateway authentication method User

Set TS Gateway server address User

Set TS User Home Directory Machine

Specify SHA1 thumbprints of certificates representing trusted .rdp publishers Machine

Specify SHA1 thumbprints of certificates representing trusted .rdp publishers User

Specify terminal server fallback printer driver behavior Machine

Start a program on connection Machine

Start a program on connection User

Terminate session when time limits are reached Machine

Terminate session when time limits are reached User

Use IP Address Redirection Machine

Use mandatory profiles on the terminal server Machine

Use the specified Terminal Services license servers Machine

Allow remote start of unlisted programs Machine

Allow time zone redirection User

Always show desktop on connection User

Do not allow clipboard redirection User

Redirect only the default client printer Machine

Redirect only the default client printer User

Remove remote desktop wallpaper User

Set time limit for logoff of RemoteApp sessions Machine

Set time limit for logoff of RemoteApp sessions User

Use Terminal Services Easy Print printer driver first Machine

Use Terminal Services Easy Print printer driver first User

Use TS Session Broker load balancing Machine

Turn off the caching of thumbnails in hidden thumbs.db files User

Turn off the display of thumbnails and only display icons on network folders User

Turn off the display of thumbnails and only display icons. User

Turn off Tablet PC touch input Machine

Turn off Tablet PC touch input User

Configure the list of blocked TPM commands Machine

Ignore the default list of blocked TPM commands Machine

Ignore the local list of blocked TPM commands Machine

Turn on TPM backup to Active Directory Domain Services Machine

Prevent backing up to local disks Machine

Prevent backing up to local disks User

Prevent backing up to network shared folder Machine

Prevent backing up to network shared folder User

Prevent backing up to optical media (CD/DVD) Machine

Prevent backing up to optical media (CD/DVD) User

Prevent the user from running the Backup Status and Configuration program Machine

Prevent the user from running the Backup Status and Configuration program User

Turn off backup configuration Machine

Turn off backup configuration User

Turn off Complete PC Backup functionality Machine

Turn off Complete PC Backup functionality User

Turn off restore functionality Machine

Turn off restore functionality User

Add the Administrators security group to roaming user profiles Machine

Connect home directory to root of the share User

Delete cached copies of roaming profiles Machine

Delete user profiles older than a specified number of days on system restart Machine

Do not check for user ownership of Roaming Profile Folders Machine

Do not detect slow network connections Machine

Do not forcefully unload the users registry at user logoff Machine

Do not log users on with temporary profiles Machine

Exclude directories in roaming profile User

Leave Windows Installer and Group Policy Software Installation Data Machine

Limit profile size User

Maximum retries to unload and update user profile Machine

Network directories to sync at Logon/Logoff time only User

Only allow local user profiles Machine

Prevent Roaming Profile changes from propagating to the server Machine

Prompt user when a slow network connection is detected Machine

Set maximum wait time for the network if a user has a roaming user profile or remote home directory Machine

Set roaming profile path for all users logging onto this computer Machine

Slow network connection timeout for user profiles Machine

Timeout for dialog boxes Machine

Wait for remote user profile Machine

Configure encryption method Machine

Configure TPM platform validation profile Machine

Control Panel Setup: Configure recovery folder Machine

Control Panel Setup: Configure recovery options Machine

Control Panel Setup: Enable advanced startup options Machine

Prevent memory overwrite on restart Machine

Turn on BitLocker backup to Active Directory Domain Services Machine

Configure Windows NTP Client Machine

Enable Windows NTP Client Machine

Enable Windows NTP Server Machine

Global Configuration Settings Machine

Diagnostics: Configure scenario execution level Machine

Diagnostics: Configure scenario retention Machine

Turn off Windows Calendar Machine

Turn off Windows Calendar User

Allow only system backup Machine

Disallow locally attached storage as backup target Machine

Disallow network as backup target Machine

Disallow optical media as backup target Machine

Disallow run-once backups Machine

Turn off Windows Meeting Space Machine

Turn off Windows Meeting Space User

Turn on Windows Meeting Space auditing Machine

Turn on Windows Meeting Space auditing User

Prohibit installing or uninstalling color profiles Machine

Prohibit installing or uninstalling color profiles User

Configuration of wireless settings using Windows Connect Now Machine

Prohibit Access of the Windows Connect Now wizards Machine

Prohibit Access of the Windows Connect Now wizards User

Check for New Signatures Before Scheduled Scans Machine

Configure Microsoft SpyNet Reporting Machine

Download Entire Signature Set Machine

Enable Logging Known Good Detections Machine

Enable Logging Unknown Detection Machine

Turn off Real-Time Protection Prompts for Unknown Detection Machine

Turn off Windows Defender Machine

Turn on definition updates through both WSUS and Windows Update Machine

Allow only per user or approved shell extensions User

Display confirmation dialog when deleting files User

Do not move deleted files to the Recycle Bin User

Do not request alternate credentials User

Do not track Shell shortcuts during roaming User

Hide the common dialog back button User

Hide the common dialog places bar User

Hide the dropdown list of recent files User

Hide these specified drives in My Computer User

Hides the Manage item on the Windows Explorer context menu User

Items displayed in Places Bar User

Maximum allowed Recycle Bin size User

Maximum number of recent documents User

No Computers Near Me in Network Locations User

No Entire Network in Network Locations User

Prevent access to drives from My Computer User

Remove "Map Network Drive" and "Disconnect Network Drive" User

Remove CD Burning features User

Remove DFS tab User

Remove File menu from Windows Explorer User

Remove Hardware tab User

Remove Search button from Windows Explorer User

Remove Security tab User

Remove Shared Documents from My Computer User

Remove UI to change keyboard navigation indicator setting User

Remove UI to change menu animation setting User

Remove Windows Explorer's default context menu User

Removes the Folder Options menu item from the Tools menu User

Request credentials for network installations User

Turn off caching of thumbnail pictures User

Turn off shell protocol protected mode Machine

Turn off shell protocol protected mode User

Turn off Windows+X hotkeys User

Turn on Classic Shell User

Hide the file scan progress window Machine

Limit Windows File Protection cache size Machine

Set Windows File Protection scanning Machine

Specify Windows File Protection cache location Machine

Windows Firewall: Allow authenticated IPSec bypass Machine

Windows Firewall: Allow ICMP exceptions Machine

Windows Firewall: Allow ICMP exceptions Machine

Windows Firewall: Allow inbound file and printer sharing exception Machine

Windows Firewall: Allow inbound file and printer sharing exception Machine

Windows Firewall: Allow inbound remote administration exception Machine

Windows Firewall: Allow inbound remote administration exception Machine

Windows Firewall: Allow inbound Remote Desktop exceptions Machine

Windows Firewall: Allow inbound Remote Desktop exceptions Machine

Windows Firewall: Allow inbound UPnP framework exceptions Machine

Windows Firewall: Allow inbound UPnP framework exceptions Machine

Windows Firewall: Allow local port exceptions Machine

Windows Firewall: Allow local port exceptions Machine

Windows Firewall: Allow local program exceptions Machine

Windows Firewall: Allow local program exceptions Machine

Windows Firewall: Allow logging Machine

Windows Firewall: Allow logging Machine

Windows Firewall: Define inbound port exceptions Machine

Windows Firewall: Define inbound port exceptions Machine

Windows Firewall: Define inbound program exceptions Machine

Windows Firewall: Define inbound program exceptions Machine

Windows Firewall: Do not allow exceptions Machine

Windows Firewall: Do not allow exceptions Machine

Windows Firewall: Prohibit notifications Machine

Windows Firewall: Prohibit notifications Machine

Windows Firewall: Prohibit unicast response to multicast or broadcast requests Machine

Windows Firewall: Prohibit unicast response to multicast or broadcast requests Machine

Windows Firewall: Protect all network connections Machine

Windows Firewall: Protect all network connections Machine

Turn off the communities features Machine

Turn off the communities features User

Turn off Windows Mail application Machine

Turn off Windows Mail application User

Prevent Windows Media DRM Internet Access Machine

Allow Screen Saver User

Configure HTTP Proxy User

Configure MMS Proxy User

Configure Network Buffering User

Configure RTSP Proxy User

Do Not Show Anchor User

Do Not Show First Use Dialog Boxes Machine

Hide Network Tab User

Hide Privacy Tab User

Hide Security Tab User

Prevent Automatic Updates Machine

Prevent CD and DVD Media Information Retrieval User

Prevent Codec Download User

Prevent Desktop Shortcut Creation Machine

Prevent Media Sharing Machine

Prevent Music File Media Information Retrieval User

Prevent Quick Launch Toolbar Shortcut Creation Machine

Prevent Radio Station Preset Retrieval User

Prevent Video Smoothing Machine

Set and Lock Skin User

Streaming Media Protocols User

Do not allow Windows Messenger to be run Machine

Do not allow Windows Messenger to be run User

Do not automatically start Windows Messenger initially Machine

Do not automatically start Windows Messenger initially User

Allow automatic configuration of listeners Machine

Allow Basic authentication Machine

Allow Basic authentication Machine

Allow unencrypted traffic Machine

Allow unencrypted traffic Machine

Disallow Digest authentication Machine

Disallow Kerberos authentication Machine

Disallow Kerberos authentication Machine

Disallow Negotiate authentication Machine

Disallow Negotiate authentication Machine

Trusted Hosts Machine

Allow Remote Shell Access Machine

MaxConcurrentUsers Machine

Specify idle Timeout Machine

Specify maximum amount of memory in MB per Shell Machine

Specify maximum number of processes per Shell Machine

Specify maximum number of remote shells per user Machine

Specify Shell Timeout Machine

Allow Automatic Updates immediate installation Machine

Allow non-administrators to receive update notifications Machine

Allow signed updates from an intranet Microsoft update service location Machine

Automatic Updates detection frequency Machine

Configure Automatic Updates Machine

Delay Restart for scheduled installations Machine

Do not adjust default option to 'Install Updates and Shut Down' in Shut Down Windows dialog box Machine

Do not adjust default option to 'Install Updates and Shut Down' in Shut Down Windows dialog box User

Do not display 'Install Updates and Shut Down' option in Shut Down Windows dialog box machine

Do not display 'Install Updates and Shut Down' option in Shut Down Windows dialog box user

Enable client-side targeting Machine

Enabling Windows Update Power Management to automatically wake up the system to install scheduled updates Machine

No auto-restart for scheduled Automatic Updates installations Machine

Remove access to use all Windows Update features User

Re-prompt for restart with scheduled installations Machine

Reschedule Automatic Updates scheduled installations Machine

Specify intranet Microsoft update service location Machine

Turn on recommended updates via Automatic Updates Machine

Windows Automatic Updates User

Timeout for hung logon sessions during shutdown Machine

Turn off legacy remote shutdown interface Machine

Custom User Interface User

Disable or enable software Secure Attention Sequence Machine

Display information about previous logons during user logon Machine

Remove logon hours expiration warnings User

Report when logon server was not available during user logon machine

Report when logon server was not available during user logon user

Set action to take when logon hours expire User

Turn off automatic termination of applications that block or cancel shutdown Machine

Custom Instant Search Internet search provider User

Policy Path

Windows Components\ActiveX Installer Service

Control Panel\Add or Remove Programs











ADFS

Windows Components\Application Compatibility







Windows Components\Attachment Manager








Windows Components\AutoPlay Policies






Network\Background Intelligent Transfer Service (BITS)













Windows Components\Import Video

Windows Components\Import Video

Windows Components\Windows Customer Experience Improvement Program

Windows Components\Windows Customer Experience Improvement Program

Network\SSL Configuration Settings

System

System

Windows Components\NetMeeting

Windows Components\NetMeeting\Application Sharing

Windows Components\NetMeeting\Audio & Video






Windows Components\NetMeeting\Options Page


























Control Panel

Control Panel

Control Panel

Control Panel

Control Panel\Display




Control Panel\Display\Desktop Themes











Control Panel\User Accounts

Logon

Logon

System\Credentials Delegation









Windows Components\Credential User Interface

Windows Components\Credential User Interface

System\Ctrl+Alt+Del Options




System\Distributed COM\Application Compatibility Settings

System\Distributed COM\Application Compatibility Settings

Desktop\Desktop

Desktop\Desktop

Desktop\Desktop

Desktop\Desktop

Desktop\Desktop

Desktop

Desktop

Desktop\Desktop

Desktop\Active Directory


Desktop

Desktop

Desktop


Desktop

Desktop\Desktop

Desktop

Desktop\Desktop

Desktop\Desktop

Desktop\Desktop

Desktop\Desktop

Desktop

Desktop

Desktop

Desktop

Desktop

Desktop

Desktop

Desktop

System\Device Installation\Device Installation Restrictions



System\Driver Installation

System\Device Installation
















Network

Windows Components\Digital Locker

Windows Components\Digital Locker

Troubleshooting and Diagnostics\Disk Diagnostic

Troubleshooting and Diagnostics\Disk Diagnostic

System\Disk NV Cache




System\Disk Quotas

System\Disk Quotas

System\Disk Quotas

System\Disk Quotas

System\Disk Quotas

System\Disk Quotas

System

Network\DNS Client

Network\DNS Client

Network\DNS Client

Network\DNS Client

Network\DNS Client

Network\DNS Client

Network\DNS Client

Network\DNS Client

Network\DNS Client

Network\DNS Client

Network\DNS Client

Network\DNS Client

Network\DNS Client

Network\DNS Client

Network\DNS Client

Windows Components\Desktop Window Manager\Window Frame Coloring


Windows Components\Desktop Window Manager








System

Windows Components\Windows Error Reporting\Advanced Error Reporting Setting

Windows Components\Windows Error Reporting\Consent


Windows Components\Windows Error Reporting























Windows Components\Event Forwarding

Windows Components\Event Log Service\Application

Windows Components\Event Log Service\Security

Windows Components\Event Log Service\Setup

Windows Components\Event Log Service\System


















Windows Components\Event Viewer



Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Troubleshooting and Diagnostics\Corrupted File Recovery

System\NTFS Filesystem

System\Folder Redirection



Windows Explorer\Explorer Frame Pane

Windows Explorer\Explorer Frame Pane

Windows Components\Game Explorer

Windows Components\Game Explorer

System

System\Locale Services






Control Panel\Regional and Language Options











System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

System\Group Policy

GroupPolicy:PolicyPolicies

\Logging and tracing

\MMC_Preferences

\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\Plugins

\MMC_Preferences

\MMC_Preferences

\MMC_Preferences

\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\MMC_Preferences



\MMC_Preferences

Group Policy

System

System

System

Windows Components\Online Assistance

Internet Communication settings


Windows Components\Online Assistance


System\Windows HotStart

System\Windows HotStart

Internet Communication Management

Internet Communication Management



























Windows Components\Internet Information Services

Windows Components\Internet Explorer\Internet Control Panel\Security Page\Inter

Windows Components\Internet Explorer\Internet Control Panel\Security Page\Lock

Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intra


Windows Components\Internet Explorer\Internet Control Panel\Security Page\Loca

Windows Components\Internet Explorer\Internet Control Panel\Security Page\Loc

Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restri


Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trust












Windows Components\Internet Explorer


Windows Components\Internet Explorer\Security Features\Add-on Management


Windows Components\Internet Explorer\Security Features\Binary Behavior Security




Windows Components\Internet Explorer\Security Features\Consistent Mime Handli

Windows Components\Internet Explorer\Security Features\Information Bar

Windows Components\Internet Explorer\Security Features\Local Machine Zone Loc

Windows Components\Internet Explorer\Security Features\Mime Sniffing Safety Fea

Windows Components\Internet Explorer\Security Features\MK Protocol Security Res

Windows Components\Internet Explorer\Security Features\Network Protocol Lockd

Windows Components\Internet Explorer\Security Features\Object Caching Protecti

Windows Components\Internet Explorer\Security Features\Protection From Zone El

Windows Components\Internet Explorer\Security Features\Restrict ActiveX Install

Windows Components\Internet Explorer\Security Features\Restrict File Download

Windows Components\Internet Explorer\Security Features\Scripted Window Security

Windows Components\Internet Explorer\Application Compatibility\Enable cut, cop















Windows Components\Internet Explorer\Internet Control Panel\Advanced Page














































































Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\M

Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\Pr































































Windows Components\Internet Explorer\Administrator Approved Controls


















































Windows Components\Internet Explorer\Toolbars








Windows Components\Internet Explorer\Offline Pages



























Windows Components\Internet Explorer\Browser menus

















Windows Components\Internet Explorer\Internet Control Panel
































































Windows Components\Internet Explorer\Security Features

Windows Components\Internet Explorer\Security Features








Windows Components\Internet Explorer\Persistence Behavior













































































Windows Components\Internet Explorer\Security Features\Network Protocol Lockdo


Windows Components\Internet Explorer\Internet Control Panel\Security Page


































































Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\S







Windows Components\Internet Explorer\Corporate Settings\Code Download

Windows Components\Internet Explorer\Internet Settings\Component Updates\Help





Windows Components\Internet Explorer\Internet Settings\Display settings\General

Windows Components\Internet Explorer\Internet Settings\Display settings



Windows Components\Internet Explorer\Internet Settings\Display settings\Link Colo

















































































Windows Components\RSS Feeds





Windows Components\Internet Explorer\Internet Settings\Component Updates\Periodi









Windows Components\Internet Explorer\Internet Settings\Component Updates\Periodi

Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\






























Windows Components\Internet Explorer\Internet Settings\AutoComplete

















Windows Components\Internet Explorer\Internet Settings\URL Encoding














Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\S





Windows Components\Internet Explorer\Internet Settings\AutoComplete



























Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\In




































































Tablet PC\Handwriting personalization




System\iSCSI\iSCSI Target Discovery

System\iSCSI\General iSCSI

System\iSCSI\iSCSI Security

System\iSCSI\General iSCSI







System\KDC

System\Kerberos

System\Kerberos

System\Kerberos

Troubleshooting and Diagnostics\Windows Memory Leak Diagnosis

Network\Link-Layer Topology Discovery

Network\Link-Layer Topology Discovery

System\Logon

System\Logon

System\Logon

System\Logon

System\Logon

System\Logon

System\Logon

System

System\Logon

System

System\Logon

System\Logon

System\Logon

System

Windows Components\Windows Media Center

Windows Components\Windows Media Center

Windows Components\Microsoft Management Console\Restricted/Permitted snap-i

Windows Components\Microsoft Management Console\Restricted/Permitted snap-in

Windows Components\Microsoft Management Console\Restricted/Permitted snap-i

Windows Components\Microsoft Management Console

Windows Components\Microsoft Management Console

mmc:MMC_RESTRICT

mmc:MMC_RESTRICT

mmc:MMC_RESTRICT

mmc:MMC_RESTRICT

\Group Policy\Group Policy snap-in extensions

\Group Policy\Resultant Set of Policy snap-in extensions



mmc:MMC_RESTRICT

mmc:MMC_ExtensionSnapins


mmc:MMC_RESTRICT

mmc:MMC_RESTRICT

mmc:MMC_RESTRICT


mmc:MMC_RESTRICT

mmc:MMC_RESTRICT




mmc:MMC_RESTRICT


mmc:MMC_RESTRICT

mmc:MMC_RESTRICT

mmc:MMC_RESTRICT

mmc:MMC_RESTRICT


mmc:MMC_RESTRICT


mmc:MMC_RESTRICT

mmc:MMC_RESTRICT

mmc:MMC_RESTRICT



mmc:MMC_RESTRICT

\Group Policy

\Group Policy

\Group Policy

mmc:MMC_RESTRICT



mmc:MMC_RESTRICT

mmc:MMC_RESTRICT



mmc:MMC_RESTRICT


mmc:MMC_RESTRICT


mmc:MMC_RESTRICT




mmc:MMC_RESTRICT



mmc:MMC_RESTRICT

mmc:MMC_RESTRICT

mmc:MMC_RESTRICT


mmc:MMC_RESTRICT


mmc:MMC_RESTRICT



mmc:MMC_RESTRICT



mmc:MMC_RESTRICT

\Group Policy



mmc:MMC_RESTRICT





mmc:MMC_RESTRICT



mmc:MMC_RESTRICT


mmc:MMC_RESTRICT


mmc:MMC_RESTRICT

mmc:MMC_RESTRICT








mmc:MMC_RESTRICT


mmc:MMC_RESTRICT

mmc:MMC_RESTRICT

mmc:MMC_RESTRICT


mmc:MMC_RESTRICT


mmc:MMC_RESTRICT


mmc:MMC_RESTRICT

mmc:MMC_RESTRICT



mmc:MMC_RESTRICT


mmcsnapins:MMC_GroupPolicy

mmcsnapins:MMC_GroupPolicy

mmc:MMC_RESTRICT


mmc:MMC_RESTRICT


Windows Components\Windows Mobility Center

Windows Components\Windows Mobility Center

Windows Components\Presentation Settings

Windows Components\Presentation Settings

Windows Components\Windows Movie Maker

Windows Components\Windows Movie Maker







Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool

Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool

Windows Components\Windows Installer


























Windows Components\Network Access Protection

System\Net Logon

System\Net Logon\DC Locator DNS Records

System\Net Logon





System\Net Logon

System\Net Logon


System\Net Logon


System\Net Logon

System\Net Logon

System\Net Logon

System\Net Logon

System\Net Logon

System\Net Logon

System\Net Logon



System\Net Logon

System\Net Logon




System\Net Logon




Network\Network Connections

























Windows Components\Network Projector

Windows Components\Network Projector

Network\Offline Files








































Network\Microsoft Peer-to-Peer Networking Services

Network\Microsoft Peer-to-Peer Networking Services\Peer Name Resolution Protoc

Network\Microsoft Peer-to-Peer Networking Services\Peer Name Resolution Protoco





Network\Microsoft Peer-to-Peer Networking Services







Windows Components\Parental Controls

Troubleshooting and Diagnostics\Application Compatibility Diagnostics





Tablet PC\Tablet PC Pen Training

Tablet PC\Tablet PC Pen Training

System\Performance Control Panel






Troubleshooting and Diagnostics\Windows Boot Performance Diagnostics

Troubleshooting and Diagnostics\Windows Standby/Resume Performance Diagnost

Troubleshooting and Diagnostics\Windows System Responsiveness Performance D

Troubleshooting and Diagnostics\Windows Shutdown Performance Diagnostics

System\Power Management\Sleep Settings


System\Power Management\Notification Settings


System



System\Power Management




System\Power Management\Button Settings













System\Power Management\Video and Display Settings







System\Power Management\Hard Disk Settings

System\Power Management\Hard Disk Settings



Windows Explorer\Previous Versions












Printers

Printers

Printers

Printers

Printers

Printers

Printers

Control Panel\Printers


Printers

Printers

Printers


Printers

Printers

Printers

Printers

Printers




Printers



Printers

Printers

Printers

Control Panel\Programs







Windows Components\Password Synchronization




Network\QoS Packet Scheduler\DSCP value of conforming packets

Network\QoS Packet Scheduler\DSCP value of non-conforming packets

Network\QoS Packet Scheduler\Layer-2 priority value







Network\QoS Packet Scheduler










Troubleshooting and Diagnostics\Windows Resource Exhaustion Detection and Res

System

System

System

wer:CAT_WindowsErrorReportingAdvanced

System\Remote Assistance






System\Removable Storage Access





























System\Remote Procedure Call






System\Scripts

System\Scripts

System\Scripts

System\Scripts

System\Scripts

System\Scripts

System\Scripts

System\Scripts

System\Scripts

System\Scripts

Windows Components\Search









Windows Components\Security Center

System\Server Manager


System


System

System

Shared Folders

Shared Folders

Windows Components\Network Sharing

System

System

System

System

Windows Explorer

Windows Components\Windows Sidebar








Windows Components\Windows SideShow








Windows Components\Smart Card













Windows Components\Server for NIS

Windows Components\Server for NIS

Network\SNMP

Network\SNMP

Network\SNMP

Windows Components\Sound Recorder

Windows Components\Sound Recorder

Start Menu and Taskbar





















































Windows Components\Windows System Resource Manager




System\System Restore

System\System Restore

Tablet PC\Input Panel
















Tablet PC\Accessories










Tablet PC\Hardware Buttons


Tablet PC\Pen UX Behaviors

Tablet PC\Pen UX Behaviors

Tablet PC\Pen Flicks Learning

Tablet PC\Pen Flicks Learning







Tablet PC\Cursors

Tablet PC\Cursors











Windows Components\Task Scheduler














Windows Components\Terminal Services\Remote Desktop Connection Client




Windows Components\Terminal Services\Terminal Server\Device and Resource Red


Windows Components\Terminal Services\Terminal Server\Connections

Windows Components\Terminal Services\Terminal Server\Security

Windows Components\Terminal Services\Terminal Server\Remote Session Enviro




Windows Components\Terminal Services\Terminal Server\TS Session Broker



Windows Components\Terminal Services\Terminal Server\Printer Redirection










Windows Components\Terminal Services\Terminal Server\Temporary folders


Windows Components\Terminal Services\Terminal Server\Temporary folders

Windows Components\Terminal Services\TS Gateway


Windows Components\Terminal Services\Terminal Server\Licensing


Windows Components\Terminal Services\TS Licensing



Windows Components\Terminal Services\TS Licensing











Windows Components\Terminal Services\Terminal Server\Profiles




Windows Components\Terminal Services\Terminal Server\Session Time Limits



















terminalserver:TS_CONNECTIONS

terminalserver:TS_REDIRECTION

terminalserver:TS_SESSIONS

terminalserver:TS_REDIRECTION

terminalserver:TS_PRINT_REDIRECTION


terminalserver:TS_SESSIONS

terminalserver:TS_SESSION_TIME_LIMITS

terminalserver:TS_SESSION_TIME_LIMITS



terminalserver:TS_SD_Node

Windows Explorer

Windows Explorer

Windows Explorer

Tablet PC\Touch Input

Tablet PC\Touch Input

System\Trusted Platform Module Services




Windows Components\Backup\Client














System\User Profiles





















Windows Components\BitLocker Drive Encryption







System\Windows Time Service\Time Providers



System\Windows Time Service

Troubleshooting and Diagnostics

Troubleshooting and Diagnostics

Windows Components\Windows Calendar

Windows Components\Windows Calendar

Backup\Server

Backup\Server

Backup\Server

Backup\Server

Backup\Server

Windows Components\Windows Meeting Space




Windows Components\Windows Color System

Windows Components\Windows Color System

Network\Windows Connect Now



Windows Components\Windows Defender








Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer\Common Open File Dialog



Windows Explorer

Windows Explorer


Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

Windows Explorer

System\Windows File Protection




\Windows Firewall

\Windows Firewall\Domain Profile

\Windows Firewall\Standard Profile



























Windows Components\Windows Mail




Windows Components\Windows Media Digital Rights Management

Windows Components\Windows Media Player\Playback

Windows Components\Windows Media Player\Networking




Windows Components\Windows Media Player\User Interface

Windows Components\Windows Media Player






Windows Components\Windows Media Player\Playback









Windows Components\Windows Messenger




Windows Components\Windows Remote Management (WinRM)\WinRM Service

Windows Components\Windows Remote Management (WinRM)\WinRM Client










Windows Components\Windows Remote Shell







Windows Components\Windows Update


















System

Windows Components\Shutdown Options

Windows Components\Shutdown Options

System

Windows Components\Windows Logon Options






System\Shutdown Options

Windows Components\Instant Search

Registry information

HKLM\SOFTWARE\Policies\Microsoft\Windows\AxInstaller!ApprovedList, HKLM\SOFTWARE\Policies\Microsoft\Windows\AxInsta

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoServices

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoAddPage

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoWindowsSetupPage

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoRemovePage

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoAddFromCDorFloppy

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoAddFromInternet

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoAddFromNetwork

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoChooseProgramsPage

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoAddRemovePrograms

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoSupportInfo

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!DefaultCategory

HKLM\Software\Policies\Microsoft\Windows\ADFS!DisallowFederationService

HKLM\Software\Policies\Microsoft\Windows\AppCompat!VDMDisallowed

HKCU\Software\Policies\Microsoft\Windows\AppCompat!VDMDisallowed

HKLM\Software\Policies\Microsoft\Windows\AppCompat!DisablePropPage

HKLM\Software\Policies\Microsoft\Windows\AppCompat!DisableEngine

HKLM\Software\Policies\Microsoft\Windows\AppCompat!DisablePCA

HKCU\Software\Policies\Microsoft\Windows\AppCompat!DisablePCA

HKLM\Software\Policies\Microsoft\Windows\AppCompat!DisableWizard

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations!DefaultFileTypeRisk

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments!SaveZoneInformation

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments!HideZoneInfoOnProperties

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations!HighRiskFileTypes

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations!LowRiskFileTypes

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations!ModRiskFileTypes

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments!ScanWithAntiVirus

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments!UseTrustedHandlers

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoAutorun

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoAutorun

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DontSetAutoplayCheckbox

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DontSetAutoplayCheckbox

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDriveTypeAutoRun

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDriveTypeAutoRun

HKLM\Software\Policies\Microsoft\Windows\BITS!EnablePeercaching

HKLM\Software\Policies\Microsoft\Windows\BITS!DisablePeerCachingClient

HKLM\Software\Policies\Microsoft\Windows\BITS!DisablePeerCachingServer

HKLM\Software\Policies\Microsoft\Windows\BITS!MaxContentAge

HKLM\Software\Policies\Microsoft\Windows\BITS!MaxCacheSize

HKLM\Software\Policies\Microsoft\Windows\BITS!MaxDownloadTime

HKLM\Software\Policies\Microsoft\Windows\BITS!EnableBITSMaxBandwidth, HKLM\Software\Policies\Microsoft\Windows\BIT

HKLM\Software\Policies\Microsoft\Windows\BITS!MaxBandwidthServed

HKLM\Software\Policies\Microsoft\Windows\BITS!MaxJobsPerUser

HKLM\Software\Policies\Microsoft\Windows\BITS!MaxJobsPerMachine

HKLM\Software\Policies\Microsoft\Windows\BITS!MaxFilesPerJob

HKLM\Software\Policies\Microsoft\Windows\BITS!MaxRangesPerFile

HKLM\Software\Policies\Microsoft\Windows\BITS!JobInactivityTimeout

HKLM\SOFTWARE\Policies\Microsoft\CaptureWizard!VidCap

HKCU\SOFTWARE\Policies\Microsoft\CaptureWizard!VidCap

HKLM\Software\Policies\Microsoft\SQMClient!CorporateSQMURL, HKLM\Software\Policies\Microsoft\SQMClient!CorporateS

HKLM\Software\Policies\Microsoft\SQMClient\Windows!StudyId, HKLM\Software\Policies\Microsoft\SQMClient\Windows!StudyI

HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002!Functions

HKLM\Software\Policies\Microsoft\Windows\App Management!COMClassStore

HKCU\Software\Policies\Microsoft\Windows\App Management!COMClassStore

HKCU\Software\Policies\Microsoft\Conferencing!PersistAutoAcceptCalls

HKCU\Software\Policies\Microsoft\Conferencing!NoAppSharing

HKCU\Software\Policies\Microsoft\Conferencing!NoAudio

HKCU\Software\Policies\Microsoft\Conferencing!NoChat

HKCU\Software\Policies\Microsoft\Conferencing!NoDirectoryServices

HKCU\Software\Policies\Microsoft\Conferencing!NoFullDuplex

HKCU\Software\Policies\Microsoft\Conferencing!NoOldWhiteBoard

HKLM\Software\Policies\Microsoft\Conferencing!NoRDS

HKCU\Software\Policies\Microsoft\Conferencing!NoAdvancedCalling

HKCU\Software\Policies\Microsoft\Conferencing!NoNewWhiteBoard

HKCU\Software\Policies\Microsoft\Conferencing!Use AutoConfig, HKCU\Software\Policies\Microsoft\Conferencing!ConfigFile

HKCU\Software\Policies\Microsoft\Conferencing!NoAudioPage

HKCU\Software\Policies\Microsoft\Conferencing!NoGeneralPage

HKCU\Software\Policies\Microsoft\Conferencing!NoSecurityPage

HKCU\Software\Policies\Microsoft\Conferencing!NoVideoPage

HKCU\Software\Policies\Microsoft\Conferencing!MaximumBandwidth

HKCU\Software\Policies\Microsoft\Conferencing!MaxFileSendSize

HKCU\Software\Policies\Microsoft\Conferencing!NoAddingDirectoryServers

HKCU\Software\Policies\Microsoft\Conferencing!NoTrueColorSharing

HKCU\Software\Policies\Microsoft\Conferencing!NoAutoAcceptCalls

HKCU\Software\Policies\Microsoft\Conferencing!NoChangingCallMode

HKCU\Software\Policies\Microsoft\Conferencing!NoChangeDirectSound

HKCU\Software\Policies\Microsoft\Conferencing!NoAllowControl

HKCU\Software\Policies\Microsoft\Conferencing!NoSharingDesktop

HKCU\Software\Policies\Microsoft\Conferencing!NoReceivingFiles

HKCU\Software\Policies\Microsoft\Conferencing!NoReceivingVideo

HKCU\Software\Policies\Microsoft\Conferencing!NoSendingFiles

HKCU\Software\Policies\Microsoft\Conferencing!NoSendingVideo

HKCU\Software\Policies\Microsoft\Conferencing!NoSharing

HKCU\Software\Policies\Microsoft\Conferencing!NoSharingDosWindows

HKCU\Software\Policies\Microsoft\Conferencing!NoSharingExplorer

HKCU\Software\Policies\Microsoft\Conferencing!NoWebDirectory

HKCU\Software\Policies\Microsoft\Conferencing!CallSecurity

HKCU\Software\Policies\Microsoft\Conferencing!IntranetSupportURL

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ForceClassicControlPanel

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisallowCpl, HKCU\Software\Microsoft\Windows\CurrentVe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoControlPanel

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!RestrictCpl, HKCU\Software\Microsoft\Windows\CurrentVer

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoDispAppearancePage

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoDispBackgroundPage

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoDispScrSavPage

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoDispSettingsPage

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!SetVisualStyle

HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop!ScreenSaverIsSecure

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop!NoChangingWallPaper

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoVisualStyleChoice

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoSizeChoice

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoColorChoice

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoDispCPL

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoThemesTab

HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop!ScreenSaveActive

HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop!SCRNSAVE.EXE

HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop!ScreenSaveTimeOut

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!UseDefaultTile

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!DefaultLogonDomain

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!ExcludedCredentialProviders

HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!AllowDefCredentialsWhenNTLMOnly, HKLM\Software\Polic

HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!AllowDefaultCredentials, HKLM\Software\Policies\Microsoft

HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!AllowFreshCredentials, HKLM\Software\Policies\Microsoft\

HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!AllowSavedCredentials, HKLM\Software\Policies\Microsoft

HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!AllowFreshCredentialsWhenNTLMOnly, HKLM\Software\Pol

HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!AllowSavedCredentialsWhenNTLMOnly, HKLM\Software\Pol

HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!DenyDefaultCredentials, HKLM\Software\Policies\Microsoft

HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!DenyFreshCredentials, HKLM\Software\Policies\Microsoft\

HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!DenySavedCredentials, HKLM\Software\Policies\Microsoft

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\CredUI!EnumerateAdministrators

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\CredUI!EnableSecureCredentialPrompting

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableChangePassword

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableLockWorkstation

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoLogoff

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableTaskMgr

HKLM\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat!AllowLocalActivationSecurityCheckExemptionList

HKLM\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat!ListBox_Support_ActivationSecurityCheckExemptionList, H

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\AdminComponent!Add, HKCU\Software\Microsoft\W

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop!NoHTMLWallPaper

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!Wallpaper, HKCU\Software\Microsoft\Windows\CurrentVers

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoActiveDesktop

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop!NoComponents

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoRecentDocsNetHood

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSaveSettings

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ForceActiveDesktopOn

HKCU\Software\Policies\Microsoft\Windows\Directory UI!EnableFilter

HKCU\Software\Policies\Microsoft\Windows\Directory UI!HideDirectoryFolder

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDesktop

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoInternetIcon

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoNetHood

HKCU\Software\Policies\Microsoft\Windows\Directory UI!QueryLimit

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoCloseDragDropBands

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop!NoAddingComponents

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoMovingBands

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoActiveDesktopChanges

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop!NoClosingComponents

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop!NoDeletingComponents

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop!NoEditingComponents

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisablePersonalDirChange

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum!{20D04FE0-3AEA-1069-A2D8-08002B30309D}

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum!{450D8FBA-AD25-11D0-98A8-0800361B1103}

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoPropertiesMyComputer

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoPropertiesMyDocuments

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoPropertiesRecycleBin

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum!{645FF040-5081-101B-9F08-00AA002F954E}

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDesktopCleanupWizard

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!AllowAdminInstall

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!AllowDeviceIDs, HKLM\Software\Policies\Microsoft\Windo

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!AllowDeviceClasses, HKLM\Software\Policies\Microsoft\

HKLM\Software\Policies\Microsoft\Windows\DriverInstall\Restrictions!AllowUserDeviceClasses, HKLM\Software\Policies\Micros

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Settings!AllowRemoteRPC

HKCU\Software\Policies\Microsoft\Windows NT\Driver Signing!BehaviorOnFailedVerify

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Settings!InstallTimeout

HKCU\Software\Policies\Microsoft\Windows\DriverSearching!DontSearchFloppies, HKCU\Software\Policies\Microsoft\Windo

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DeniedPolicy!DetailText

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DeniedPolicy!SimpleText

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Settings!DisableSystemRestore

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Settings!DisableSendGenericDriverNotFoundToWER

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!DenyUnspecified

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!DenyDeviceIDs, HKLM\Software\Policies\Microsoft\Wind

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!DenyDeviceClasses, HKLM\Software\Policies\Microsoft\

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!DenyRemovableDevices

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Settings!AllSigningEqual

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Settings!DisableBalloonTips

HKLM\Software\Policies\Microsoft\Windows\DriverSearching!DontPromptForWindowsUpdate

HKCU\Software\Policies\Microsoft\Windows\DriverSearching!DontPromptForWindowsUpdate

HKLM\Software\Policies\Microsoft\System\DFSClient!DfsDcNameDelay

HKLM\SOFTWARE\Policies\Microsoft\Windows\Digital Locker!DoNotRunDigitalLocker

HKCU\SOFTWARE\Policies\Microsoft\Windows\Digital Locker!DoNotRunDigitalLocker

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{29689E29-2CE9-4751-B4FC-8EFF5066E3FD}!DfdAlertTextOverride

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{29689E29-2CE9-4751-B4FC-8EFF5066E3FD}!ScenarioExecutionEnable

HKLM\Software\Policies\Microsoft\Windows\NvCache!OptimizeBootAndResume

HKLM\Software\Policies\Microsoft\Windows\NvCache!EnablePowerModeState

HKLM\Software\Policies\Microsoft\Windows\NvCache!EnableNvCache

HKLM\Software\Policies\Microsoft\Windows\NvCache!EnableSolidStateMode

HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!ApplyToRemovableMedia

HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!Limit, HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!Lim

HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!Enable

HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!Enforce

HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!LogEventOverLimit

HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!LogEventOverThreshold

HKLM\Software\Policies\Microsoft\Windows\System!DLT_AllowDomainMode

HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!AppendToMultiLabelName

HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!AdapterDomainName

HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!NameServer

HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!SearchList

HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!RegistrationEnabled

HKLM\Software\Policies\Microsoft\System\DNSClient!NV PrimaryDnsSuffix

HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!UseDomainNameDevolution

HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!RegisterAdapterName

HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!RegisterReverseLookup

HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!RegistrationRefreshInterval

HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!RegistrationOverwritesInConflict

HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!RegistrationTtl

HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!EnableMulticast

HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!UpdateSecurityLevel

HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!UpdateTopLevelDomainZones

HKLM\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowColorizationColorChanges

HKCU\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowColorizationColorChanges

HKLM\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowComposition

HKCU\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowComposition

HKLM\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowFlip3d

HKCU\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowFlip3d

HKLM\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowAnimations

HKCU\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowAnimations

HKLM\SOFTWARE\Policies\Microsoft\Windows\DWM!DefaultColorizationColorState, HKLM\SOFTWARE\Policies\Microsoft\Win

HKCU\SOFTWARE\Policies\Microsoft\Windows\DWM!DefaultColorizationColorState, HKCU\SOFTWARE\Policies\Microsoft\Wi

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoEncryptOnMove

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!CorporateWerServer, HKLM\SOFTWARE\Policies\Mic

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent!DefaultConsent

HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent!DefaultConsent

HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting\DW!DWNoExternalURL, HKLM\Software\Policies\Microsoft\PCHea

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!DisableArchive, HKLM\SOFTWARE\Policies\Microsof

HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!DisableArchive, HKCU\SOFTWARE\Policies\Microsof

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!DisableQueue, HKLM\SOFTWARE\Policies\Microsoft

HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!DisableQueue, HKCU\SOFTWARE\Policies\Microsoft

HKLM\

HKCU\

HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting!AllOrNone, HKLM\Software\Policies\Microsoft\PCHealth\ErrorRepo

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!LoggingDisabled

HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!LoggingDisabled

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!Disabled

HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!Disabled

HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting!ShowUI, HKLM\Software\Policies\Microsoft\PCHealth\ErrorRepo

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!DontSendAdditionalData

HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!DontSendAdditionalData

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent!DefaultOverrideBehavior

HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent!DefaultOverrideBehavior

HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting\InclusionList

HKLM\Software\Policies\Microsoft\Windows\Windows Error Reporting\ExcludedApplications

HKCU\Software\Policies\Microsoft\Windows\Windows Error Reporting\ExcludedApplications

HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting\ExclusionList

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!DoNotShowUI

HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting!IncludeKernelFaults

HKLM\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager

HKLM\Software\Policies\Microsoft\Windows\EventLog\Application!AutoBackupLogFiles

HKLM\Software\Policies\Microsoft\Windows\EventLog\Security!AutoBackupLogFiles

HKLM\Software\Policies\Microsoft\Windows\EventLog\Setup!AutoBackupLogFiles

HKLM\Software\Policies\Microsoft\Windows\EventLog\System!AutoBackupLogFiles

HKLM\Software\Policies\Microsoft\Windows\EventLog\Application!ChannelAccess

HKLM\Software\Policies\Microsoft\Windows\EventLog\Security!ChannelAccess

HKLM\Software\Policies\Microsoft\Windows\EventLog\Setup!ChannelAccess

HKLM\Software\Policies\Microsoft\Windows\EventLog\System!ChannelAccess

HKLM\Software\Policies\Microsoft\Windows\EventLog\Application!File

HKLM\Software\Policies\Microsoft\Windows\EventLog\Security!File

HKLM\Software\Policies\Microsoft\Windows\EventLog\Setup!File

HKLM\Software\Policies\Microsoft\Windows\EventLog\System!File

HKLM\Software\Policies\Microsoft\Windows\EventLog\Application!MaxSize

HKLM\Software\Policies\Microsoft\Windows\EventLog\Security!MaxSize

HKLM\Software\Policies\Microsoft\Windows\EventLog\Setup!MaxSize

HKLM\Software\Policies\Microsoft\Windows\EventLog\System!MaxSize

HKLM\Software\Policies\Microsoft\Windows\EventLog\Application!Retention

HKLM\Software\Policies\Microsoft\Windows\EventLog\Security!Retention

HKLM\Software\Policies\Microsoft\Windows\EventLog\Setup!Retention

HKLM\Software\Policies\Microsoft\Windows\EventLog\System!Retention

HKLM\Software\Policies\Microsoft\Windows\EventLog\Setup!Enabled

HKLM\Software\Policies\Microsoft\EventViewer!MicrosoftRedirectionProgram

HKLM\Software\Policies\Microsoft\EventViewer!MicrosoftRedirectionProgramCommandLineParameters

HKLM\Software\Policies\Microsoft\EventViewer!MicrosoftRedirectionURL

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!AlwaysShowClassicMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!PreventItemCreationInUsersFilesFolder

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TurnOffSPIAnimations

HKLM\Software\Policies\Microsoft\Windows\Explorer!NoHeapTerminationOnCorruption

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{8519d925-541e-4a2b-8b1e-8059d16082f2}!ScenarioExecutionEnabled,

HKLM\Software\Policies\Microsoft\Windows\Filesystems\NTFS!SymLinkState, HKLM\Software\Policies\Microsoft\Windows\Fi

HKCU\Software\Policies\Microsoft\Windows\NetCache!DisableFRAdminPin

HKLM\Software\Policies\Microsoft\Windows\System\Fdeploy!LocalizeXPRelativePaths

HKCU\Software\Policies\Microsoft\Windows\System\Fdeploy!LocalizeXPRelativePaths

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoPreviewPane

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoReadingPane

HKLM\Software\Policies\Microsoft\Windows\GameUX!DownloadGameInfo

HKLM\Software\Policies\Microsoft\Windows\GameUX!ListRecentlyPlayed

HKCU\Software\Policies\Microsoft\Control Panel\International\Calendars\TwoDigitYearMax!1

HKLM\Software\Policies\Microsoft\Control Panel\International!PreventGeoIdChange

HKCU\Software\Policies\Microsoft\Control Panel\International!PreventGeoIdChange

HKLM\Software\Policies\Microsoft\Control Panel\International!CustomLocalesNoSelect

HKCU\Software\Policies\Microsoft\Control Panel\International!CustomLocalesNoSelect

HKLM\Software\Policies\Microsoft\Control Panel\International!PreventUserOverrides

HKCU\Software\Policies\Microsoft\Control Panel\International!PreventUserOverrides

HKLM\Software\Policies\Microsoft\MUI\Settings!MachineUILock

HKCU\Software\Policies\Microsoft\Control Panel\International!HideAdminOptions

HKCU\Software\Policies\Microsoft\Control Panel\International!HideCurrentLocation

HKCU\Software\Policies\Microsoft\Control Panel\International!HideLanguageSelection

HKCU\Software\Policies\Microsoft\Control Panel\International!HideLocaleSelectAndCustomize

HKCU\Software\Policies\Microsoft\Control Panel\Desktop!MultiUILanguageID

HKLM\Software\Policies\Microsoft\Control Panel\International!RestrictSystemLocales, HKLM\Software\Policies\Microsoft\Contr

HKLM\Software\Policies\Microsoft\Control Panel\International!RestrictUserLocales, HKLM\Software\Policies\Microsoft\Control

HKCU\Software\Policies\Microsoft\Control Panel\International!RestrictUserLocales, HKCU\Software\Policies\Microsoft\Control

HKLM\Software\Policies\Microsoft\MUI\Settings!PreferredUILanguages

HKCU\Software\Policies\Microsoft\Control Panel\Desktop!PreferredUILanguages

HKLM\Software\Policies\Microsoft\Windows\System!AllowX-ForestPolicy-and-RUP

HKLM\Software\Policies\Microsoft\Windows\Group Policy!OnlyUseLocalAdminFiles

HKCU\Software\Policies\Microsoft\Windows\Group Policy Editor!NewGPOLinksDisabled

HKCU\Software\Policies\Microsoft\Windows\Group Policy Editor!GPODisplayName

HKLM\Software\Policies\Microsoft\Windows\System!DenyRsopToInteractiveUser

HKCU\Software\Policies\Microsoft\Windows\System!DenyRsopToInteractiveUser

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}!NoSlowLink, HKLM\Softw

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}!NoSlowLink, HKLM\

HKCU\Software\Policies\Microsoft\Windows\Group Policy Editor!ShowPoliciesOnly

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{25537BA6-77A8-11D2-9B6C-0000F8080861}!NoSlowLink, HKLM\So

HKCU\Software\Policies\Microsoft\Windows\Group Policy Editor!DCOption

HKLM\Software\Policies\Microsoft\Windows\System!GroupPolicyRefreshTime, HKLM\Software\Policies\Microsoft\Windows\Sy

HKLM\Software\Policies\Microsoft\Windows\System!GroupPolicyRefreshTimeDC, HKLM\Software\Policies\Microsoft\Windows

HKCU\Software\Policies\Microsoft\Windows\System!GroupPolicyRefreshTime, HKCU\Software\Policies\Microsoft\Windows\Sy

HKLM\Software\Policies\Microsoft\Windows\System!GroupPolicyMinTransferRate

HKCU\Software\Policies\Microsoft\Windows\System!GroupPolicyMinTransferRate

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}!NoSlowLink, HKLM\

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{e437bc1c-aa7d-11d2-a382-00c04f991e27}!NoSlowLink, HKLM\Softw

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}!NoBackgroundPolic

HKLM\Software\Policies\Microsoft\Windows\System!DenyUsersFromMachGP

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}!NoSlowLink, HKLM\So

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}!NoBackgroundPolic

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{c6dc5466-785a-11d2-84d0-00c04fb169f7}!NoSlowLink, HKLM\Softw

HKLM\Software\Policies\Microsoft\Windows\System!GpNetworkStartTimeoutPolicyValue

HKCU\Software\Policies\Microsoft\Windows\Group Policy Editor!DisableAutoADMUpdate

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableBkGndGroupPolicy

HKLM\Software\Policies\Microsoft\Windows\System!DisableLGPOProcessing

HKLM\Software\Policies\Microsoft\Windows\System!RSoPLogging

HKLM\Software\Policies\Microsoft\Windows\System!UserPolicyMode

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}!NoSlowLink, HKLM\S

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}!NoSlowLink, HKLM

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{F9C77450-3A41-477e-9310-9ACD617BD9E3}!NoSlowLink, HKLM\So

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{F9C77450-3A41-477e-9310-9ACD617BD9E3}!LogLevel, HKLM\Softw

HKCU\Software\Policies\Microsoft\MMC\{17C6249E-BA57-4F69-AE93-4FB3D25CD9D7}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{085A3BC4-FB62-4360-90C1-726A9A00DCA3}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{728EE579-943C-4519-9EF7-AB56765798ED}!NoSlowLink, HKLM\So

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{728EE579-943C-4519-9EF7-AB56765798ED}!LogLevel, HKLM\Softw

HKCU\Software\Policies\Microsoft\MMC\{EB21163A-3F08-44c4-B40F-F67FC97D6F44}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{1A6364EB-776B-4120-ADE1-B63A406A76B5}!NoSlowLink, HKLM\So

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{1A6364EB-776B-4120-ADE1-B63A406A76B5}!LogLevel, HKLM\Soft

HKCU\Software\Policies\Microsoft\MMC\{F780A62E-DDE3-45b7-9DA6-38CFC25154BA}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{5794DAFD-BE60-433f-88A2-1A31939AC01F}!NoSlowLink, HKLM\So

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{5794DAFD-BE60-433f-88A2-1A31939AC01F}!LogLevel, HKLM\Softw

HKCU\Software\Policies\Microsoft\MMC\{35141B6B-498A-4cc7-AD59-CEF93D89B2CE}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0E28E245-9368-4853-AD84-6DA3BA35BB75}!NoSlowLink, HKLM\So

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0E28E245-9368-4853-AD84-6DA3BA35BB75}!LogLevel, HKLM\Softw

HKCU\Software\Policies\Microsoft\MMC\{3BAE7E51-E3F4-41D0-853D-9BB9FD47605F}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}!NoSlowLink, HKLM\So

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}!LogLevel, HKLM\Soft

HKCU\Software\Policies\Microsoft\MMC\{4F4F5452-92B8-4e4d-AFBB-EBB3BC1F40E3}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A3F3E39B-5D83-4940-B954-28315B82F0A8}!NoSlowLink, HKLM\So

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A3F3E39B-5D83-4940-B954-28315B82F0A8}!LogLevel, HKLM\Softw

HKCU\Software\Policies\Microsoft\MMC\{3EC4E9D3-714D-471F-88DC-4DD4471AAB47}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6232C319-91AC-4931-9385-E70C2B099F0E}!NoSlowLink, HKLM\So

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6232C319-91AC-4931-9385-E70C2B099F0E}!LogLevel, HKLM\Softw

HKCU\Software\Policies\Microsoft\MMC\{516FC620-5D34-4B08-8165-6A06B623EDEB}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{74EE6C03-5363-4554-B161-627540339CAB}!NoSlowLink, HKLM\Sof

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{74EE6C03-5363-4554-B161-627540339CAB}!LogLevel, HKLM\Softw

HKCU\Software\Policies\Microsoft\MMC\{5C935941-A954-4F7C-B507-885941ECE5C4}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}!NoSlowLink, HKLM\S

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}!LogLevel, HKLM\Soft

HKCU\Software\Policies\Microsoft\MMC\{294C9265-50C9-476c-BB18-12069D9FA538}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{17D89FEC-5C44-4972-B12D-241CAEF74509}!NoSlowLink, HKLM\S

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{17D89FEC-5C44-4972-B12D-241CAEF74509}!LogLevel, HKLM\Soft

HKCU\Software\Policies\Microsoft\MMC\{8A84720A-9AE0-4e74-81D5-B78F85C2867C}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}!NoSlowLink, HKLM\S

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}!LogLevel, HKLM\Soft

HKCU\Software\Policies\Microsoft\MMC\{BFCBBEB0-9DF4-4c0c-A728-434EA66A0373}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}!NoSlowLink, HKLM\So

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}!LogLevel, HKLM\Softw

HKCU\Software\Policies\Microsoft\MMC\{D08D61AC-6A7A-4945-9A14-A3BB64403607}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}!NoSlowLink, HKLM\So

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}!LogLevel, HKLM\Softw

HKCU\Software\Policies\Microsoft\MMC\{6A712058-33C6-4046-BCF9-0EA3A8808EDC}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{0DA274B5-EB93-47A7-AAFB-65BA532D3FE6}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{06F18E4A-47DE-43c3-B0E8-17FDC76C76D4}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{45B01F1C-5AC2-458c-9457-42A81B34A26D}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{A8C42CEA-CDB8-4388-97F4-5831F933DA84}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}!NoSlowLink, HKLM\S

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}!LogLevel, HKLM\Soft

HKCU\Software\Policies\Microsoft\MMC\{ABC77E89-745D-41da-B21D-346D1B9A3F13}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E5094040-C46C-4115-B030-04FB2E545B00}!NoSlowLink, HKLM\So

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E5094040-C46C-4115-B030-04FB2E545B00}!LogLevel, HKLM\Softw

HKCU\Software\Policies\Microsoft\MMC\{BEE07A6A-EC9F-4659-B8C9-0B1937907C83}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B087BE9D-ED37-454f-AF9C-04291E351182}!NoSlowLink, HKLM\So

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B087BE9D-ED37-454f-AF9C-04291E351182}!LogLevel, HKLM\Softw

HKCU\Software\Policies\Microsoft\MMC\{770933BF-A9EF-46a7-BCB0-EF67B7B6C191}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{AADCED64-746C-4633-A97C-D61349046527}!NoSlowLink, HKLM\S

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{AADCED64-746C-4633-A97C-D61349046527}!LogLevel, HKLM\Soft

HKCU\Software\Policies\Microsoft\MMC\{CC5746A9-9B74-4be5-AE2E-64379C86E0E4}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{91FBB303-0CD5-4055-BF42-E512A681B325}!NoSlowLink, HKLM\So

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{91FBB303-0CD5-4055-BF42-E512A681B325}!LogLevel, HKLM\Softw

HKCU\Software\Policies\Microsoft\MMC\{CEFFA6E2-E3BD-421B-852C-6F6A79A59BC1}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}!NoSlowLink, HKLM\S

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}!LogLevel, HKLM\Soft

HKCU\Software\Policies\Microsoft\MMC\{E235F4FA-246B-4233-9200-60CF020696F1}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}!NoSlowLink, HKLM\S

HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}!LogLevel, HKLM\Soft

HKCU\Software\Policies\Microsoft\MMC\{127537A8-C1ED-40BC-9AE5-C5891DF6B2D4}!Restrict_Run

HKLM\Software\Policies\Microsoft\Windows\System!ProcessTSUserLogonAsync

HKLM\Software\Policies\Microsoft\Windows\System!HelpQualifiedRootDir

HKLM\Software\Policies\Microsoft\Windows\System!DisableInHelp

HKCU\Software\Policies\Microsoft\Windows\System!DisableInHelp

HKLM\Software\Policies\Microsoft\Assistance\Client\1.0!NoActiveHelp

HKCU\Software\Policies\Microsoft\Assistance\Client\1.0!NoImplicitFeedback

HKCU\Software\Policies\Microsoft\Assistance\Client\1.0!NoExplicitFeedback

HKLM\Software\Policies\Microsoft\Assistance\Client\1.0!NoUntrustedContent

HKCU\Software\Policies\Microsoft\Assistance\Client\1.0!NoOnlineAssist

HKLM\Software\policies\Microsoft\System\HotStart!NoHotStart

HKCU\Software\policies\Microsoft\System\HotStart!NoHotStart

HKLM\Software\Policies\Microsoft\InternetManagement!RestrictCommunication, HKLM\Software\Microsoft\Windows\CurrentVer

HKCU\Software\Policies\Microsoft\InternetManagement!RestrictCommunication, HKCU\Software\Microsoft\Windows\CurrentVers

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate!DisableWindowsUpdateAccess

HKLM\Software\Policies\Microsoft\SystemCertificates\AuthRoot!DisableRootAutoUpdate

HKLM\Software\Policies\Microsoft\Windows NT\Printers!DisableWebPnPDownload

HKCU\Software\Policies\Microsoft\Windows NT\Printers!DisableWebPnPDownload

HKLM\Software\Policies\Microsoft\EventViewer!MicrosoftEventVwrDisableLinks

HKLM\Software\Policies\Microsoft\PCHealth\HelpSvc!Headlines

HKLM\Software\Policies\Microsoft\PCHealth\HelpSvc!MicrosoftKBSearch

HKLM\Software\Policies\Microsoft\Windows\Internet Connection Wizard!ExitOnMSICW

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoWebServices

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoWebServices

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoInternetOpenWith

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoInternetOpenWith

HKLM\Software\Policies\Microsoft\Windows NT\Printers!DisableHTTPPrinting

HKCU\Software\Policies\Microsoft\Windows NT\Printers!DisableHTTPPrinting

HKLM\Software\Policies\Microsoft\Windows\Registration Wizard Control!NoRegistration

HKLM\Software\Policies\Microsoft\SearchCompanion!DisableContentFileUpdates

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoOnlinePrintsWizard

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoOnlinePrintsWizard

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoPublishingWizard

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoPublishingWizard

HKLM\Software\Policies\Microsoft\Messenger\Client!CEIP

HKCU\Software\Policies\Microsoft\Messenger\Client!CEIP

HKLM\Software\Policies\Microsoft\SQMClient\Windows!CEIPEnable

HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting!DoReport, HKLM\Software\Policies\Microsoft\Windows\Windows Er

HKLM\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator!NoActiveProbe

HKLM\Software\Policies\Microsoft\Windows\DriverSearching!DontSearchWindowsUpdate

HKLM\Software\Policies\Microsoft\Windows NT\IIS!PreventIISInstall

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1406

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1406









HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1406

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1406









HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!AddPolicySearchProviders

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!AddPolicySearchProviders

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Ext!ListBox_Support_CLSID, HKLM\Software\Microsoft\Windows\Cu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext!ListBox_Support_CLSID, HKCU\Software\Microsoft\Windows\Cu

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!ListBox_Support_AllowedBehaviors, HKLM\Softwar

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!ListBox_Support_AllowedBehaviors, HKCU\Softwar

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT!*

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS!*

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING!*

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND!*

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN!*

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING!*

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL!*

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN!*

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING!*

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION!*

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL!*

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD!*

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS!*

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Script_Paste_URLAction_If_Prompt!

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT!*

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS!*

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING!*

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND!*

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN!*

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING!*

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL!*

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN!*

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING!*

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION!*

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL!*

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD!*

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS!*

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Script_Paste_URLAction_If_Prompt!

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Sett

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Sett







































































HKLM\Software\Policies\Microsoft\Internet Explorer\Main!NoWebJITSetup

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!NoWebJITSetup

HKLM\Software\Policies\Microsoft\Internet Explorer\Main!NoJITSetup

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!NoJITSetup









































HKLM\Software\Policies\Microsoft\Internet Explorer\Download!RunInvalidSignatures

HKCU\Software\Policies\Microsoft\Internet Explorer\Download!RunInvalidSignatures





















HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Show image placeholders

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Print_Background

HKLM\Software\Policies\Microsoft\Internet Explorer\Main!Enable Browser Extensions

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Enable Browser Extensions

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!120A

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!120A









HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!120A

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!120A

















































HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{05589FA1-C356-11CE-BF01-









































HKLM\Software\Policies\Microsoft\Internet Explorer\Main!NoUpdateCheck

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!NoUpdateCheck

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{DED22F57-FEE2-11D0-953B

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!CertificateRevocation

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!CertificateRevocation

HKLM\Software\Policies\Microsoft\Internet Explorer\Download!CheckExeSignatures

HKCU\Software\Policies\Microsoft\Internet Explorer\Download!CheckExeSignatures

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!No_LaunchMediaBar, HKCU\Software\Microsoft\Internet Explo

HKCU\Software\Microsoft\Outlook Express!BlockExeAttachments

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!SpecifyDefaultButtons, HKCU\Software\Microsoft\Windows

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent!Version

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent!Version

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Ext!RestrictToList

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext!RestrictToList

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{2D360201-FFF5-11D1-8D03

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!History, HKLM\Software\Policies\Microsoft\Windows\CurrentV

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!History, HKCU\Software\Policies\Microsoft\Windows\Current

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoAddingChannels

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoAddingSubscriptions

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoScheduledUpdates

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Use FormSuggest, HKCU\Software\Policies\Microsoft\Internet Explor

HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoJITSetup

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!EnableAutoProxyResultCache

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Accessibility

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Advanced

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!Autoconfig

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Autoconfig

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!CalendarContact

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Certificates

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Colors

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!Connection Settings, HKLM\Software\Policies\Microsoft\Inte

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Connection Settings

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Check_If_Default

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Fonts

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!HomePage, HKCU\Software\Policies\Microsoft\Internet Explo

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Languages

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!links

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Messaging

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Profiles

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!Proxy

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Proxy

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Ratings

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Cache

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoChannelUI

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoBrowserContextMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoToolbarCustomize

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoBandCustomize

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoSubscriptionContent

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoEditingScheduleGroups

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoEditingSubscriptions

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoExternalBranding

HKCU\Software\Policies\Microsoft\Internet Explorer!DisableImportExportFavorites

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Connwiz Admin Lock

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoChannelLogging

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoOpeninNewWnd

HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoUpdateCheck

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoRemovingChannels

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoRemovingSubscriptions

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoSelectDownloadDir

HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoSplash

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoMSAppLogo5ChannelNotify

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!AdvancedTab

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!AdvancedTab

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!ConnectionsTab

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!ConnectionsTab

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!ContentTab

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!ContentTab

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!GeneralTab

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!GeneralTab

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!PrivacyTab

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!PrivacyTab

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!ProgramsTab

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!ProgramsTab

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!ResetWebSettings

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!SecurityTab

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!SecurityTab





















HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!DisplayScriptDownloadFailureUI





















HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableRIED

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableRIED

HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoExtensionManagement

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoExtensionManagement

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1A04

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1A04









HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1A04

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1A04









HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!DisableCachingOfSSLPages

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!DisableCachingOfSSLPages









































HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Cache!Persistent

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Cache!Persistent

HKLM\Software\Policies\Microsoft\Internet Explorer\Main!XMLHTTP

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!XMLHTTP

HKLM\Software\Policies\Microsoft\Internet Explorer\Main!AlwaysShowMenus, HKLM\Software\Policies\Microsoft\Internet Explo

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!AlwaysShowMenus, HKCU\Software\Policies\Microsoft\Internet Explo

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoBrowserClose

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoFileNew

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoFileOpen

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoBrowserSaveWebComplete

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoBrowserSaveAs

HKCU\Software\Policies\Microsoft\Internet Explorer\Persistence\3!DomainLimit, HKCU\Software\Policies\Microsoft\Internet Exp





HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoHelpItemNetscapeHelp

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoHelpItemSendFeedback

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoHelpItemTipOfTheDay

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoHelpItemTutorial

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoFavorites

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Identities!Locked Down









































HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS!(Reserved), HKLM\Software\P

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING!(Reserved), HKLM\Softw

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND!(Reserved), HKLM\Softwa

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN!(Reserved

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING!(Reserved), HKLM\Softwa

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL!(Reserved), H

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN!(Reserved), HK

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING!(Reserved), HKLM\Sof

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION!(Reserved), HKLM\Sof

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL!(Reserved)

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD!(Reserved),

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS!(Reserved), H

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Script_Paste_URLAction_If_Prompt!(

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS!(Reserved), HKCU\Software\P

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING!(Reserved), HKCU\Soft

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND!(Reserved), HKCU\Softw

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN!(Reserved

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING!(Reserved), HKCU\Softw

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL!(Reserved), H

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN!(Reserved), HK

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING!(Reserved), HKCU\Sof

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION!(Reserved), HKCU\Sof

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL!(Reserved)

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD!(Reserved),

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS!(Reserved), H

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Script_Paste_URLAction_If_Prompt!(

HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols!ListBox_Support_3, HKLM\

HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols!ListBox_Support_3, HKCU\

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Template Policies!InternetZoneTemplate, HKLM\Sof

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Template Policies!InternetZoneTemplate, HKCU\Sof

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!IntranetName

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!IntranetName

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!UNCAsIntranet

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!UNCAsIntranet

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!ProxyByPass

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!ProxyByPass



HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Intranet Settings\Template Policies!IntranetZoneTemplate, HKLM\Sof

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Intranet Settings\Template Policies!IntranetZoneTemplate, HKCU\Sof

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{9276B91A-E780-11d2-8A8D-

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1C00

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1C00









HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1C00

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1C00



















































HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Local Machine Zone Settings\Template Policies!LocalMachineZone

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Local Machine Zone Settings\Template Policies!LocalMachineZone

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Lockdown Settings\Template Policies!InternetZoneLockdo

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Lockdown Settings\Template Policies!InternetZoneLockdo

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Intranet Lockdown Settings\Template Policies!IntranetZoneLockdo

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Intranet Lockdown Settings\Template Policies!IntranetZoneLockdo

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Local Machine Zone Lockdown Settings\Template Policies!Local

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Local Machine Zone Lockdown Settings\Template Policies!Local

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Restricted Sites Lockdown Settings\Template Policies!RestrictedS

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Restricted Sites Lockdown Settings\Template Policies!Restricted

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Trusted Sites Lockdown Settings\Template Policies!TrustedSites

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Trusted Sites Lockdown Settings\Template Policies!TrustedSites









































HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!ProxySettingsPerUser

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{275E2FE0-7486-11D0-89D6-

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{D45FD31B-5C6E-11D1-9EC1

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{D6526FE0-E651-11CF-99CB

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{AE24FDAE-03C6-11D1-8B76

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{BD1F006E-174F-11D2-95C0

HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbar\WebBrowser!ITBar7Position

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{2FF18E10-DE11-11D1-8161





















HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{26F24A93-1DA2-11D0-A334-





















HKLM\Software\Policies\Microsoft\Internet Explorer\Main!Play_Animations

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Play_Animations

HKLM\Software\Policies\Microsoft\Internet Explorer\Main!Play_Background_Sounds

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Play_Background_Sounds

HKLM\Software\Policies\Microsoft\Internet Explorer\Main!Display Inline Videos

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Display Inline Videos

HKLM\Software\Policies\Microsoft\Internet Explorer\New Windows!ListBox_Support_Allow, HKLM\Software\Policies\Microsoft\I

HKCU\Software\Policies\Microsoft\Internet Explorer\New Windows!ListBox_Support_Allow, HKCU\Software\Policies\Microsoft\

HKLM\Software\Policies\Microsoft\Internet Explorer\Security!DisableFixSecuritySettings

HKCU\Software\Policies\Microsoft\Internet Explorer\Security!DisableFixSecuritySettings

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!AutoSearch

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!PreventIgnoreCertErrors

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!PreventIgnoreCertErrors

HKLM\Software\Policies\Microsoft\Internet Explorer\SQM!DisableCustomerImprovementProgram

HKCU\Software\Policies\Microsoft\Internet Explorer\SQM!DisableCustomerImprovementProgram

HKLM\Software\Policies\Microsoft\Internet Explorer\Main!DisableFirstRunCustomize

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!DisableFirstRunCustomize

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!CodeBaseSearchPath

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion!IEAKUpdateUrl

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!Settings

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Settings

HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoSearchBox

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoSearchBox

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Use_DlgBox_Colors

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoDefaultTextSize, HKCU\Software\Policies\Microsoft\Intern

HKCU\Software\Policies\Microsoft\Internet Explorer\Settings!Background Color

HKCU\Software\Policies\Microsoft\Internet Explorer\Settings!Text Color

HKCU\Software\Policies\Microsoft\Internet Explorer\Settings!Anchor Color Visited

HKCU\Software\Policies\Microsoft\Internet Explorer\Settings!Anchor Color

HKCU\Software\Policies\Microsoft\Internet Explorer\Settings!Anchor Color Hover

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_ADDON_MANAGEMEN

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_BEHAVIORS, HKLM\Sof

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_MIME_HANDLING, HKL

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_SECURITYBAND, HKLM

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_LOCALMACHINE_L

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_MIME_SNIFFING, HKLM

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_DISABLE_MK_PROTO

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_PROTOCOL_LOCKDO

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_OBJECT_CACHING, HK

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_ZONE_ELEVATION, HK

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_RESTRICT_ACTIVEXI

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_RESTRICT_FILEDOW

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_WINDOW_RESTRICTI

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_Feature_Enable_Script_Paste_URLA

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_ADDON_MANAGEMEN

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_BEHAVIORS, HKCU\Sof

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_MIME_HANDLING, HKC

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_SECURITYBAND, HKCU

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_LOCALMACHINE_L

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_MIME_SNIFFING, HKCU

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_DISABLE_MK_PROTO

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_PROTOCOL_LOCKD

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_OBJECT_CACHING, H

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_ZONE_ELEVATION, HK

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_RESTRICT_ACTIVEXI

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_RESTRICT_FILEDOW

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_WINDOW_RESTRICTI

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_Feature_Enable_Script_Paste_URLA

HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoChangeDefaultSearchProvider

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoChangeDefaultSearchProvider

HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!UsePolicySearchProvidersOnly

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!UsePolicySearchProvidersOnly



HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Restricted Sites Settings\Template Policies!RestrictedSitesZoneTem

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Restricted Sites Settings\Template Policies!RestrictedSitesZoneTem









































HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoFindFiles

HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoSearchCustomization

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!Security_zones_map_edit

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!Security_options_edit

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!Security_HKLM_only

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!EnablePunyCode

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!EnablePunyCode

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{D27CDB6E-AE6D-11CF-96B8

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!ListBox_Support_ZoneMapKey, HKLM\Software\Po

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!ListBox_Support_ZoneMapKey, HKCU\Software\Po

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1E05

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1E05









HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1E05

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1E05





























HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!MaxSubscriptionSize, HKCU\Software\Policies\Micr

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoBrowserOptions



HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Trusted Sites Settings\Template Policies!TrustedSitesZoneTemplate

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Trusted Sites Settings\Template Policies!TrustedSitesZoneTemplate

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableDeleteBrowsingHistory

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableDeleteBrowsingHistory

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableDeleteForms

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableDeleteForms

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableDeletePasswords

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableDeletePasswords

HKLM\Software\Policies\Microsoft\Internet Explorer\Feeds!DisableAddRemove

HKCU\Software\Policies\Microsoft\Internet Explorer\Feeds!DisableAddRemove

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Enable AutoImageResize

HKLM\Software\Policies\Microsoft\Internet Explorer\Feeds!BackgroundSyncStatus

HKCU\Software\Policies\Microsoft\Internet Explorer\Feeds!BackgroundSyncStatus

HKLM\Software\Policies\Microsoft\Internet Explorer\Main!Update_Check_Page

HKLM\Software\Policies\Microsoft\Internet Explorer\Main!UseClearType

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!UseClearType

HKLM\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!OpenInForeground

HKCU\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!OpenInForeground

HKLM\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!PopupsUseNewWindow

HKCU\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!PopupsUseNewWindow

HKLM\Software\Policies\Microsoft\Internet Explorer\Main!AllowWindowReuse

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!AllowWindowReuse

HKLM\Software\Policies\Microsoft\Internet Explorer\Main!Update_Check_Interval

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Anchor Underline

HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoCrashDetection

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoCrashDetection

HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoHelpMenu

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoHelpMenu

HKLM\Software\Policies\Microsoft\Internet Explorer\Feeds!DisableEnclosureDownload

HKCU\Software\Policies\Microsoft\Internet Explorer\Feeds!DisableEnclosureDownload

HKLM\Software\Policies\Microsoft\Internet Explorer\Feed Discovery!Enabled

HKCU\Software\Policies\Microsoft\Internet Explorer\Feed Discovery!Enabled





















HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Friendly http errors

HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete!Use AutoComplete

HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter!Enabled

HKCU\Software\Policies\Microsoft\Internet Explorer\PhishingFilter!Enabled

HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions!RestrictPopupExceptionList

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!RestrictPopupExceptionList

HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions!DisablePopupFilterLevel

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!DisablePopupFilterLevel

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Page_Transitions

HKLM\Software\Policies\Microsoft\Internet Explorer\ZOOM!ZoomDisabled

HKCU\Software\Policies\Microsoft\Internet Explorer\ZOOM!ZoomDisabled

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Display Inline Images

HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoPopupManagement

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoPopupManagement

HKLM\Software\Policies\Microsoft\Internet Explorer\Security\P3Global!Enabled

HKCU\Software\Policies\Microsoft\Internet Explorer\Security\P3Global!Enabled

HKLM\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!QuickTabsThreshold

HKCU\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!QuickTabsThreshold

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!UrlEncoding

HKCU\SOFTWARE\Policies\Microsoft\Internet Explorer!SmartDithering

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!SmoothScroll

HKLM\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!Enabled

HKCU\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!Enabled

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete!AutoSuggest

HKLM\Software\Policies\Microsoft\Internet Explorer\Feeds!DisableFeedPane

HKCU\Software\Policies\Microsoft\Internet Explorer\Feeds!DisableFeedPane

HKLM\Software\Policies\Microsoft\Internet Explorer\Security!DisableSecuritySettingsCheck

HKCU\Software\Policies\Microsoft\Internet Explorer\Security!DisableSecuritySettingsCheck

HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions!DisableToolbarUpgrader

HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions!DisableToolbarUpgrader

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!AutoDetect

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!AutoDetect

HKCU\Software\Policies\Microsoft\IEAK!NoAutomaticSignup

HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Compat_logging!iexplore.exe

HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Compat_logging!iexplore.exe

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!WarnOnIntranet

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!WarnOnIntranet

HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete!Append Completion

HKLM\Software\Policies\Microsoft\Internet Explorer\Main!AlwaysShowMenus

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!AlwaysShowMenus





















HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Disable Script Debugger

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!FormSuggest Passwords, HKCU\Software\Policies\Microsoft\Interne

HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Error Dlg Displayed On Every Error

HKCU\Software\Policies\Microsoft\Internet Explorer\Settings!Use Anchor Hover Color

HKCU\Software\Policies\Microsoft\Internet Connection Wizard!DisableICW

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!DialupAutodetect









































HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Protocols\Mailto!UTF8Encoding

HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Protocols\Mailto!UTF8Encoding





















HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoTheaterMode

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoViewSource





























































HKLM\Software\Policies\Microsoft\Windows\HandwritingErrorReports!PreventHandwritingErrorReports

HKCU\Software\Policies\Microsoft\Windows\HandwritingErrorReports!PreventHandwritingErrorReports

HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization!RestrictImplicitTextCollection, HKLM\SOFTWARE\Policies\Microsoft\In

HKCU\SOFTWARE\Policies\Microsoft\InputPersonalization!RestrictImplicitTextCollection, HKCU\SOFTWARE\Policies\Microsoft\In

HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization!DisablePersonalization

HKCU\SOFTWARE\Policies\Microsoft\InputPersonalization!DisablePersonalization

HKLM\Software\Policies\Microsoft\Windows\iSCSI!NewStaticTargets

HKLM\Software\Policies\Microsoft\Windows\iSCSI!RestrictAdditionalLogins

HKLM\Software\Policies\Microsoft\Windows\iSCSI!ChangeCHAPSecret

HKLM\Software\Policies\Microsoft\Windows\iSCSI!ChangeIQNName

HKLM\Software\Policies\Microsoft\Windows\iSCSI!RequireIPSec

HKLM\Software\Policies\Microsoft\Windows\iSCSI!ConfigureTargets

HKLM\Software\Policies\Microsoft\Windows\iSCSI!ConfigureiSNSServers

HKLM\Software\Policies\Microsoft\Windows\iSCSI!ConfigureTargetPortals

HKLM\Software\Policies\Microsoft\Windows\iSCSI!RequireMutualCHAP

HKLM\Software\Policies\Microsoft\Windows\iSCSI!RequireOneWayCHAP

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters!EmitLILI

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos!domain_realm_Enabled, HKLM\Software\Microso

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos!MitRealms_Enabled, HKLM\Software\Microsoft\W

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters!KdcValidation

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{180b3a99-8c39-4f12-b631-2031998efe45}!ScenarioExecutionEnabled, H

HKLM\Software\Policies\Microsoft\Windows\LLTD!EnableLLTDIO, HKLM\Software\Policies\Microsoft\Windows\LLTD!AllowLLT

HKLM\Software\Policies\Microsoft\Windows\LLTD!EnableRspndr, HKLM\Software\Policies\Microsoft\Windows\LLTD!AllowRspn

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!LogonType

HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon!SyncForegroundPolicy

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisableLocalMachineRun

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisableCurrentUserRun

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisableLocalMachineRunOnce

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisableCurrentUserRunOnce

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoWelcomeScreen

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoWelcomeScreen

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!HideFastUserSwitching

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableStatusMessages

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableStartupSound

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!VerboseStatus

HKLM\Software\Policies\Microsoft\WindowsMediaCenter!MediaCenter

HKCU\Software\Policies\Microsoft\WindowsMediaCenter!MediaCenter

HKCU\Software\Policies\Microsoft\MMC\{C96401CF-0E17-11D3-885B-00C04F72C717}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{B708457E-DB61-4C55-A92F-0D4B5E9B1224}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{C96401D1-0E17-11D3-885B-00C04F72C717}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC!RestrictAuthorMode

HKCU\Software\Policies\Microsoft\MMC!RestrictToPermittedSnapins

HKCU\Software\Policies\Microsoft\MMC\{18BA7139-D98B-43c2-94DA-2604E34E175D}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{EBC53A38-A23F-11D0-B09B-00C04FD8DCA6}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{D967F824-9968-11D0-B936-00C04FD8D5B0}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{E355E538-1C2E-11D0-8C37-00C04FD8FE93}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{0F6B957D-509E-11D1-A7CC-0000F87571E3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{B6F9C8AE-EF3A-41C8-A911-37370C331DD4}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{0F6B957E-509E-11D1-A7CC-0000F87571E3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{B6F9C8AF-EF3A-41C8-A911-37370C331DD4}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{1C5DACFA-16BA-11D2-81D0-0000F87A7AA3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{1AA7F83C-C7F5-11D0-A376-00C04FC9DA04}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{1F5EEC01-1214-4D94-80C5-4BDCD2014DDD}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{A994E107-6854-4F3D-917C-E6F01670F6D3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{53D6AB1D-2488-11D1-A28C-00C04FB94F17}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{de751566-4cc6-11d1-8ca0-00c04fc297eb}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{3F276EB4-70EE-11D1-8A0F-00C04FB93753}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{C9BC92DF-5B9A-11D1-8F00-00C04FC2C17B}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{58221C67-EA27-11CF-ADCF-00AA00A80033}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{C2FE450B-D6C2-11D0-A37B-00C04FC9DA04}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{9EC88934-C774-11d1-87F4-00C04FC2C17B}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{90087284-d6d6-11d0-8353-00a0c90640bf}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{74246bfc-4c96-11d0-abef-0020af6b0b7a}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{C2FE4502-D6C2-11D0-A37B-00C04FC9DA04}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{43668E21-2636-11D1-A1CE-0080C88593A5}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{8EAD3A12-B2C1-11d0-83AA-00A0C92C9D5D}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{677A2D94-28D9-11D1-A95B-008048918FB1}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{634BDE40-E5E1-49A1-B2CD-140FFFC830F9}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{394C052E-B830-11D0-9A86-00C04FD8DBF7}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{975797FC-4E2A-11D0-B702-00C04FD8DBF7}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{b05566ae-fe9c-4363-be05-7a4cbb7cb510}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{b05566ad-fe9c-4363-be05-7a4cbb7cb510}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{D2779945-405B-4ACE-8618-508F3E3054AC}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{753EDB4D-2E1B-11D1-9064-00A0C90AB504}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{c40d66a0-e90c-46c6-aa3b-473e38c72bf2}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{FF5903A8-78D6-11D1-92F6-006097B01056}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{E12BBB5D-D59D-4E61-947A-301D25AE8C23}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{D70A2BEA-A63E-11D1-A7D4-0000F87571E3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{89cc9588-7628-4d29-8e4a-6550d0087059}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{2E19B602-48EB-11d2-83CA-00104BCA42CF}!Restrict_Run


HKCU\Software\Policies\Microsoft\MMC\{95AD72F0-44CE-11D0-AE29-00AA004B9986}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{8F8F8DC0-5713-11D1-9551-0060B0576642}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{FC715823-C5FB-11D1-9EEF-00A0C90347FF}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{d524927d-6c08-46bf-86af-391534d779d3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{A841B6C2-7577-11D0-BB1F-00A0C922E79C}!Restrict_Run


HKCU\Software\Policies\Microsoft\MMC\{57C596D0-9370-40C0-BA0D-AB491B63255D}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{DEA8AFA0-CC85-11d0-9CE2-0080C7221EBD}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{DEA8AFA2-CC85-11d0-9CE2-0080C7221EBD}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{90810502-38F1-11D1-9345-00C04FC9DA04}!Restrict_Run



HKCU\Software\Policies\Microsoft\MMC\{5D6179C8-17EC-11D1-9AA9-00C04FD8FE93}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{6E8E0081-19CD-11D1-AD91-00AA00B8E05A}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{a1bc4ecb-66b2-44e8-9915-be02e84438ba}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{a1bc4eca-66b2-44e8-9915-be02e84438ba}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{6630f2d7-bd52-4072-bfa7-863f3d0c5da0}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{6d8880af-e518-43a8-986c-1ad21c4c976e}!Restrict_Run


HKCU\Software\Policies\Microsoft\MMC\{7478EF61-8C46-11d1-8D99-00A0C913CAD4}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{34AB8E82-C27E-11D1-A6C0-00C04FB94F17}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{FD57D297-4FD9-11D1-854E-00C04FC31FD3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{B52C1E50-1DD2-11D1-BC43-00C04FC31FD3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{5880CD5C-8EC0-11d1-9570-0060B0576642}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{3D5D035E-7721-4B83-A645-6C07A3D403B7}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{3060E8CE-7020-11D2-842D-00C04FA372D4}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{243E20B0-48ED-11D2-97DA-00A024D77700}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{3CB6973D-3E6F-11D0-95DB-00A024D77700}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{6DC3804B-7212-458D-ADB0-9A07E2AE1FA2}!Restrict_Run


HKCU\Software\Policies\Microsoft\MMC\{DAB1A262-4FD7-11D1-842C-00C04FB6C218}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{1AA7F839-C7F5-11D0-A376-00C04FC9DA04}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{40B66650-4972-11D1-A7CA-0000F87571E3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{40B66661-4972-11d1-A7CA-0000F87571E3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{40B6664F-4972-11D1-A7CA-0000F87571E3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{40B66660-4972-11d1-A7CA-0000F87571E3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{011BE22D-E453-11D1-945A-00C04FB984F9}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{fe883157-cebd-4570-b7a2-e4fe06abe626}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{5ADF5BF6-E452-11D1-945A-00C04FB984F9}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{B1AFF7D0-0C49-11D1-BB12-00C04FC9A3A3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{18ea3f92-d6aa-41d9-a205-2023400c8fbb}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{BD95BA60-2E26-AAD1-AD99-00AA00B8E05A}!Restrict_Run




HKCU\Software\Policies\Microsoft\MMC\{03f1f940-a0f2-11d0-bb77-00aa00a1eab7}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{7AF60DD3-4979-11D1-8A6C-00C04FC33566}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{942A8E4F-A261-11D1-A760-00C04FB9603F}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{7E45546F-6D52-4D10-B702-9C2E67232E62}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{BACF5C8A-A3C7-11D1-A760-00C04FB9603F}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{1BC972D6-555C-4FF7-BE2C-C584021A0A6A}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{45ac8c63-23e2-11d1-a696-00c04fd58bc3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{0F3621F1-23C6-11D1-AD97-00AA00B88E5A}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{E26D02A0-4C1F-11D1-9AA1-00C04FC3357A}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{B91B6008-32D2-11D2-9888-00A0C925F917}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{7d3830aa-e69e-4e17-8bd1-1b87b97099da}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{0E752416-F29E-4195-A9DD-7F0D4D5A9D71}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{b05566ac-fe9c-4368-be02-7a4cbb7cbe11}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{06993B16-A5C7-47EB-B61C-B1CB7EE600AC}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{23DC5869-BD9F-46fd-AADD-1F869BA64FC3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{2DA6AA7F-8C88-4194-A558-0D36E7FD3E64}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{5C659257-E236-11D2-8899-00104B2AFB46}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{671ee405-c969-4af9-ad1b-65e96b3b9a10}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{f78fbadd-c21a-4e0a-b53d-c879a9c8f002}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{dbfca500-8c31-11d0-aa2c-00a0c92749a3}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{f8abd46c-1297-4474-9cdf-831ebb245f49}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{f8abd46e-1297-4474-9cdf-831ebb245f49}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{C11D2F3B-E2F4-4e5b-824B-84A87AB0F666}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\{9FE24B92-C23D-451c-8045-73038D99E620}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{813C1B01-6624-4922-9C6C-03C315646584}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{f9f63d92-6225-410b-bb02-26239b8f1f59}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{317cdc35-c09e-486f-ab09-90dd2e3fdd7d}!Restrict_Run

HKCU\Software\Policies\Microsoft\MMC\FX:{317cdc37-c09e-486f-ab09-90dd2e3fdd7d}!Restrict_Run

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\MobilityCenter!NoMobilityCenter

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\MobilityCenter!NoMobilityCenter

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\PresentationSettings!NoPresentationSettings

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\PresentationSettings!NoPresentationSettings

HKLM\Software\Policies\Microsoft\WindowsMovieMaker!MovieMaker

HKCU\Software\Policies\Microsoft\WindowsMovieMaker!MovieMaker

HKLM\Software\Policies\Microsoft\WindowsMovieMaker!CodecDownload

HKCU\Software\Policies\Microsoft\WindowsMovieMaker!CodecDownload

HKLM\Software\Policies\Microsoft\WindowsMovieMaker!WebHelp

HKCU\Software\Policies\Microsoft\WindowsMovieMaker!WebHelp

HKLM\Software\Policies\Microsoft\WindowsMovieMaker!WebPublish

HKCU\Software\Policies\Microsoft\WindowsMovieMaker!WebPublish

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{C295FBBA-FD47-46ac-8BEE-B1715EC634E5}!ScenarioExecutionEnable

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{C295FBBA-FD47-46ac-8BEE-B1715EC634E5}!DownloadToolsEnabled,

HKLM\Software\Policies\Microsoft\Windows\Installer!EnableAdminTSRemote

HKLM\Software\Policies\Microsoft\Windows\Installer!AlwaysInstallElevated

HKCU\Software\Policies\Microsoft\Windows\Installer!AlwaysInstallElevated

HKLM\Software\Policies\Microsoft\Windows\Installer!MaxPatchCacheSize

HKLM\Software\Policies\Microsoft\Windows\Installer!TransformsSecure

HKLM\Software\Policies\Microsoft\Windows\Installer!SafeForScripting

HKLM\Software\Policies\Microsoft\Windows\Installer!DisableLoggingFromPackage

HKLM\Software\Policies\Microsoft\Windows\Installer!DisableMSI

HKLM\Software\Policies\Microsoft\Windows\Installer!EnableUserControl

HKLM\Software\Policies\Microsoft\Windows\Installer!AllowLockdownBrowse

HKLM\Software\Policies\Microsoft\Windows\Installer!AllowLockdownPatch

HKLM\Software\Policies\Microsoft\Windows\Installer!AllowLockdownMedia

HKLM\Software\Policies\Microsoft\Windows\Installer!EnforceUpgradeComponentRules

HKLM\Software\Policies\Microsoft\Windows\Installer!Logging

HKCU\Software\Policies\Microsoft\Windows\Installer!DisableMedia

HKLM\Software\Policies\Microsoft\Windows\Installer!DisableFlyweightPatching

HKLM\Software\Policies\Microsoft\Windows\Installer!DisableLUAPatching

HKLM\Software\Policies\Microsoft\Windows\Installer!DisablePatch

HKLM\Software\Policies\Microsoft\Windows\Installer!DisablePatchUninstall

HKLM\Software\Policies\Microsoft\Windows\Installer!DisableRollback

HKCU\Software\Policies\Microsoft\Windows\Installer!DisableRollback

HKLM\Software\Policies\Microsoft\Windows\Installer!DisableAutomaticApplicationShutdown

HKLM\Software\Policies\Microsoft\Windows\Installer!DisableUserInstalls

HKLM\Software\Policies\Microsoft\Windows\Installer!DisableBrowse

HKCU\Software\Policies\Microsoft\Windows\Installer!SearchOrder

HKLM\Software\Policies\Microsoft\Windows\Installer!LimitSystemRestoreCheckpointing

HKLM\SOFTWARE\Policies\Microsoft\NetworkAccessProtection\ClientConfig\Qecs\79620!Enabled

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!AllowNT4Crypto

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!AutoSiteCoverage

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!AvoidPdcOnWan

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!DnsAvoidRegisterRecords

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!IgnoreIncomingMailslotMessages

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!AddressTypeReturned

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!UseDynamicDns

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!ExpectedDialupDelay

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!BackgroundRetryQuitTime

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!ForceRediscoveryInterval

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!BackgroundRetryInitialPeriod

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!AllowSingleLabelDnsDomain

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!dbFlag

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!BackgroundRetryMaximumPeriod

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!MaximumLogFileSize

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!NegativeCachePeriod

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!AllowExclusiveScriptsShareAccess

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!BackgroundSuccessfulRefreshPeriod

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!NonBackgroundSuccessfulRefreshPeriod

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!LdapSrvPriority

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!DnsRefreshInterval

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!ScavengeInterval

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!SiteName

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!NdncSiteCoverage

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!SiteCoverage

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!GcSiteCoverage

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!AllowExclusiveSysvolShareAccess

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!TryNextClosestSite

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!DnsTtl

HKLM\Software\Policies\Microsoft\Netlogon\Parameters!LdapSrvWeight

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RasAllUserProperties

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_DeleteAllUserConnection

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_LanConnect

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RenameAllUserRasConnection

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RenameLanConnection

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RenameConnection

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_EnableAdminProhibits

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_LanProperties

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_LanChangeProperties

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RasChangeProperties

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_AdvancedSettings

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_NewConnectionWizard

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_DialupPrefs

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_AddRemoveComponents

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RasMyProperties

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RasConnect

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_DeleteConnection

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_ChangeBindState

HKLM\Software\Policies\Microsoft\Windows\Network Connections!NC_AllowNetBridge_NLA

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RenameMyRasConnection

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_AllowAdvancedTCPIPConfig

HKLM\Software\Policies\Microsoft\Windows\Network Connections!NC_PersonalFirewallConfig

HKLM\Software\Policies\Microsoft\Windows\Network Connections!NC_ShowSharedAccessUI

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_Statistics

HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_IpStateChecking

HKLM\Software\Policies\Microsoft\NetworkProjector!DisableNetworkProjector

HKCU\Software\Policies\Microsoft\NetworkProjector!DisableNetworkProjector

HKLM\Software\Policies\Microsoft\Windows\NetCache!GoOfflineAction

HKCU\Software\Policies\Microsoft\Windows\NetCache!GoOfflineAction

HKLM\Software\Policies\Microsoft\Windows\NetCache\AssignedOfflineFolders

HKCU\Software\Policies\Microsoft\Windows\NetCache\AssignedOfflineFolders

HKLM\Software\Policies\Microsoft\Windows\NetCache!Enabled

HKLM\Software\Policies\Microsoft\Windows\NetCache!PurgeAtLogoff, HKLM\Software\Policies\Microsoft\Windows\NetCache!

HKLM\Software\Policies\Microsoft\Windows\NetCache!SlowLinkSpeed

HKLM\Software\Policies\Microsoft\Windows\NetCache!SlowLinkEnabled, HKLM\Software\Policies\Microsoft\Windows\NetCac

HKLM\Software\Policies\Microsoft\Windows\NetCache!DefCacheSize

HKLM\Software\Policies\Microsoft\Windows\NetCache!EncryptCache

HKLM\Software\Policies\Microsoft\Windows\NetCache!EventLoggingLevel

HKCU\Software\Policies\Microsoft\Windows\NetCache!EventLoggingLevel

HKLM\Software\Policies\Microsoft\Windows\NetCache!ExcludeExtensions

HKLM\Software\Policies\Microsoft\Windows\NetCache!InitialBalloonTimeoutSeconds

HKCU\Software\Policies\Microsoft\Windows\NetCache!InitialBalloonTimeoutSeconds

HKLM\Software\Policies\Microsoft\Windows\NetCache!CacheQuotaLimit, HKLM\Software\Policies\Microsoft\Windows\NetCac

HKLM\Software\Policies\Microsoft\Windows\NetCache\CustomGoOfflineActions

HKCU\Software\Policies\Microsoft\Windows\NetCache\CustomGoOfflineActions

HKLM\Software\Policies\Microsoft\Windows\NetCache!NoCacheViewer

HKCU\Software\Policies\Microsoft\Windows\NetCache!NoCacheViewer

HKLM\Software\Policies\Microsoft\Windows\NetCache\NoMakeAvailableOfflineList

HKCU\Software\Policies\Microsoft\Windows\NetCache\NoMakeAvailableOfflineList

HKLM\Software\Policies\Microsoft\Windows\NetCache!NoConfigCache

HKCU\Software\Policies\Microsoft\Windows\NetCache!NoConfigCache

HKLM\Software\Policies\Microsoft\Windows\NetCache!ReminderFreqMinutes

HKCU\Software\Policies\Microsoft\Windows\NetCache!ReminderFreqMinutes

HKLM\Software\Policies\Microsoft\Windows\NetCache!ReminderBalloonTimeoutSeconds

HKCU\Software\Policies\Microsoft\Windows\NetCache!ReminderBalloonTimeoutSeconds

HKLM\Software\Policies\Microsoft\Windows\NetCache!NoMakeAvailableOffline

HKCU\Software\Policies\Microsoft\Windows\NetCache!NoMakeAvailableOffline

HKLM\Software\Policies\Microsoft\Windows\NetCache!AlwaysPinSubFolders

HKLM\Software\Policies\Microsoft\Windows\NetCache!SyncAtLogoff

HKCU\Software\Policies\Microsoft\Windows\NetCache!SyncAtLogoff

HKLM\Software\Policies\Microsoft\Windows\NetCache!SyncAtLogon

HKCU\Software\Policies\Microsoft\Windows\NetCache!SyncAtLogon

HKLM\Software\Policies\Microsoft\Windows\NetCache!SyncAtSuspend

HKCU\Software\Policies\Microsoft\Windows\NetCache!SyncAtSuspend

HKLM\Software\Policies\Microsoft\Windows\NetCache!NoReminders

HKCU\Software\Policies\Microsoft\Windows\NetCache!NoReminders

HKLM\Software\Policies\Microsoft\Windows\NetCache!EconomicalAdminPinning

HKLM\Software\policies\Microsoft\Peernet!IgnoreDomainPasswordPolicyForNewGroups

HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-Global!SearchOnly

HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-LinkLocal!SearchOnly

HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-SiteLocal!SearchOnly

HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-Global!SeedServer, HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6

HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-LinkLocal!SeedServer

HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-SiteLocal!SeedServer

HKLM\Software\policies\Microsoft\Peernet!Disabled

HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-Global!DisableMulticastBootstrap

HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-LinkLocal!DisableMulticastBootstrap

HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-SiteLocal!DisableMulticastBootstrap

HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-Global!Disabled

HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-LinkLocal!Disabled

HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-SiteLocal!Disabled

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ParentalControls!WPCEnableOnDomain

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{659F08FB-2FAB-42a7-BD4F-566CFA528769}!ScenarioExecutionEnabled

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{acfd1ca6-18b6-4ccf-9c07-580cdb6eded4}!ScenarioExecutionEnabled, HK

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{D113E4AA-2D07-41b1-8D9B-C065194A791D}!ScenarioExecutionEnable

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{081D3213-48AA-4533-9284-D98F01BDC8E6}!ScenarioExecutionEnabled

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{affc81e2-612a-4f70-6fb2-916ff5c7e3f8}!ScenarioExecutionEnabled, HKLM

HKLM\SOFTWARE\Policies\Microsoft\PenTraining!DisablePenTraining

HKCU\SOFTWARE\Policies\Microsoft\PenTraining!DisablePenTraining

HKLM\Software\Policies\Microsoft\Windows\Control Panel\Performance Control Panel!UpsellEnabled

HKCU\Software\Policies\Microsoft\Windows\Control Panel\Performance Control Panel!UpsellEnabled

HKLM\Software\Policies\Microsoft\Windows\Control Panel\Performance Control Panel!PerfCplEnabled

HKCU\Software\Policies\Microsoft\Windows\Control Panel\Performance Control Panel!PerfCplEnabled

HKLM\Software\Policies\Microsoft\Windows\Control Panel\Performance Control Panel!SolutionsEnabled

HKCU\Software\Policies\Microsoft\Windows\Control Panel\Performance Control Panel!SolutionsEnabled

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{67144949-5132-4859-8036-a737b43825d8}!ScenarioExecutionEnabled,

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}!ScenarioExecutionEnabled, HKL

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}!ScenarioExecutionEnabled, H

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{2698178D-FDAD-40AE-9D3C-1371703ADC5B}!ScenarioExecutionEnabl

HKLM\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab!ACSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\637EA02F-BBCB-4015-8E2C-A1C7B9C0B546!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\9A66D8D7-4FF7-4EF9-B5A2-5A326CA2A469!DCSettingIndex

HKLM\Software\Policies\Microsoft\Windows NT!DontPowerOffAfterShutdown

HKLM\Software\Policies\Microsoft\Power\PowerSettings\d8742dcb-3e6a-4b3c-b3fe-374623cdcf06!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\8183ba9a-e910-48da-8769-14ae6dc1170a!DCSettingIndex

HKCU\Software\Policies\Microsoft\Windows\System\Power!PromptPasswordOnResume

HKLM\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51!ACSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings!ActivePowerScheme

HKLM\Software\Policies\Microsoft\Power\PowerSettings\5CA83367-6E45-459F-A27B-476B1D01C936!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\5CA83367-6E45-459F-A27B-476B1D01C936!ACSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\7648EFA3-DD9C-4E3E-B566-50F929386280!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\7648EFA3-DD9C-4E3E-B566-50F929386280!ACSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\96996BC0-AD50-47EC-923B-6F41874DD9EB!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\96996BC0-AD50-47EC-923B-6F41874DD9EB!ACSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\A7066653-8D6C-40A8-910E-A1F54B84C7E5!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\A7066653-8D6C-40A8-910E-A1F54B84C7E5!ACSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings!ActivePowerScheme

HKLM\Software\Policies\Microsoft\Power\PowerSettings\9D7815A6-7EE4-497E-8888-515A05F02364!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\9D7815A6-7EE4-497E-8888-515A05F02364!ACSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\29F6C1DB-86DA-48C5-9FDB-F2B67B1F44DA!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\29F6C1DB-86DA-48C5-9FDB-F2B67B1F44DA!ACSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\90959D22-D6A1-49B9-AF93-BCE885AD335B!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\90959D22-D6A1-49B9-AF93-BCE885AD335B!ACSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\94ac6d29-73ce-41a6-809f-6363ba21b47e!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\94ac6d29-73ce-41a6-809f-6363ba21b47e!ACSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\bcded951-187b-4d05-bccc-f7e51960c258!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\3C0BC021-C8A8-4E07-A973-6B14CBCB2B7E!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\3C0BC021-C8A8-4E07-A973-6B14CBCB2B7E!ACSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\6738E2C4-E8A5-4A42-B16A-E040E769756E!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\6738E2C4-E8A5-4A42-B16A-E040E769756E!ACSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\B7A27025-E569-46c2-A504-2B96CAD225A1!DCSettingIndex

HKLM\Software\Policies\Microsoft\Power\PowerSettings\B7A27025-E569-46c2-A504-2B96CAD225A1!ACSettingIndex

HKLM\Software\Policies\Microsoft\PreviousVersions!DisableLocalPage

HKCU\Software\Policies\Microsoft\PreviousVersions!DisableLocalPage

HKLM\Software\Policies\Microsoft\PreviousVersions!DisableRemotePage

HKCU\Software\Policies\Microsoft\PreviousVersions!DisableRemotePage

HKLM\Software\Policies\Microsoft\PreviousVersions!HideBackupEntries

HKCU\Software\Policies\Microsoft\PreviousVersions!HideBackupEntries

HKLM\Software\Policies\Microsoft\PreviousVersions!DisableLocalRestore

HKCU\Software\Policies\Microsoft\PreviousVersions!DisableLocalRestore

HKLM\Software\Policies\Microsoft\PreviousVersions!DisableBackupRestore

HKCU\Software\Policies\Microsoft\PreviousVersions!DisableBackupRestore

HKLM\Software\Policies\Microsoft\PreviousVersions!DisableRemoteRestore

HKCU\Software\Policies\Microsoft\PreviousVersions!DisableRemoteRestore

HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!DomainDisplayPrinters_State, HKLM\Software\Policies\Micros

HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!NonDomainDisplayPrinters_State, HKLM\Software\Policies\Mi

HKLM\Software\Policies\Microsoft\Windows NT\Printers!RegisterSpoolerRemoteRpcEndPoint

HKLM\Software\Policies\Microsoft\Windows NT\Printers!PublishPrinters

HKLM\Software\Policies\Microsoft\Windows NT\Printers!Immortal

HKLM\Software\Policies\Microsoft\Windows NT\Printers!ForceCSREMFDespooling

HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!Auto Publishing

HKCU\Software\Policies\Microsoft\Windows NT\Printers\Wizard!Printers Page URL

HKCU\Software\Policies\Microsoft\Windows NT\Printers\Wizard!Downlevel Browse

HKLM\Software\Policies\Microsoft\Windows NT\Printers!VerifyPublishedState

HKLM\Software\Policies\Microsoft\Windows NT\Printers!PhysicalLocation

HKLM\Software\Policies\Microsoft\Windows NT\Printers!SupportLink

HKCU\Software\Policies\Microsoft\Windows NT\Printers\Wizard!Default Search Scope

HKLM\Software\Policies\Microsoft\Windows NT\Printers!PruningInterval

HKLM\Software\Policies\Microsoft\Windows NT\Printers!PruningPriority

HKLM\Software\Policies\Microsoft\Windows NT\Printers!PruningRetries

HKLM\Software\Policies\Microsoft\Windows NT\Printers!KMPrintersAreBlocked

HKLM\Software\Policies\Microsoft\Windows NT\Printers!PruningRetryLog

HKCU\Software\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint!PackagePointAndPrintOnly

HKCU\Software\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint!PackagePointAndPrintServerList, HKCU\Software

HKCU\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint!Restricted, HKCU\Software\Policies\Microsoft\Windows

HKLM\Software\Policies\Microsoft\Windows NT\Printers!PhysicalLocationSupport

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoAddPrinter

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDeletePrinter

HKLM\Software\Policies\Microsoft\Windows NT\Printers!ServerThread

HKLM\Software\Policies\Microsoft\Windows NT\Printers!PruneDownlevel

HKLM\Software\Policies\Microsoft\Windows NT\Printers!DisableWebPrinting

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Programs!NoGetPrograms

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Programs!NoInstalledUpdates

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Programs!NoProgramsAndFeatures

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Programs!NoDefaultPrograms

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Programs!NoWindowsFeatures

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Programs!NoWindowsMarketplace

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Programs!NoProgramsCPL

HKLM\Software\Policies\Microsoft\Windows\PswdSync!MaxRetries_state, HKLM\Software\Policies\Microsoft\Windows\PswdSy

HKLM\Software\Policies\Microsoft\Windows\PswdSync!UpdateRetryInterval_state, HKLM\Software\Policies\Microsoft\Windows

HKLM\Software\Policies\Microsoft\Windows\PswdSync!LoggingLevel

HKLM\Software\Policies\Microsoft\Windows\PswdSync!SNISPasswordSyncEnable

HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingConforming!ServiceTypeBestEffort

HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingNonConforming!ServiceTypeBestEffort

HKLM\Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping!ServiceTypeBestEffort

HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingConforming!ServiceTypeControlledLoad

HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingNonConforming!ServiceTypeControlledLoad

HKLM\Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping!ServiceTypeControlledLoad

HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingConforming!ServiceTypeGuaranteed

HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingNonConforming!ServiceTypeGuaranteed

HKLM\Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping!ServiceTypeGuaranteed

HKLM\Software\Policies\Microsoft\Windows\Psched!MaxOutstandingSends

HKLM\Software\Policies\Microsoft\Windows\Psched!NonBestEffortLimit

HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingConforming!ServiceTypeNetworkControl

HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingNonConforming!ServiceTypeNetworkControl

HKLM\Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping!ServiceTypeNetworkControl

HKLM\Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping!ServiceTypeNonConforming

HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingConforming!ServiceTypeQualitative

HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingNonConforming!ServiceTypeQualitative

HKLM\Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping!ServiceTypeQualitative

HKLM\Software\Policies\Microsoft\Windows\Psched!TimerResolution

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{739FF6CF-5033-428c-9E2F-582096482DD5}!ScenarioExecutionEnabled

HKLM\Software\Policies\Microsoft\Windows NT\Reliability!SnapShot

HKLM\Software\Policies\Microsoft\Windows NT\Reliability!ShutdownReasonOn, HKLM\Software\Policies\Microsoft\Windows NT

HKLM\Software\Policies\Microsoft\Windows NT\Reliability!TimeStampEnabled, HKLM\Software\Policies\Microsoft\Windows NT\R

HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting!IncludeShutdownErrs

HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!CreateEncryptedOnlyTickets

HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!UseCustomMessages, HKLM\Software\policies\Microsoft\W

HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!fAllowUnsolicited, HKLM\Software\policies\Microsoft\Windows

HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!fAllowToGetHelp, HKLM\Software\policies\Microsoft\Windows

HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!UseBandwidthOptimization, HKLM\Software\policies\Micros

HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!LoggingEnabled

HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices!Deny_All

HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices!Deny_All

HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices!AllowRemoteDASD

HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56308-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read

HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56308-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read

HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56308-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write

HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56308-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write

HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\Custom\Deny_Read!Deny_Read, HKLM\Software\Polic

HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\Custom\Deny_Read!Deny_Read, HKCU\Software\Polic

HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\Custom\Deny_Write!Deny_Write, HKLM\Software\Polic

HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\Custom\Deny_Write!Deny_Write, HKCU\Software\Polic

HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56311-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read

HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56311-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read

HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56311-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write

HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56311-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write

HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read

HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read

HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write

HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write

HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630b-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read

HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630b-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read

HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630b-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write

HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630b-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write

HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices!RebootTimeinSeconds_state, HKLM\Software\Policie

HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices!RebootTimeinSeconds_state, HKCU\Software\Policie

HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{6AC27878-A6FA-4155-BA85-F98F491D4F33}!Deny

HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{6AC27878-A6FA-4155-BA85-F98F491D4F33}!Deny

HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{6AC27878-A6FA-4155-BA85-F98F491D4F33}!Deny_

HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{6AC27878-A6FA-4155-BA85-F98F491D4F33}!Deny_

HKLM\Software\Policies\Microsoft\Windows NT\Rpc\IgnoreDelegationFailure!IgnoreDelegationFailure

HKLM\Software\Policies\Microsoft\Windows NT\Rpc\MinimumConnectionTimeout!MinimumConnectionTimeout

HKLM\Software\Policies\Microsoft\Windows NT\Rpc!ExtErrorInformation, HKLM\Software\Policies\Microsoft\Windows NT\Rpc!E

HKLM\Software\Policies\Microsoft\Windows NT\Rpc!RestrictRemoteClients

HKLM\Software\Policies\Microsoft\Windows NT\Rpc!EnableAuthEpResolution

HKLM\Software\Policies\Microsoft\Windows NT\Rpc!StateInformation

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!Allow-LogonScript-NetbiosDisabled

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!MaxGPOScriptWait

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!HideLegacyLogonScripts

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!HideLogoffScripts

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!RunLogonScriptSync

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!RunLogonScriptSync

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!HideLogonScripts

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!HideShutdownScripts

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!RunStartupScriptSync

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!HideStartupScripts

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search!AllowIndexingEncryptedStoresOrItems

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search!AllowUsingDiacritics

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search!DataDirectory

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search!PreventUsingAdvancedIndexingOptions

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search!PreventIndexingEmailAttachments

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search!PreventIndexingOfflineFiles

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search!PreventIndexingOutlook

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search!PreventIndexingPublicFolders

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search!PreventIndexingUncachedExchangeFolders

HKLM\Software\Policies\Microsoft\Windows NT\Security Center!SecurityCenterInDomain

HKLM\Software\Policies\Microsoft\Windows\Server\ServerManager!RefreshIntervalEnabled, HKLM\Software\Policies\Microsoft

HKLM\Software\Policies\Microsoft\Windows\Server\InitialConfigurationTasks!DoNotOpenAtLogon

HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\MYS!DisableShowAtLogon

HKLM\Software\Policies\Microsoft\Windows\Server\ServerManager!DoNotOpenAtLogon

HKLM\Software\Policies\Microsoft\Windows NT\Setup!SourcePath

HKLM\Software\Policies\Microsoft\Windows NT\Setup!ServicePackSourcePath

HKCU\Software\Policies\Microsoft\Windows NT\SharedFolders!PublishDfsRoots

HKCU\Software\Policies\Microsoft\Windows NT\SharedFolders!PublishSharedFolders

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoInplaceSharing

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisallowRun, HKCU\Software\Microsoft\Windows\CurrentV

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableRegistryTools

HKCU\Software\Policies\Microsoft\Windows\System!DisableCMD

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!RestrictRun, HKCU\Software\Microsoft\Windows\CurrentVe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!RestrictWelcomeCenter

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!TurnOffUnsignedGadgets

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!TurnOffUnsignedGadgets

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!OverrideMoreGadgetsLink

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!OverrideMoreGadgetsLink

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!TurnOffUserInstalledGadgets

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!TurnOffUserInstalledGadgets

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!TurnOffSidebar

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!TurnOffSidebar

HKLM\Software\Policies\Microsoft\Windows\SideShow!DeleteDataOnLogoff

HKCU\Software\Policies\Microsoft\Windows\SideShow!DeleteDataOnLogoff

HKLM\Software\Policies\Microsoft\Windows\SideShow!SetPIN, HKLM\Software\Policies\Microsoft\Windows\SideShow!PIN, HK

HKCU\Software\Policies\Microsoft\Windows\SideShow!SetPIN, HKCU\Software\Policies\Microsoft\Windows\SideShow!PIN, HK

HKLM\Software\Policies\Microsoft\Windows\SideShow!AutoWakeDisabled

HKCU\Software\Policies\Microsoft\Windows\SideShow!AutoWakeDisabled

HKLM\Software\Policies\Microsoft\Windows\SideShow!Disabled

HKCU\Software\Policies\Microsoft\Windows\SideShow!Disabled

HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!AllowCertificatesWithNoEKU

HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!AllowIntegratedUnblock

HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!AllowSignatureOnlyKeys

HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!AllowTimeInvalidCertificates

HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!X509HintsNeeded

HKLM\SOFTWARE\Policies\Microsoft\Windows\CertProp!RootCertificateCleanupOption

HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!IntegratedUnblockPromptString

HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!FilterDuplicateCerts

HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!ForceReadingAllCertificates

HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!DisallowPlaintextPin

HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!ReverseSubject

HKLM\SOFTWARE\Policies\Microsoft\Windows\CertProp!CertPropEnabled

HKLM\SOFTWARE\Policies\Microsoft\Windows\CertProp!EnableRootCertificatePropagation

HKLM\Software\Policies\Microsoft\Windows\Server for NIS!PushInterval_state, HKLM\Software\Policies\Microsoft\Windows\Serv

HKLM\Software\Policies\Microsoft\Windows\Server for NIS!LoggingLevel

HKLM\Software\Policies\SNMP\Parameters\ValidCommunities

HKLM\Software\Policies\SNMP\Parameters\PermittedManagers

HKLM\Software\Policies\SNMP\Parameters\TrapConfiguration\public

HKLM\SOFTWARE\Policies\Microsoft\SoundRecorder!Soundrec

HKCU\SOFTWARE\Policies\Microsoft\SoundRecorder!Soundrec

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!MemCheckBoxInRunDlg

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ForceStartMenuLogOff

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ForceRunOnStartMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ClearRecentDocsOnExit

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ClearRecentProgForNewUserInStartMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoToolbarsOnTaskbar

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoRecentDocsHistory

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSearchCommInStartMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSearchFilesInStartMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSearchInternetInStartMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSearchProgramsInStartMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoResolveSearch

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoResolveTrack

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSimpleStartMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!GreyMSIAds

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoTrayItemsDisplay

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!LockTaskbar

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSetTaskbar

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoTaskGrouping

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoTrayContextMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStartMenuMorePrograms

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoClose

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSMBalloonTip

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!HideClock

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoCommonGroups

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSMConfigurePrograms

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSMMyDocs

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoChangeStartMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoFavoritesMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStartMenuMFUprogramsList

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStartMenuMyGames

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSMHelp

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoWindowsUpdate

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!StartMenuLogOff

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStartMenuMyMusic

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoNetworkConnections

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStartMenuNetworkPlaces

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSMMyPictures

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStartMenuPinnedList

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSetFolders

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoRecentDocsMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoRun

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSearchComputerLinkInStartMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoFind

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStartMenuEjectPC

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoUserFolderInStartMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoUserNameInStartMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStartMenuSubFolders

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!QuickLaunchEnabled

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoAutoTrayNotify

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Intellimenus

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoInstrumentation

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!UseFoldersInStartMenu

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\WSRM!EmailIds

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\WSRM!SMTPServer

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\WSRM!RecordWriteInterval

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\WSRM!AccountingEnabled

HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore!DisableConfig

HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore!DisableSR

HKLM\software\policies\microsoft\TabletTip\1.7!HideIPTIPTarget

HKCU\software\policies\microsoft\TabletTip\1.7!HideIPTIPTarget

HKLM\software\policies\microsoft\TabletTip\1.7!HideIPTIPTouchTarget

HKCU\software\policies\microsoft\TabletTip\1.7!HideIPTIPTouchTarget

HKLM\software\policies\microsoft\TabletTip\1.7!IncludeRareChar

HKCU\software\policies\microsoft\TabletTip\1.7!IncludeRareChar

HKLM\software\policies\microsoft\TabletTip\1.7!DisableEdgeTarget

HKCU\software\policies\microsoft\TabletTip\1.7!DisableEdgeTarget

HKLM\software\policies\microsoft\TabletTip\1.7!PRCGesture

HKCU\software\policies\microsoft\TabletTip\1.7!PRCGesture

HKLM\software\policies\microsoft\TabletTip\1.7!DisableACIntegration

HKCU\software\policies\microsoft\TabletTip\1.7!DisableACIntegration

HKLM\software\policies\microsoft\TabletTip\1.7!PasswordSecurityState, HKLM\software\policies\microsoft\TabletTip\1.7!Passw

HKCU\software\policies\microsoft\TabletTip\1.7!PasswordSecurityState, HKCU\software\policies\microsoft\TabletTip\1.7!Passw

HKLM\software\policies\microsoft\TabletTip\1.7!ScratchOutState, HKLM\software\policies\microsoft\TabletTip\1.7!ScratchOut

HKCU\software\policies\microsoft\TabletTip\1.7!ScratchOutState, HKCU\software\policies\microsoft\TabletTip\1.7!ScratchOut

HKLM\SOFTWARE\Policies\Microsoft\TabletPC!DisableInkball

HKCU\SOFTWARE\Policies\Microsoft\TabletPC!DisableInkball

HKLM\SOFTWARE\Policies\Microsoft\TabletPC!DisableNoteWriterPrinting

HKCU\SOFTWARE\Policies\Microsoft\TabletPC!DisableNoteWriterPrinting

HKLM\SOFTWARE\Policies\Microsoft\TabletPC!DisableSnippingTool

HKCU\SOFTWARE\Policies\Microsoft\TabletPC!DisableSnippingTool

HKLM\SOFTWARE\Policies\Microsoft\TabletPC!DisableStickyNotes

HKCU\SOFTWARE\Policies\Microsoft\TabletPC!DisableStickyNotes

HKLM\SOFTWARE\Policies\Microsoft\TabletPC!DisableJournal

HKCU\SOFTWARE\Policies\Microsoft\TabletPC!DisableJournal

HKLM\SOFTWARE\Policies\Microsoft\TabletPC!PreventButtonBackEscapeMapping

HKCU\SOFTWARE\Policies\Microsoft\TabletPC!PreventButtonBackEscapeMapping

HKLM\SOFTWARE\Policies\Microsoft\TabletPC!PreventFlicks

HKCU\SOFTWARE\Policies\Microsoft\TabletPC!PreventFlicks

HKLM\SOFTWARE\Policies\Microsoft\TabletPC!PreventFlicksLearningMode

HKCU\SOFTWARE\Policies\Microsoft\TabletPC!PreventFlicksLearningMode

HKLM\SOFTWARE\Policies\Microsoft\TabletPC!PreventButtonApplicationLaunch

HKCU\SOFTWARE\Policies\Microsoft\TabletPC!PreventButtonApplicationLaunch

HKLM\SOFTWARE\Policies\Microsoft\TabletPC!PreventButtonPressAndHold

HKCU\SOFTWARE\Policies\Microsoft\TabletPC!PreventButtonPressAndHold

HKLM\SOFTWARE\Policies\Microsoft\TabletPC!TurnOffButtons

HKCU\SOFTWARE\Policies\Microsoft\TabletPC!TurnOffButtons

HKLM\SOFTWARE\Policies\Microsoft\TabletPC!TurnOffPenFeedback

HKCU\SOFTWARE\Policies\Microsoft\TabletPC!TurnOffPenFeedback

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TaskbarLockAll

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TaskbarNoAddRemoveToolbar

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TaskbarNoRedock

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TaskbarNoDragToolbar

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TaskbarNoResize

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!HideSCABattery

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!HideSCANetwork

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!HideSCAVolume

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TaskbarNoNotification

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TaskbarNoThumbnail

HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Disable Advanced

HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Disable Advanced

HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Property Pages

HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Property Pages

HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Execution

HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Execution

HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Allow Browse

HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Allow Browse

HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0!DragAndDrop

HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0!DragAndDrop

HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Task Creation

HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Task Creation

HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Task Deletion

HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Task Deletion

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AllowUnsignedFiles

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AllowUnsignedFiles

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AllowSignedFiles

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AllowSignedFiles

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableCam

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fEnableTimeZoneRedirection

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDenyTSConnections

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fPromptForPassword

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fTurnOffSingleAppMode

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableAutoReconnect

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!KeepAliveEnable, HKLM\SOFTWARE\Policies\Microsoft\W

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AuthenticationLevel

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!SessionDirectoryClusterName

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!SessionDirectoryLocation

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableForcibleLogoff

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableCpm

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableClip

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableCcm

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableCdm

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fWritableTSCCPermTab

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableLPT

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!DisablePasswordSaving

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!DisablePasswordSaving

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fEnableSmartCard

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisablePNPRedir

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!DeleteTempDirsOnExit

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fForceClientLptDef

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!PerSessionTempDir

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!UseProxy, HKCU\SOFTWARE\Policies\Microsoft\Windows

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fNoRemoteDesktopWallpaper

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableTerminalServerTooltip

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!SessionDirectoryActive

HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services!fSecureLicensing

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!ColorDepth

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxInstanceCount

HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services!fPreventLicenseUpgrade

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!PromptForCredsOnClient

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDisconnect

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoNTSecurity

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fEncryptRPCTraffic

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!SecurityLayer

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!UserAuthentication

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fSingleSessionPerUser

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!CertTemplateName

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MinEncryptionLevel

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxCompressionLevel

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!WFProfilePath

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!Shadow

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!Shadow

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!LicensingMode

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxIdleTime

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxIdleTime

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxConnectionTime

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxConnectionTime

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxDisconnectionTime

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxDisconnectionTime

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AllowExplicitLogonMethod, HKCU\SOFTWARE\Policies\M

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AllowExplicitProxyName, HKCU\SOFTWARE\Policies\Mi

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!WFHomeDirUNC, HKLM\SOFTWARE\Policies\Microsoft\

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!TrustedCertThumbprints

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!TrustedCertThumbprints

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fPolicyFallbackPrintDriver, HKLM\SOFTWARE\Policies\Mi

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!InitialProgram, HKLM\SOFTWARE\Policies\Microsoft\Win

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fInheritInitialProgram, HKCU\SOFTWARE\Policies\Micros

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fResetBroken

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fResetBroken

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!SessionDirectoryExposeServerIP

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!WFDontAppendUserNameToProfile

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!LicenseServers

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fAllowUnlistedRemotePrograms

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fEnableTimeZoneRedirection

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fTurnOffSingleAppMode

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableClip

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!RedirectOnlyDefaultClientPrinter

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!RedirectOnlyDefaultClientPrinter

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fNoRemoteDesktopWallpaper

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!RemoteAppLogoffTimeLimit

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!RemoteAppLogoffTimeLimit

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!UseUniversalPrinterDriverFirst

HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!UseUniversalPrinterDriverFirst

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!ParticipateInLoadBalancing

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisableThumbsDBOnNetworkFolders

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisableThumbnailsOnNetworkFolders

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisableThumbnails

HKLM\SOFTWARE\Policies\Microsoft\TabletPC!TurnOffTouchInput

HKCU\SOFTWARE\Policies\Microsoft\TabletPC!TurnOffTouchInput

HKLM\SOFTWARE\Policies\Microsoft\Tpm\BlockedCommands!Enabled, HKLM\SOFTWARE\Policies\Microsoft\Tpm\BlockedC

HKLM\Software\Policies\Microsoft\TPM\BlockedCommands!IgnoreDefaultList

HKLM\Software\Policies\Microsoft\TPM\BlockedCommands!IgnoreLocalList

HKLM\Software\Policies\Microsoft\TPM!ActiveDirectoryBackup, HKLM\Software\Policies\Microsoft\TPM!RequireActiveDirector

HKLM\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupToDisk

HKCU\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupToDisk

HKLM\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupToNetwork

HKCU\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupToNetwork

HKLM\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupToOptical

HKCU\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupToOptical

HKLM\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupLauncher

HKCU\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupLauncher

HKLM\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupUI

HKCU\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupUI

HKLM\Software\Policies\Microsoft\Windows\Backup\Client!DisableSystemBackupUI

HKCU\Software\Policies\Microsoft\Windows\Backup\Client!DisableSystemBackupUI

HKLM\Software\Policies\Microsoft\Windows\Backup\Client!DisableRestoreUI

HKCU\Software\Policies\Microsoft\Windows\Backup\Client!DisableRestoreUI

HKLM\Software\Policies\Microsoft\Windows\System!AddAdminGroupToRUP

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!ConnectHomeDirToRoot

HKLM\Software\Policies\Microsoft\Windows\System!DeleteRoamingCache

HKLM\Software\Policies\Microsoft\Windows\System!CleanupProfiles

HKLM\Software\Policies\Microsoft\Windows\System!CompatibleRUPSecurity

HKLM\Software\Policies\Microsoft\Windows\System!SlowLinkDetectEnabled

HKLM\Software\Policies\Microsoft\Windows\System!DisableForceUnload

HKLM\Software\Policies\Microsoft\Windows\System!ProfileErrorAction

HKCU\Software\Policies\Microsoft\Windows\System!ExcludeProfileDirs

HKLM\Software\Policies\Microsoft\Windows\System!LeaveAppMgmtData

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!EnableProfileQuota, HKCU\Software\Microsoft\Windows\Cu

HKLM\Software\Policies\Microsoft\Windows\System!ProfileUnloadTimeout

HKCU\Software\Policies\Microsoft\Windows\System!CscSuspendDirs

HKLM\Software\Policies\Microsoft\Windows\System!LocalProfile

HKLM\Software\Policies\Microsoft\Windows\System!ReadOnlyProfile

HKLM\Software\Policies\Microsoft\Windows\System!SlowLinkUIEnabled

HKLM\Software\Policies\Microsoft\Windows\System!WaitForNetwork

HKLM\Software\Policies\Microsoft\Windows\System!MachineProfilePath

HKLM\Software\Policies\Microsoft\Windows\System!UserProfileMinTransferRate, HKLM\Software\Policies\Microsoft\Windows

HKLM\Software\Policies\Microsoft\Windows\System!ProfileDlgTimeOut

HKLM\Software\Policies\Microsoft\Windows\System!SlowLinkProfileDefault

HKLM\SOFTWARE\Policies\Microsoft\FVE!EncryptionMethod

HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!Enabled, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValid

HKLM\SOFTWARE\Policies\Microsoft\FVE!DefaultRecoveryFolderPath

HKLM\SOFTWARE\Policies\Microsoft\FVE!UseRecoveryPassword, HKLM\SOFTWARE\Policies\Microsoft\FVE!UseRecoveryDr

HKLM\SOFTWARE\Policies\Microsoft\FVE!EnableNonTPM, HKLM\SOFTWARE\Policies\Microsoft\FVE!UsePartialEncryptionK

HKLM\Software\Policies\Microsoft\FVE!MorBehavior

HKLM\Software\Policies\Microsoft\FVE!ActiveDirectoryBackup, HKLM\Software\Policies\Microsoft\FVE!RequireActiveDirectoryB

HKLM\Software\Policies\Microsoft\W32time\Parameters!NtpServer, HKLM\Software\Policies\Microsoft\W32time\Parameters!Typ

HKLM\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient!Enabled

HKLM\Software\Policies\Microsoft\W32Time\TimeProviders\NtpServer!Enabled

HKLM\Software\Policies\Microsoft\W32Time\Config!FrequencyCorrectRate, HKLM\Software\Policies\Microsoft\W32Time\Config

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Window

HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI!DataRetentionBySizeEnabled, HKLM\SOFTWARE\Policies\Microsoft\Wind

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Windows!TurnOffWinCal

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Windows!TurnOffWinCal

HKLM\Software\Policies\Microsoft\Windows\Backup\Server!OnlySystemBackup

HKLM\Software\Policies\Microsoft\Windows\Backup\Server!NoBackupToDisk

HKLM\Software\Policies\Microsoft\Windows\Backup\Server!NoBackupToNetwork

HKLM\Software\Policies\Microsoft\Windows\Backup\Server!NoBackupToOptical

HKLM\Software\Policies\Microsoft\Windows\Backup\Server!NoRunNowBackup

HKLM\Software\Policies\Microsoft\Windows\Windows Collaboration!TurnOffWindowsCollaboration

HKCU\Software\Policies\Microsoft\Windows\Windows Collaboration!TurnOffWindowsCollaboration

HKLM\Software\Policies\Microsoft\Windows\Windows Collaboration!TurnOnWindowsCollaborationAuditing

HKCU\Software\Policies\Microsoft\Windows\Windows Collaboration!TurnOnWindowsCollaborationAuditing

HKLM\Software\Policies\Microsoft\Windows\WindowsColorSystem!ProhibitInstallUninstall

HKCU\Software\Policies\Microsoft\Windows\WindowsColorSystem!ProhibitInstallUninstall

HKLM\Software\Policies\Microsoft\Windows\WCN\Registrars!EnableRegistrars, HKLM\Software\Policies\Microsoft\Windows\

HKLM\Software\Policies\Microsoft\Windows\WCN\UI!DisableWcnUi

HKCU\Software\Policies\Microsoft\Windows\WCN\UI!DisableWcnUi

HKLM\Software\Policies\Microsoft\Windows Defender\Scan!CheckForSignaturesBeforeRunningScan

HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet!SpyNetReporting, HKLM\Software\Policies\Microsoft\Windows D

HKLM\Software\Policies\Microsoft\Windows Defender\Signature Updates!ForceFullUpdate

HKLM\Software\Policies\Microsoft\Windows Defender\Reporting!DisableLoggingForKnownGood

HKLM\Software\Policies\Microsoft\Windows Defender\Reporting!DisableLoggingForUnknown

HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection!EnableUnknownPrompts

HKLM\Software\Policies\Microsoft\Windows Defender!DisableAntiSpyware

HKLM\Software\Policies\Microsoft\Windows Defender\Signature Updates!CheckAlternateDownloadLocation

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!EnforceShellExtensionSecurity

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ConfirmFileDelete

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoRecycleFiles

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoRunasInstallPrompt

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!LinkResolveIgnoreLinkInfo

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32!NoBackButton

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32!NoPlacesBar

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32!NoFileMru

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDrives

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoManageMyComputerVerb

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\comdlg32\Placesbar!Place0, HKCU\Software\Microsoft\Windows\Cu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!RecycleBinSize

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!MaxRecentDocs

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoComputersNearMe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Network!NoEntireNetwork

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoViewOnDrive

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoNetConnectDisconnect

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoCDBurning

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDFSTab

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoFileMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoHardwareTab

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoShellSearchButton

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSecurityTab

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSharedDocuments

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoChangeKeyboardNavigationIndicators

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoChangeAnimation

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoViewContextMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoFolderOptions

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!PromptRunasInstallNetPath

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoThumbnailCache

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!PreXPSP2ShellProtocolBehavior

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!PreXPSP2ShellProtocolBehavior

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoWinKeys

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ClassicShell

HKLM\Software\Policies\Microsoft\Windows NT\Windows File Protection!SfcShowProgress

HKLM\Software\Policies\Microsoft\Windows NT\Windows File Protection!SfcQuota

HKLM\Software\Policies\Microsoft\Windows NT\Windows File Protection!SfcScan

HKLM\Software\Policies\Microsoft\Windows NT\Windows File Protection!SFCDllCacheDir

HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\ICFv4!BypassFirewall

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\IcmpSettings!AllowOutboundDestinationUnreachable,

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings!AllowOutboundDestinationUnreachable,

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\FileAndPrint!Enabled, HKLM\SOFTWARE\Policie

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\Services\FileAndPrint!Enabled, HKLM\SOFTWARE\Polici

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\RemoteAdminSettings!Enabled, HKLM\SOFTWARE\Polici

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\RemoteAdminSettings!Enabled, HKLM\SOFTWARE\Polic

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\RemoteDesktop!Enabled, HKLM\SOFTWARE\Pol

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\Services\RemoteDesktop!Enabled, HKLM\SOFTWARE\Po

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\UPnPFramework!Enabled, HKLM\SOFTWARE\Po

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\Services\UPnPFramework!Enabled, HKLM\SOFTWARE\P

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts!AllowUserPrefMerge

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\GloballyOpenPorts!AllowUserPrefMerge

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications!AllowUserPrefMerge

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\AuthorizedApplications!AllowUserPrefMerge

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging!LogDroppedPackets, HKLM\SOFTWARE\Policies\M

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\Logging!LogDroppedPackets, HKLM\SOFTWARE\Policies\

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts!Enabled, HKLM\SOFTWARE\Policies\M

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\GloballyOpenPorts!Enabled, HKLM\SOFTWARE\Policies\

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications!Enabled, HKLM\SOFTWARE\Policie

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\AuthorizedApplications!Enabled, HKLM\SOFTWARE\Polici

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile!DoNotAllowExceptions

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile!DoNotAllowExceptions

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile!DisableNotifications

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile!DisableNotifications

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile!DisableUnicastResponsesToMulticastBroadcast

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile!DisableUnicastResponsesToMulticastBroadcast

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile!EnableFirewall

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile!EnableFirewall

HKLM\SOFTWARE\Policies\Microsoft\Windows Mail!DisableCommunities

HKCU\SOFTWARE\Policies\Microsoft\Windows Mail!DisableCommunities

HKLM\SOFTWARE\Policies\Microsoft\Windows Mail!ManualLaunchAllowed

HKCU\SOFTWARE\Policies\Microsoft\Windows Mail!ManualLaunchAllowed

HKLM\Software\Policies\Microsoft\WMDRM!DisableOnline

HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!EnableScreenSaver

HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\HTTP!ProxyPolicy, HKCU\Software\Policies\Microsoft\Win

HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\MMS!ProxyPolicy, HKCU\Software\Policies\Microsoft\Win

HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!NetworkBufferingPolicy, HKCU\Software\Policies\Microsoft\WindowsM

HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\RTSP!ProxyPolicy, HKCU\Software\Policies\Microsoft\Wi

HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!DoNotShowAnchor

HKLM\Software\Policies\Microsoft\WindowsMediaPlayer!GroupPrivacyAcceptance

HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!HideNetworkTab

HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!HidePrivacyTab

HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!HideSecurityTab

HKLM\Software\Policies\Microsoft\WindowsMediaPlayer!DisableAutoUpdate

HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!PreventCDDVDMetadataRetrieval

HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!PreventCodecDownload

HKLM\Software\Policies\Microsoft\WindowsMediaPlayer!DesktopShortcut

HKLM\Software\Policies\Microsoft\WindowsMediaPlayer!PreventLibrarySharing

HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!PreventMusicFileMetadataRetrieval

HKLM\Software\Policies\Microsoft\WindowsMediaPlayer!QuickLaunchShortcut

HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!PreventRadioPresetsRetrieval

HKLM\Software\Policies\Microsoft\WindowsMediaPlayer!DontUseFrameInterpolation

HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!SetAndLockSkin, HKCU\Software\Policies\Microsoft\WindowsMediaPla

HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols!WindowsMediaStreamingProtocols, HKCU\Software\Policies

HKLM\Software\Policies\Microsoft\Messenger\Client!PreventRun

HKCU\Software\Policies\Microsoft\Messenger\Client!PreventRun

HKLM\Software\Policies\Microsoft\Messenger\Client!PreventAutoRun

HKCU\Software\Policies\Microsoft\Messenger\Client!PreventAutoRun

HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!AllowAutoConfig, HKLM\Software\Policies\Microsoft\Windows\WinRM

HKLM\Software\Policies\Microsoft\Windows\WinRM\Client!AllowBasic

HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!AllowBasic

HKLM\Software\Policies\Microsoft\Windows\WinRM\Client!AllowUnencryptedTraffic

HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!AllowUnencryptedTraffic

HKLM\Software\Policies\Microsoft\Windows\WinRM\Client!AllowDigest

HKLM\Software\Policies\Microsoft\Windows\WinRM\Client!AllowKerberos

HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!AllowKerberos

HKLM\Software\Policies\Microsoft\Windows\WinRM\Client!AllowNegotiate

HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!AllowNegotiate

HKLM\Software\Policies\Microsoft\Windows\WinRM\Client!TrustedHosts, HKLM\Software\Policies\Microsoft\Windows\WinRM\Cl

HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS!AllowRemoteShellAccess

HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS!MaxConcurrentUsers

HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS!IdleTimeout, HKLM\

HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS!MaxMemoryPerShellMB

HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS!MaxProcessesPerShell

HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS!MaxShellsPerUser

HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS!ShellTimeOut

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!AutoInstallMinorUpdates

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate!ElevateNonAdmins

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate!AcceptTrustedPublisherCerts

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!DetectionFrequencyEnabled, HKLM\Software\Policies\Micro

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!NoAutoUpdate, HKLM\Software\Policies\Microsoft\Windows\W

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!RebootWarningTimeoutEnabled, HKLM\Software\Policies\Mi

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!NoAUAsDefaultShutdownOption

HKCU\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!NoAUAsDefaultShutdownOption

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!NoAUShutdownOption

HKCU\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!NoAUShutdownOption

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate!TargetGroupEnabled, HKLM\Software\Policies\Microsoft\Windo

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!AUPowerManagement

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!NoAutoRebootWithLoggedOnUsers

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate!DisableWindowsUpdateAccess

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!RebootRelaunchTimeoutEnabled, HKLM\Software\Policies\M

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!RescheduleWaitTimeEnabled, HKLM\Software\Policies\Micr

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!UseWUServer

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!IncludeRecommendedUpdates

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoAutoUpdate

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!ShutdownSessionTimeout

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableShutdownNamedPipe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!Shell

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!SoftwareSASGeneration

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisplayLastLogonInfo

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!DontDisplayLogonHoursWarnings

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!ReportControllerMissing

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!ReportControllerMissing

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!LogonHoursAction

HKLM\Software\Policies\Microsoft\Windows\System!AllowBlockingAppsAtShutdown

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\SearchExtensions!InternetExtensionName, HKCU\Software\

Requirements

At least Windows Vista

Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only












At least Microsoft Windows Server 2003

At least Microsoft Windows XP Professional with SP1 or Windows Server 2003 family






At least Microsoft Windows XP Professional with SP2












At least Microsoft Windows 2000








Windows XP SP2 or Windows Server 2003 SP1, or computers with BITS 2.0 installed.






Windows XP or Windows Server 2003, or computers with BITS 1.5 installed.








at least Windows NetMeeting v3.0


































At least Microsoft Windows XP Professional or Windows Server 2003 family









At least Microsoft Windows 2000 Service Pack 1







































Microsoft Windows 2000 only



















Microsoft Windows Server 2003 and Windows XP operating systems only
























Windows Codename Longhorn Server with Desktop Experience installed or Windows Vista

Windows Codename Longhorn Server with Desktop Experience installed or Windows Vista













Microsoft Windows XP Professional only




























Microsoft Windows Server 2003 and Windows XP only



























































At least Internet Explorer 6 Service Pack 1












At least Microsoft Windows 2000 Service Pack 3, Microsoft Windows XP Professional Service Pack 1 or Microsoft Windows Ser

At least Microsoft Windows XP Professional with SP2 or Windows Server 2003 family with SP1

























Microsoft Windows Server 2003 only

At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1




















At least Internet Explorer 7.0














































Only Internet Explorer 6.0 in Windows 2003 Service Pack 1




































































At least Internet Explorer 6.0 in Windows 2003 Service Pack 1











































At least Internet Explorer 6.0 in Windows 2003 Service Pack 1. Not supported on Windows Vista

At least Internet Explorer 6.0 in Windows 2003 Service Pack 1. Not supported on Windows Vista






Only Internet Explorer 6.0










Only Internet Explorer 5.0 and Internet Explorer 6.0










At least Internet Explorer 5.0. Not supported on Windows Vista










































































At least Internet Explorer 7.0 in Windows Vista


























































At least Microsoft Windows Server 2003 R2




























Windows Installer v3.0



















Microsoft Windows XP or Windows 2000 with Windows Installer v2.0








































Microsoft Windows Server 2003, Windows XP, and Windows 2000 Service Pack 1 operating systems only



















Microsoft Windows XP Professional with SP2 and Windows Server 2003 family only




























Windows 2000 or later, running IIS. Not supported on Windows Server 2003























































































At least Microsoft Windows Vista, or an earlier version with Windows Search

























At least Microsoft Windows 2000 Service Pack 3 or Microsoft Windows XP Professional Service Pack 1





















Microsoft Windows Server 2003 and Windows XP operating systems only













































































At least Windows Vista with Service Pack 1








At least Microsoft Windows Server 2003 with SP1




At least Microsoft Windows Server 2003, Enterprise Edition


Windows XP Professional or Windows Server 2003 family only























At least Microsoft Windows 2000 Terminal Services

At least Microsoft Windows 2000 Terminal Services























Microsoft Windows Server 2003 with Service Pack 1 only






At least Microsoft Windows Server 2003 with Service Pack 2














Windows Vista Service Pack 1





























































































Windows Media Player 9 Series and later.

Windows Media Player for Windows XP and later.













Windows Media Player 11 for Windows XP or Windows Media Player 11 for Windows Vista or later.












Explain TextThe ActiveX Installer Service is the solution to delegate the install of per-machine ActiveX controls to a Standard User in the ent

Prevents users from using Add or Remove Programs to configure installed services.\n\n\nThis setting removes the "Set up serv

Removes the Add New Programs button from the Add or Remove Programs bar. As a result, users cannot view or change the attache

Removes the Add/Remove Windows Components button from the Add or Remove Programs bar. As a result, users cannot view or ch

Removes the Change or Remove Programs button from the Add or Remove Programs bar. As a result, users cannot view or change th

Removes the "Add a program from CD-ROM or floppy disk" section from the Add New Programs page. This prevents users from using

Removes the "Add programs from Microsoft" section from the Add New Programs page. This setting prevents users from using Add

Prevents users from viewing or installing published programs.\n\n\nThis setting removes the "Add programs from your network" sec

Removes the Set Program Access and Defaults button from the Add or Remove Programs bar. As a result, users cannot view or ch

Prevents users from using Add or Remove Programs.\n\n\nThis setting removes Add or Remove Programs from Control Panel and re

Removes links to the Support Info dialog box from programs on the Change or Remove Programs page.\n\n\nPrograms listed on the C

Specifies the category of programs that appears when users open the "Add New Programs" page.\n\n\nIf you enable this setting,

This policy setting prevents a Federation Service in Active Directory Federation Services (AD FS) from being installed or run.\n\n

Specifies whether to prevent the MS-DOS subsystem (ntvdm.exe) from running on this computer. This setting affects the launching

Specifies whether to prevent the MS-DOS subsystem (ntvdm.exe) from running for all users. This setting affects the launching of

This policy controls the visibility of the Program Compatibility property page shell extension. This shell extension is visible on

This policy controls the state of the application compatibility engine in the system.\n\n\nThe engine is part of the loader and lo

This policy controls the state of the Program Compatibility Assistant in the system.\n \nThe PCA monitors user initiated pr

This policy controls the state of the Program Compatibility Assistant in the system.\n \nThe PCA monitors user initiated pr

This policy controls the state of the Program Compatibility Wizard.\n\n\nWhen enabled, this policy disables the start page of the w

This policy setting allows you to manage the default risk level for file types. To fully customize the risk level for file attachments

This policy setting allows you to manage whether Windows marks file attachments with information about their zone of origin (i.e.

This policy setting allows you to manage whether users can manually remove the zone information from saved file attachments by

This policy setting allows you to configure the list of high risk file types. If the file attachment is in the list of high risk file ty

This policy setting allows you to configure the list of low risk file types. If the attachment is in the list of low risk file types, W

This policy setting allows you to configure the list of moderate risk file types. If the attachment is in the list of moderate risk fi

This policy setting allows you to manage the behavior for notifying registered antivirus programs. If multiple programs are regis

This policy setting allows you to configure the logic that Windows uses to determine the risk for file attachments.\n\n\nPreferring

Sets the default behavior for Autorun commands.\n\n\nAutorun commands are generally stored in autorun.inf files. They often l

Sets the default behavior for Autorun commands.\n\n\nAutorun commands are generally stored in autorun.inf files. They often l

If this policy is enabled, the "Always do this..." checkbox in Autoplay dialog will not be set by default when the dialog is shown.

If this policy is enabled, the "Always do this..." checkbox in Autoplay dialog will not be set by default when the dialog is shown.

Turns off the Autoplay feature.\n\n\nAutoplay begins reading from a drive as soon as you insert media in the drive. As a result,

Turns off the Autoplay feature.\n\n\nAutoplay begins reading from a drive as soon as you insert media in the drive. As a result,

This setting determines if the BITS Peer-caching feature is enabled on a specific computer. By default, the files in a BITS job ar

This setting specifies whether the computer will act as a BITS peercaching client. By default, when BITS peercaching is enabled, t

This setting specifies whether the computer will act as a BITS peercaching server. By default, when BITS peercaching is enabled, t

This setting specifies the maximum age of files in the Peercache. In order to make the most efficient use of disk space, by defau

This setting specifies the maximum amount of disk space that can be used for the BITS Peercache, as a percentage of the total sys

This setting limits the amount of time that BITS will take to download the files in a BITS job.\nThe time limit applies only to t

This setting limits the network bandwidth that BITS uses for background transfers (this setting does not affect foreground transfer

This setting limits the network bandwidth that BITS uses for peercache transfers (this setting does not affect transfers from t

This setting specifies the maximum number of BITS jobs that can be created by a user. By default, BITS limits the total number of

This setting specifies the maximum number of BITS jobs that can be created for all users of the computer. By default, BITS limits

This setting specifies the maximum number of files that a BITS job can contain. By default, a BITS job is limited to 200 files. Yo

This setting specifies the maximum number of ranges that can be added to a file in a BITS job. By default, files in a BITS job are

This setting specifies the number of days a pending BITS job can remain inactive before the job is considered abandoned. By defau

Specifies whether Import Video can run.\n\n\nImport Video is a feature of Windows Vista that can be used to import video from a d

Specifies whether Import Video can run.\n\n\nImport Video is a feature of Windows Vista that can be used to import video from a d

If you enable this setting all Customer Experience Improvement Program uploads are redirected to Microsoft Operations Manager s

This policy setting will enable tagging of Windows Customer Experience Improvement data when a study is being conducted.\n\n\nIf

Determines the cipher suites used by the Secure Socket Layer (SSL).\n\n\nIf this setting is enabled, SSL cipher

Directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires.\n\n\

Directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires.\n\n\

Make the automatic acceptance of incoming calls persistent.

Disables the application sharing feature of NetMeeting completely. Users will not be able to host or view shared applications.

Disables the audio feature of NetMeeting. Users will not be able to send or receive audio.

Disables the Chat feature of NetMeeting.

Disables the directory feature of NetMeeting.\n\n\nUsers will not logon to a directory (ILS) server when NetMeeting starts. User

Disables full duplex mode audio. Users will not be able to listen to incoming audio while speaking into the microphone. Older

Disables the 2.x whiteboard feature of NetMeeting.\n\n\nThe 2.x whiteboard is available for compatibility with older versions of

Disables the remote desktop sharing feature of NetMeeting. Users will not be able to set it up or use it for controlling their com

Disables the Advanced Calling button on the General Options page. Users will not then be able to change the call placement m

Disables the T.126 whiteboard feature of NetMeeting.

Configures NetMeeting to download settings for users each time it starts.\n\n\nThe settings are downloaded from the URL listed

Hides the Audio page of the Tools Options dialog. Users will not then be able to change audio settings.

Hides the General page of the Tools Options dialog. Users will not then be able to change personal identification and bandwidth

Hides the Security page of the Tools Options dialog. Users will not then be able to change call security and authentication setti

Hides the Video page of the Tools Options dialog. Users will not then be able to change video settings.

Limits the bandwidth audio and video will consume when in a conference. This setting will guide NetMeeting to choose the right

Limits the size of files users can send to others in a conference.

Prevents users from adding directory (ILS) servers to the list of those they can use for placing calls.

Prevents users from sharing applications in true color. True color sharing uses more bandwidth in a conference.

Prevents users from turning on automatic acceptance of incoming calls.\n\n\nThis ensures that others cannot call and connect

Prevents users from changing the way calls are placed, either directly or via a gatekeeper server.

Prevents user from changing the DirectSound audio setting. DirectSound provides much better audio quality, but older audio ha

Prevents users from allowing others in a conference to control what they have shared. This enforces a read-only mode; the othe

Prevents users from sharing the whole desktop. They will still be able to share individual applications.

Prevents users from receiving files from others in a conference.

Prevents users from receiving video. Users will still be able to send video provided they have the hardware."

Prevents users from sending files to others in a conference.

Prevents users from sending video if they have the hardware. Users will still be able to receive video from others.

Prevents users from sharing anything themselves. They will still be able to view shared applications/desktops from others.

Prevents users from sharing command prompts. This prevents users from inadvertently sharing out applications, since comman

Prevents users from sharing Explorer windows. This prevents users from inadvertently sharing out applications, since Explorer

Prevents users from viewing directories as Web pages in a browser.

Sets the level of security for both outgoing and incoming NetMeeting calls.

Sets the URL NetMeeting will display when the user chooses the Help Online Support command.

This setting affects the visual style and presentation of the Control Panel.\n\n\nIt allows you to disable the new categorized Co

Hides specified Control Panel items.\n\n\nThis setting removes Control Panel items (such as "Mouse", "System" or "Programs and

Disables all Control Panel programs.\n\n\nThis setting prevents Control.exe, the program file for Control Panel, from starting.

Hides all Control Panel items and folders except those specified in this setting.\n\n\nThis setting removes all Control Panel it

Removes the Appearance and Themes tabs from Display in Control Panel.\n\n\nWhen this setting is enabled, it removes the deskto

Removes the Desktop tab from Display in Control Panel.\n\n\nThis setting prevents users from using Control Panel to change th

Removes the Screen Saver tab from Display in Control Panel.\n\n\nThis setting prevents users from using Control Panel to add,

Removes the Settings tab from Display in Control Panel.\n\n\nThis setting prevents users from using Control Panel to add, confi

This setting allows you to load a specific visual style file by entering the path (location) of the visual style file.\n\n\nThis can

Determines whether screen savers used on the computer are password protected.\n\n\nIf you enable this setting, all screen saver

Prevents users from adding or changing the background design of the desktop.\n\n\nBy default, users can use the Desktop tab of

Prevents users from changing the visual style of the windows and buttons displayed on their screens. When enabled, this settin

Prevents users from changing the size of the font in the windows and buttons displayed on their screens.\n\n\nIf this setting is e

This setting forces the theme color to be the default color scheme.\n\n\nIf you enable this setting, a user cannot change the co

Disables Display in Control Panel.\n\n\nIf you enable this setting, Display in Control Panel does not run. When users try to s

This setting effects the Themes tab that controls the overall appearance of windows.\n\n\nIt is accessed through the Display icon

Enables desktop screen savers.\n\n\nIf you disable this setting, screen savers do not run. Also, this setting disables the Screen

Specifies the screen saver for the user's desktop.\n\n\nIf you enable this setting, the system displays the specified screen saver o

Specifies how much user idle time must elapse before the screen saver is launched.\n\n\nWhen configured, this idle time can be se

This policy setting allows an administrator to standardize the logon pictures for all users on a system to the default user pictu

This policy setting specifies a default logon domain which may be a different domain than the machine joined domain. Without thi

This policy setting allows the administrator to exclude the specified\ncredential providers from use during authentication.\n\n\nNo

This policy setting applies to applications using the Cred SSP component (for example: Terminal Server).\n\n\nIf you enable t



This policy setting applies to applications using the Cred SSP component (for example: Terminal Server).\n\n\nIf you enable





This policy setting applies to applications using the Cred SSP component (for example: Terminal Server).\n\n\nIf you enable

By default administrator accounts are not displayed when attempting to elevate a running application. \n\n\nIf you enable this po

This policy setting requires the user to enter Microsoft Windows credentials using a trusted path, to prevent a Trojan horse or o

Prevents users from changing their Windows password on demand.\n\n\nThis setting disables the "Change Password" button on

Prevents users from locking the system.\n\n\nWhile locked, the desktop is hidden and the system cannot be used. Only the user

This setting disables or removes all menu items and buttons that log the user off the system.\n\n\nAlso, see the "Remove Logoff

Prevents users from starting Task Manager (Taskmgr.exe).\n\n\nIf this setting is enabled and users try to start Task Manager,

Allows you to specify that local computer administrators can supplement the "Define Activation Security Check exemptions" list.\n\n

Allows you to view and change a list of DCOM server application ids (appids) which are exempted from the DCOM Activation securit

Adds and deletes specified Web content items.\n\n\nYou can use the "Add" box in this setting to add particular Web-based items or

Permits only bitmap images for wallpaper. This setting limits the desktop background ("wallpaper") to bitmap (.bmp) files. If

Specifies the desktop background ("wallpaper") displayed on all users' desktops.\n\n\nThis setting lets you specify the wallpaper

Disables Active Desktop and prevents users from enabling it.\n\n\nThis setting prevents users from trying to enable or disable Ac

Removes Active Desktop content and prevents users from adding Active Desktop content. \n\n\nThis setting removes all Active De

Remote shared folders are not added to Network Locations whenever you open a document in the shared folder.\n\n\nIf you disabl

Prevents users from saving certain changes to the desktop.\n\n\nIf you enable this setting, users can change the desktop, but

Enables Active Desktop and prevents users from disabling it.\n\n\nThis setting prevents users from trying to enable or disable Ac

Displays the filter bar above the results of an Active Directory search. The filter bar consists of buttons for applying additional f

Hides the Active Directory folder in Network Locations.\n\n\nThe Active Directory folder displays Active Directory objects in a bro

Removes icons, shortcuts, and other default and user-defined items from the desktop, including Briefcase, Recycle Bin, Compu

Removes the Internet Explorer icon from the desktop and from the Quick Launch bar on the taskbar.\n\n\nThis setting does not p

Removes the Network Locations icon from the desktop.\n\n\nThis setting only affects the desktop icon. It does not prevent users

Specifies the maximum number of objects the system displays in response to a command to browse or search Active Directory. This

Prevents users from manipulating desktop toolbars.\n\n\nIf you enable this setting, users cannot add or remove toolbars from the d

Prevents users from adding Web content to their Active Desktop.\n\n\nThis setting removes the "New" button from Web tab in Disp

Prevents users from adjusting the length of desktop toolbars. Also, users cannot reposition items or toolbars on docked toolbars.

Prevents the user from enabling or disabling Active Desktop or changing the Active Desktop configuration.\n\n\nThis is a compreh

Prevents users from removing Web content from their Active Desktop.\n\n\nIn Active Desktop, you can add items to the desktop b

Prevents users from deleting Web content from their Active Desktop.\n\n\nThis setting removes the Delete button from the Web tab

Prevents users from changing the properties of Web content items on their Active Desktop.\n\n\nThis setting disables the Propert

Prevents users from changing the path to their profile folders.\n\n\nBy default, a user can change the location of their individual

This setting hides Computer from the desktop and from the new Start menu. It also hides links to Computer in the Web view of all

Removes most occurrences of the My Documents icon.\n\n\nThis setting removes the My Documents icon from the desktop, from W

This setting hides Properties on the context menu for Computer.\n\n\nIf you enable this setting, the Properties option will not b

This setting hides Properties for the context menu on the Documents icon.\n\n\nNote: In operating systems earlier than Microsoft

Removes the Properties option from the Recycle Bin context menu.\n\n\nIf you enable this setting, the Properties option will not

Removes most occurrences of the Recycle Bin icon.\n\n\nThis setting removes the Recycle Bin icon from the desktop, from Windo

Prevents users from using the Desktop Cleanup Wizard.\n\n\nIf you enable this setting, the Desktop Cleanup wizard does not auto

Allows members of the Administrators group to install and update the drivers for any device, regardless of other policy settings.\n\

Specifies a list of Plug and Play hardware IDs and compatible IDs that describe devices that can be installed.\n\n\nThis setting is

Specifies a list of device setup class GUIDs describing devices that can be installed.\n\n\nThis setting is intended to be used only

Specifies a list of device setup class GUIDs describing device drivers that non-administrator members of the built-in Users grou

Specifies whether or not remote access to the Plug and Play interface is allowed. \n \nIf you enable this setting, remote connectio

Determines how the system responds when a user tries to install device driver files that are not digitally signed.\n\n\nThis settin

Specifies the number of seconds the system will wait for a device installation task to complete. If the task is not complete within

This setting configures the location that Windows searches for drivers when a new piece of hardware is found.\n\n\nBy default

Specifies a custom message that is displayed to the user in the text of the notification balloon when policy prevents the installat

Specifies a custom message that is displayed to the user in the title of the notification balloon when policy prevents the installati

Specifies whether or not a system restore point is created when a new device driver is installed on your machine.\n\n\nIf you enabl

Specifies whether or not to send a Windows Error Report when a generic driver is installed on a device.\n\n\nIf you enable this set

This setting controls the installation policy for devices that are not specifically described by any other policy.\n\n\nIf you enable

Specifies a list of Plug and Play hardware IDs and compatible IDs for devices that cannot be installed.\n\n\nIf you enable this sett

Specifies a list of Plug and Play device setup class GUIDs for devices that cannot be installed.\n\n\nIf you enable this setting, ne

Prevents removable devices from being installed.\n\n\nIf you enable this setting, removable devices may not be installed, and exis

When selecting which driver to install, do not distinguish between drivers that are signed by a Microsoft Windows Publisher certifi

Do not display "Found New Hardware" balloons during device installation.\n\n\nIf you enable this setting, "Found New Hardware" ba

Specifies whether the administrator will be prompted about going to Windows Update to search for device drivers using the Inter

Specifies whether the administrator will be prompted about going to Windows Update to search for device drivers using the Inter

Allows you to configure how often a Distributed File System (DFS) client attempts to discover domain controllers on their network.

Specifies whether Digital Locker can run.\n\n\nDigital Locker is a dedicated download manager associated with Windows Marketpla

Specifies whether Digital Locker can run.\n\n\nDigital Locker is a dedicated download manager associated with Windows Marketpla

Substitutes custom alert text in the disk diagnostic message shown to users when a disk reports a S.M.A.R.T. fault.\n\n\nIf you e

Determines the execution level for S.M.A.R.T.-based disk diagnostics.\n\n\nSelf-Monitoring And Reporting Technology (S.M.A.R.T.)

Turns off the boot and resume optimizations for the hybrid hard disks in the system.\n\n\nIf you enable this policy setting, the

Turns off the power save mode on the hybrid hard disks in the system.\n\n\nIf you enable this policy, the disks will not be put

Turns off all support for the non-volatile (NV) cache on all hybrid hard disks in the system. To check if you have hybrid hard d

Turns off the solid state mode for the hybrid hard disks. \n\n\nIf you enable this policy setting, frequently written files such as

Extends the disk quota policies in this folder to NTFS file system volumes on removable media.\n\n\nIf you disable this setting or

Specifies the default disk quota limit and warning level for new users of the volume.\n\n\nThis setting determines how much disk s

Enables and disables disk quota management on all NTFS volumes of the computer, and prevents users from changing the setting.\n

Determines whether disk quota limits are enforced and prevents users from changing the setting.\n\n\nIf you enable this setting,

Determines whether the system records an event in the local Application log when users reach their disk quota limit on a volume,

Determines whether the system records an event in the Application log when users reach their disk quota warning level on a volum

Specifies that Distributed Link Tracking clients in this domain may use the Distributed Link Tracking (DLT) server, which runs

Specifies whether the computers to which this setting is applied may attach suffixes to an unqualified multi-label name before sen

Specifies a connection-specific DNS suffix. This setting supersedes the connection-specific DNS suffixes set on the computers to w

Defines the DNS servers to which a computer sends queries when it attempts to resolve names.\n\n\nWarning: The list of the DNS se

Determines the DNS suffixes to attach to an unqualified single-label name before submission of a DNS query for that name.\n\n\nAn

Determines if dynamic update is enabled.\n\n\nComputers configured for dynamic update automatically register and update their DNS

Specifies the primary Domain Name System (DNS) suffix for all affected computers. The primary DNS suffix is used in DNS name reg

Determines whether the DNS client performs primary DNS suffix devolution in a name resolution process.\n\n\nWhen a user submits

Determines if a computer performing dynamic registration may register A and PTR resource records with a concatenation of its C

Determines whether the registration of PTR resource records is enabled for the computers to which this policy is applied.\n\n\nB

Specifies the Registration Refresh Interval of A and PTR resource records for computers to which this setting is applied. This s

Determines whether a DNS client that attempts to register its A resource record should overwrite an existing A resource record o

Specifies the value for the Time-To-Live (TTL) field in A and PTR resource records registered by the computers to which this setti

Local Link Multicast Name Resolution (LLMNR) is a secondary name resolution protocol. Queries are sent over the Local Link, a s

Specifies whether the computers to which this setting is applied use secure dynamic update or standard dynamic update for regis

Specifies whether the computers to which this setting is applied may send dynamic updates to the zones named with a single label

This policy setting controls the ability to change the color of window frames.\n\n\nIf you enable this policy setting, you prevent

This policy setting controls the ability to change the color of window frames.\n\n\nIf you enable this policy setting, you prevent

This policy setting controls how some graphics are rendered and facilitates other features, including Flip, Flip3D, and Taskbar Thu

This policy setting controls how some graphics are rendered and facilitates other features, including Flip, Flip3D, and Taskbar Thu

Flip3D is a 3D window switcher.\n\n\nIf you enable this setting, Flip3D will be inaccessible.\n\n\nIf you disable or do not configure

Flip3D is a 3D window switcher.\n\n\nIf you enable this setting, Flip3D will be inaccessible.\n\n\nIf you disable or do not configure

This policy setting controls the appearance of window animations such as those found when restoring, minimizing, and maximizing

This policy setting controls the appearance of window animations such as those found when restoring, minimizing, and maximizing

This policy setting controls the default color for window frames when the user does not specify a color.\n\n\nIf you enable this pol

This policy setting controls the default color for window frames when the user does not specify a color.\n\n\nIf you enable this pol

Prevents Windows Explorer from encrypting files that are moved to an encrypted folder.\n\n\nIf you disable this setting or do not

This setting determines the corporate server to which Windows Error Reporting will send reports (instead of sending reports to

This setting determines the consent behavior of Windows Error Reporting. If Consent level is set to "Always ask before sending d

This setting determines the consent behavior of Windows Error Reporting. If Consent level is set to "Always ask before sending d

Configures how errors are reported and what information is sent when Error Reporting is enabled.\n\n\nThis Policy will not enable o

This setting controls the behavior of the Windows Error Reporting archive. If Archive behavior is set to "Store all", all data col

This setting controls the behavior of the Windows Error Reporting archive. If Archive behavior is set to "Store all", all data col

This setting determines the behavior of the Windows Error Reporting queue. If Queuing behavior is set to "Default", Windows wi

This setting determines the behavior of the Windows Error Reporting queue. If Queuing behavior is set to "Default", Windows w

This policy setting determines the consent behavior of Windows Error Reporting for specific event types.\n\n\nIf this policy settin

This policy setting determines the consent behavior of Windows Error Reporting for specific event types.\n\n\nIf this policy settin

This setting controls whether or not errors in general applications are included when error reporting is enabled.\n\n\nWhen this sett

If this setting is enabled Windows Error Reporting events will not be logged to the system event log.

If this setting is enabled Windows Error Reporting events will not be logged to the system event log.

If this setting is enabled, Windows Error Reporting will not send any problem information to Microsoft. Additionally, solution inf

If this setting is enabled, Windows Error Reporting will not send any problem information to Microsoft. Additionally, solution inf

Use this setting to control whether or not a user is given the choice to report an error.\n\n\nWhen Display Error Notification is en

If this setting is enabled any additional data requests from Microsoft in response to a Windows Error Reporting event will be auto

If this setting is enabled any additional data requests from Microsoft in response to a Windows Error Reporting event will be auto

This setting determines the behavior of the default consent setting in relation to custom consent settings. If this setting is enabl

This setting determines the behavior of the default consent setting in relation to custom consent settings. If this setting is enabl

This setting specifies the applications that are always included in error reporting.\n\n\nWhen this setting is enabled, You can crea

This setting determines the behavior of the error reporting exclusion list. Windows will not send reports for any process added to

This setting determines the behavior of the error reporting exclusion list. Windows will not send reports for any process added to

This setting controls error reporting for errors in general applications when error reporting is enabled.\n\n\nThe "Default" dropdown

This policy setting prevents the display of the user interface for critical errors.\n\n\nIf you enable this policy setting, Windows Err

This setting controls whether or not errors in the operating system are included when error reporting is enabled.\n\n\nWhen this sett

This policy setting allows you to configure the server address, refresh interval, and issuer certificate authority (CA) of a

This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the “Retain old




This policy setting specifies to use the security descriptor for the log using the Security Descriptor Definition Language (SDDL) st




This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and sh




This policy setting specifies the maximum size of the log file in kilobytes.\n\n\nIf you enable this policy setting, you can confi




This policy setting controls Event Log behavior when the log file reaches its maximum size.\n\n\nWhen this policy setting is enab




This policy setting turns on logging.\n\n\nIf you enable or do not configure this policy setting, then events can be written to this

This is the program that will be invoked when the user clicks the events.asp link.

This specifies the command line parameters that will be passed to the events.asp program

This is the URL that will be passed to the Description area in the Event Properties dialog box. Change this value if you want to

This policy setting configures Windows Explorer to always display the menu bar.\n\n\nNote: By default, the menu bar is not displ

This policy setting allows administrators to prevent users from adding new items such as files or folders to the root of their Users

This policy is similar to settings directly available to computer users. Disabling animations can improve usability for users with

Disabling heap termination on corruption can allow certain legacy plug-in applications to function without terminating Explorer i

This policy setting allows you to configure the recovery behavior for corrupted files to one of three states:\n\n\nRegular: Detecti

Symbolic links can introduce vulnerabilities in certain applications. To mitigate this issue, you can selectively enable or disab

All redirected shell folders, such as Contacts, Documents, Desktop, Favorites, Music, Pictures, Videos, Start Menu, and AppData\Roam

This policy setting allows the administrator to define whether Folder Redirection should use localized names for the All Progra

This policy setting allows the administrator to define whether Folder Redirection should use localized names for the All Progra

Hides the Details Pane in Windows Explorer.\n\n\nIf you enable this policy setting, the Details Pane in Windows Explorer is hidde

Hides the Preview Pane in Windows Explorer.\n\n\nIf you enable this policy setting, the Preview Pane in Windows Explorer is hidd

Manages download of game box art and ratings from the Windows Metadata Services.\n\n\nIf you enable this setting, game inform

Tracks the last play time of games in the Games folder.\n\n\nIf you enable this setting the last played time of games will not be re

Determines how programs interpret two-digit years.\n\n\nThis setting specifies the largest two-digit year interpreted as being pre

This policy prevents users from changing their user geographical location (GeoID).\n\n\nIf this policy is Enabled, then the user ca

This policy prevents users from changing their user geographical location (GeoID).\n\n\nIf this policy is Enabled, then the user ca

This policy prevents a user from selecting a supplemental custom locale as their user locale. The user is restricted to the set of l

This policy prevents a user from selecting a supplemental custom locale as their user locale. The user is restricted to the set of l

This policy prevents the user from customizing their locale by changing their user overrides.\n\n\nAny existing overrides in place w

This policy prevents the user from customizing their locale by changing their user overrides.\n\n\nAny existing overrides in place w

This is a setting for computers with more than one UI language installed. If you enable this setting, the UI language of Window

This policy removes the Administrative options from the Regional and Language Options control panel. Administrative options incl

This policy removes the option to change the user's geographical location (GeoID) from the Language and Regional Options control

This policy removes the option to change the user's menus and dialogs (UI) language from the Language and Regional Options contr

This policy removes the regional formats interface from the Regional and Language Options control panel. This does not, however,

This setting restricts users to the specified language by disabling the menus and dialog box controls in the Regional and Langua

This policy restricts the permitted system locales to the specified list. If the list is empty, it locks the system locale to its c

This policy restricts users on a machine to the specified list of user locales. If the list is empty, it locks all user locales to th

This policy restricts users on a machine to the specified list of user locales. If the list is empty, it locks all user locales to th

This is a setting for computers with more than one UI language installed. If you enable this setting the UI language of Windows m

This is a setting for computers with more than one UI language installed. If you enable this setting the UI language of Windows

Allows user-based policy processing, roaming user profiles, and user object logon scripts for interactive logons across forests.\n

Always use local ADM files for the Group Policy snap-in.\n\n\nBy default, when you edit a Group Policy object (GPO) using the Gr

Creates new Group Policy object links in the disabled state.\n\n\nThis setting creates all new Group Policy object links in the di

Sets the default display name for new Group Policy objects.\n\n\nThis setting allows you to specify the default name for new G

This setting controls the ability of users to view their Resultant Set of Policy (RSoP) data.\n\n\nBy default, interactively log

This setting controls the ability of users to view their Resultant Set of Policy (RSoP) data.\n\n\nBy default, interactively log

Determines when disk quota policies are updated.\n\n\nThis setting affects all policies that use the disk quota component of Gr

Determines when encryption policies are updated.\n\n\nThis setting affects all policies that use the encryption component of Gr

Prevents administrators from viewing or using Group Policy preferences.\n\n\nA Group Policy administration (.adm) file can contai

Determines when folder redirection policies are updated.\n\n\nThis setting affects all policies that use the folder redirection

Determines which domain controller the Group Policy Object Editor snap-in uses.\n\n\n-- "Use the Primary Domain Controller" in

Specifies how often Group Policy for computers is updated while the computer is in use (in the background). This setting specifi

Specifies how often Group Policy is updated on domain controllers while they are running (in the background). The updates specif

Specifies how often Group Policy for users is updated while the computer is in use (in the background). This setting specifies a

Defines a slow connection for purposes of applying and updating Group Policy.\n\n\nIf the rate at which data is transferred from t

Defines a slow connection for purposes of applying and updating Group Policy.\n\n\nIf the rate at which data is transferred from t

Determines when Internet Explorer Maintenance policies are updated.\n\n\nThis setting affects all policies that use the Interne

Determines when IP security policies are updated.\n\n\nThis setting affects all policies that use the IP security component of

Determines when registry policies are updated.\n\n\nThis setting affects all policies in the Administrative Templates folder and

This setting allows you to control a user's ability to invoke a computer policy refresh.\n\n\nIf you enable this setting, users may

Determines when policies that assign shared scripts are updated.\n\n\nThis setting affects all policies that use the scripts co

Determines when security policies are updated.\n\n\nThis setting affects all policies that use the security component of Group P

Determines when software installation policies are updated.\n\n\nThis setting affects all policies that use the software install

This policy setting specifies how long Group Policy should wait for network availability notifications during startup policy proce

Prevents the system from updating the Administrative Templates source files automatically when you open the Group Policy Object

Prevents Group Policy from being updated while the computer is in use. This setting applies to Group Policy for computers, users,

This policy setting prevents Local Group Policy objects (Local GPOs) from being applied.\n\n\nBy default, the policy settings in

This setting allows you to enable or disable Resultant Set of Policy (RSoP) logging on a client computer.\n\n\nRSoP logs inform

Applies alternate user settings when a user logs on to a computer affected by this setting.\n\n\nThis setting directs the system

Determines when policies that assign wired network settings are updated.\n\n\nThis setting affects all policies that use the wi

Determines when policies that assign wireless network settings are updated.\n\n\nThis setting affects all policies that use the

Applications Client-Side Extension (CSE) policy processing settings.

Applications Client-Side Extension (CSE) tracing and logging options.

Computer Control Panel settings configure options that are manually configurable via the Windows Control Panel and affect all

Data Sources policy allows an administrator to manage user and system data sources.

Data Sources Client-Side Extension (CSE) policy processing settings.

Data Sources Client-Side Extension (CSE) tracing and logging options.

Devices policy allows an administrator to enable and disable classes of devices.

Devices Policy Client-Side Extension (CSE) policy processing settings.

Devices Policy Client-Side Extension (CSE) tracing and logging options.

Drive Maps policy allows an administrator to manage drive letter mappings to network shares or subfolders, such as mapping the

Drive Maps Client-Side Extension (CSE) policy processing settings.

Drive Maps Client-Side Extension (CSE) tracing and logging options.

Environment variables policy allows an administrator to manage persistent user and computer environment variablers. Computer po

Environment Client-Side Extension (CSE) policy processing settings.

Environment Client-Side Extension (CSE) tracing and logging options.

Files policy allows an administrator to copy files from one location to another or delete files, with the option to set attributes o

Files Policy Client-Side Extension (CSE) policy processing settings.

Files Policy Client-Side Extension (CSE) tracing and logging options.

Folder Options policy allows an administrator to set option folder parameters include view options, offline files, file types and fol

Folder Options Policy Client-Side Extension (CSE) policy processing settings.

Folder Options Policy Client-Side Extension (CSE) tracing and logging options.

Folders policy allows an administrator to create nested folders or to cascade delete folders and/or their contents, with the option

Folders Policy Client-Side Extension (CSE) policy processing settings.

Folders Policy Client-Side Extension (CSE) tracing and logging options.

Ini File policy allows an administrator to configure ini file settings in any type of ini file. Ini files are widely used by software

Ini Files Client-Side Extension (CSE) policy processing settings.

Ini Files Client-Side Extension (CSE) tracing and logging options.

Internet Settings policy allows an administrator to manage settings that are available in the Internet Options Control Panel applet,

Internet Settings Client-Side Extension (CSE) policy processing settings.

Internet Settings Client-Side Extension (CSE) tracing and logging options.

Local Users and Groups policy allows an administrator to create and configure local users and groups including group members

Local Users and Groups Client-Side Extension (CSE) policy processing settings.

Local Users and Groups Client-Side Extension (CSE) tracing and logging options.

Network Options policy allows an administrator to set network options such as VPN connections.

Network Options Policy Client-Side Extension (CSE) policy processing settings.

Network Options Policy Client-Side Extension (CSE) tracing and logging options.

Network Shares policy allows an administrator to configure network shares.

Network Shares Client-Side Extension (CSE) policy processing settings.

Network Shares Client-Side Extension (CSE) tracing and logging options.

Power Options policy allows an administrator to set power scheme and global power options.

Power Options Policy Client-Side Extension (CSE) policy processing settings.

Power Options Policy Client-Side Extension (CSE) tracing and logging options.

Preferences implement a robust and standards-based application plugin system. The plugin architecture allows anyone to write a ful

Application policy allows an administrator to manage settings that are provided by various application management plugins. Thes

This view extension provides additional information when editing or viewing policy settings in the MMC. The view extension a

This view extension provides additional information when editing or viewing policy settings in the MMC. The view extension a

Printers policy allows an administrator to manage printer configurations for users and computers. Computer policy supports automa

Printers Client-Side Extension (CSE) policy processing settings.

Printers Client-Side Extension (CSE) tracing and logging options.

Regional Options policy allows an administrator to set default locale and language properties.

Regional Options Policy Client-Side Extension (CSE) policy processing settings.

Regional Options Policy Client-Side Extension (CSE) tracing and logging options.

Registry policy allows an administrator to configure registry settings of any type. This policy differs significantly from Admini

Registry Client-Side Extension (CSE) policy processing settings.

Registry Client-Side Extension (CSE) tracing and logging options.

Scheduled Tasks policy allows an administrator to configure Scheduled Tasks.

Scheduled Tasks Policy Client-Side Extension (CSE) policy processing settings.

Scheduled Tasks Policy Client-Side Extension (CSE) tracing and logging options.

Services policy allows an administrator to configure Windows NT services.

Services Policy Client-Side Extension (CSE) policy processing settings.

Services Policy Client-Side Extension (CSE) tracing and logging options.

Shortcuts policy allows an administrator to manage shortcuts of any type that can be configured manually on a computer, includin

Shortcuts Client-Side Extension (CSE) policy processing settings.

Shortcuts Client-Side Extension (CSE) tracing and logging options.

Start Menu policy allows an administrator to set start menu and task bar options.

Start Menu Policy Client-Side Extension (CSE) policy processing settings.

Start Menu Policy Client-Side Extension (CSE) tracing and logging options.

User Control Panel settings configure options that are manually configurable via the Windows Control Panel and affect only ind

This policy setting allows Microsoft Windows to process user Group Policy settings asynchronously when logging on through Ter

With this policy, you can restrict certain HTML Help commands to function only in HTML Help (.chm) files within specified folder

Allows you to restrict programs from being run from online Help.\n\n\nIf you enable this setting, you can prevent programs that yo

Allows you to restrict programs from being run from online Help.\n\n\nIf you enable this setting, you can prevent programs that yo

Specifies whether active content links in trusted assistance content are rendered. By default, the Help viewer renders trusted as

Specifies whether users can participate in the Help Experience Improvement program. The Help Experience Improvement program co

Specifies whether users can provide ratings for Help content.\n\n\nIf this setting is enabled, this policy setting prevents ratings

Specifies whether untrusted content is rendered. By default, the Help viewer renders untrusted assistance content pages with the e

Specifies whether users can search and view content from Windows Online in Help and Support. Windows Online provides the most

This policy setting allows you to manage whether HotStart buttons can be used to launch applications.\n\n\nIf you enable this poli

This policy setting allows you to manage whether HotStart buttons can be used to launch applications.\n\n\nIf you enable this poli

Specifies whether Windows can access the Internet to accomplish tasks that require Internet resources.\n\n\nIf this setting is enabled

Specifies whether Windows can access the Internet to accomplish tasks that require Internet resources.\n\n\nIf this setting is enabled

This setting allows you to remove access to Windows Update.\n\n\nIf you enable this setting, all Windows Update features are r

Specifies whether to automatically update root certificates using the Windows Update Web site. \n\n\nTypically, a certificate is

Specifies whether to allow this client to download print driver packages over HTTP.\n\n\nTo set up HTTP printing, non-inbox drivers

Specifies whether to allow this client to download print driver packages over HTTP.\n\n\nTo set up HTTP printing, non-inbox drivers

Specifies whether "Events.asp" hyperlinks are available for events within the Event Viewer application.\n\n\nThe Event Viewer no

Specifies whether to show the "Did you know?" section of Help and Support Center.\n\n\nThis content is dynamically updated when

Specifies whether users can perform a Microsoft Knowledge Base search from the Help and Support Center.\n\n\nThe Knowledge Base

Specifies whether the Internet Connection Wizard can connect to Microsoft to download a list of Internet Service Providers (ISPs).\n

Specifies whether Windows should download a list of providers for the Web publishing and online ordering wizards.\n\n\nThese wiza

Specifies whether Windows should download a list of providers for the Web publishing and online ordering wizards.\n\n\nThese wiza

Specifies whether to use the Microsoft Web service for finding an application to open a file with an unhandled file association.\n

Specifies whether to use the Microsoft Web service for finding an application to open a file with an unhandled file association.\n

Specifies whether to allow printing over HTTP from this client.\n\n\nPrinting over HTTP allows a client to print to printers on the

Specifies whether to allow printing over HTTP from this client.\n\n\nPrinting over HTTP allows a client to print to printers on the

Specifies whether the Windows Registration Wizard connects to Microsoft.com for online registration.\n\n\nIf you enable this sett

Specifies whether Search Companion should automatically download content updates during local and Internet searches.\n\n\nWhen

Specifies whether the "Order Prints Online" task is available from Picture Tasks in Windows folders.\n\n\nThe "Order Prints Online

Specifies whether the "Order Prints Online" task is available from Picture Tasks in Windows folders.\n\n\nThe "Order Prints Online

Specifies whether the tasks "Publish this file to the Web," "Publish this folder to the Web," and "Publish the selected items to

Specifies whether the tasks "Publish this file to the Web," "Publish this folder to the Web," and "Publish the selected items to

Specifies whether Windows Messenger collects anonymous information about how Windows Messenger software and service is used.\n

Specifies whether Windows Messenger collects anonymous information about how Windows Messenger software and service is used.\n

The Windows Customer Experience Improvement Program will collect information about your hardware configuration and how you use

Controls whether or not errors are reported to Microsoft.\n\n\nError Reporting is used to report information about a system or ap

This policy setting turns off the active tests performed by the Windows Network Connectivity Status Indicator (NCSI) to determin

This policy specifies whether Windows searches Windows Update for device drivers when no local drivers for a device are present

When you enable this setting, it will prevent Internet Information Services (IIS) from being installed, and you will not be able to

This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Micros




















This policy setting allows you to add a specific set of search providers to the user's default search provider list. Normally, sear

This policy setting allows you to add a specific set of search providers to the user's default search provider list. Normally, sear

This policy setting allows you to manage a list of add-ons to be allowed or denied by Internet Explorer.\n\n\nThis list can be us

This policy setting allows you to manage a list of add-ons to be allowed or denied by Internet Explorer.\n\n\nThis list can be us

For each zone, the Binary and Scripted Behavior security restrictions may be configured to allow only a list of admin-approved beh

For each zone, the Binary and Scripted Behavior security restrictions may be configured to allow only a list of admin-approved beh

This policy setting allows you to manage whether processes respect add-on management user preferences (as reflected by Add-on Ma

Internet Explorer contains dynamic binary behaviors: components that encapsulate specific functionality for the HTML elements to

Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received t

This policy setting allows you to manage whether the Information Bar is displayed for processes other than the Internet Explorer pro

Internet Explorer places zone restrictions on each Web page it opens, which are dependent upon the location of the Web page (Inte

This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more danger

The MK Protocol Security Restriction policy setting reduces attack surface area by preventing the MK protocol. Resources hosted on

Internet Explorer may be configured to prevent active content obtained through restricted protocols from running in an unsafe manne

This policy setting defines whether a reference to an object is accessible when the user navigates within the same domain or to a

Internet Explorer places restrictions on each Web page it opens. The restrictions are dependent upon the location of the Web page

This policy setting enables applications hosting the Web Browser Control to block automatic prompting of ActiveX control installati

This policy setting enables applications hosting the Web Browser Control to block automatic prompting of file downloads that are no

Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restrictions

This policy setting allows this feature to be prevented or allowed for all processes running on the machine.\n\n\nIf you enable th

This policy setting allows you to manage whether processes respect add-on management user preferences (as reflected by Add-on Ma


Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received t

This policy setting allows you to manage whether the Information Bar is displayed for processes other than the Internet Explorer pro

Internet Explorer places zone restrictions on each Web page it opens, which are dependent upon the location of the Web page (Inte


The MK Protocol Security Restriction policy setting reduces attack surface area by preventing the MK protocol. Resources hosted on






Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restrictions

This policy setting allows this feature to be prevented or allowed for all processes running on the machine.\n\n\nIf you enable th

This policy setting allows you to manage whether users receive a dialog requesting permission for active content on a CD to run.\

This policy setting allows you to manage whether users receive a dialog requesting permission for active content on a CD to run.\

This policy setting allows you to manage whether a resource hosted on an admin-restricted protocol in the Intranet Zone can run ac



This policy setting allows you to manage whether a resource hosted on an admin-restricted protocol in the Trusted Sites Zone can r





This policy setting allows you to manage whether a resource hosted on an admin-restricted protocol in the Trusted Sites Zone can r


This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting,




















This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality




















This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a




















This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nI




















This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone




















This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy set






This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy sett














This policy setting allows you to manage whether users can download and install self-installing program files (non-Internet Explo

This policy setting allows you to manage whether users can download and install self-installing program files (non-Internet Explo

This policy setting allows you to manage whether users can automatically download and install Web components (such as fonts) t

This policy setting allows you to manage whether users can automatically download and install Web components (such as fonts) t

This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this optio




















This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web




















This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy




















This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and sta


This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and stat


















This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able




















This policy setting allows you to manage whether software, such as ActiveX controls and file downloads, can be installed or run by th

This policy setting allows you to manage whether software, such as ActiveX controls and file downloads, can be installed or run by th

This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this p




















This policy setting specifies whether placeholders should be shown for graphical images while they are downloading. This allows i

This policy setting specifies whether you want Internet Explorer to print background colors and images when you print a Web page.

This policy setting allows you to manage whether Internet Explorer will launch COM add-ons known as browser helper objects, such

This policy setting allows you to manage whether Internet Explorer will launch COM add-ons known as browser helper objects, such

This policy setting allows you to play video and animation through the dynsrc/img tag in a specified zone. This means video and




















This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nI




















This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, s




















Designates the Audio/Video Player ActiveX control as administrator-approved.\n\n\nThis control is used for playing sounds, videos

This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this




















This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, use


This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, us


















This policy setting allows you to manage whether Internet Explorer checks the Internet for newer versions. When Internet Explorer

This policy setting allows you to manage whether Internet Explorer checks the Internet for newer versions. When Internet Explorer

Designates the Microsoft Network (MSN) Carpoint automatic pricing control as administrator-approved.\n\n\nThis control enables en

This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificat

This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificat

This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher o

This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher o

Allows Administrators to enable and disable the Media Explorer Bar and set the auto-play default.\n\n\nThe Media Explorer Bar play

Allows Administrators to enable and disable the ability for Outlook Express users to save or open attachments that can potentially

Specifies which buttons will be displayed on the standard toolbar in Microsoft Internet Explorer.\n\n\nIf you enable this policy, yo

This policy setting allows you to customize the Internet Explorer version string as reported to Web servers in the HTTP User Agent

This policy setting allows you to customize the Internet Explorer version string as reported to Web servers in the HTTP User Agent

This policy setting allows you to ensure that any Internet Explorer add-ons not listed in the 'Add-on List' policy setting are denie

This policy setting allows you to ensure that any Internet Explorer add-ons not listed in the 'Add-on List' policy setting are denie

This ActiveX control enables users to edit HTML text and see a faithful rendition of how the text would look in the browser. There

This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete B

This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete B

Prevents users from adding channels to Internet Explorer.\n\n\nChannels are Web sites that are updated automatically on your com

Prevents users from specifying that Web pages can be downloaded for viewing offline. When users make Web pages available for off

Disables existing schedules for downloading Web pages for offline viewing.\n\n\nWhen users make Web pages available for offline

This AutoComplete feature suggests possible matches when users are filling up forms.\n\n\nIf you enable this setting, the user is

Prevents Internet Explorer from automatically installing components.\n\n\nIf you enable this policy, it prevents Internet Explor

Prevents automatic proxy scripts, which interact with a server to automatically configure users' proxy settings, from being stored i

If you enable this policy, the user cannot modify the Accessibility options. All options in the "Accessibility" window on the Gen

Prevents users from changing settings on the Advanced tab in the Internet Options dialog box.\n\n\nIf you enable this policy, u

This setting specifies to automatically detect the proxy server settings used to connect to the Internet and customize Internet Exp

This setting specifies to automatically detect the proxy server settings used to connect to the Internet and customize Internet Exp

Prevents users from changing the default programs for managing schedules and contacts.\n\n\nIf you enable this policy, the Cale

Prevents users from changing certificate settings in Internet Explorer. Certificates are used to verify the identity of software pu

Prevents users from changing the default Web page colors.\n\n\nIf you enable this policy, the color settings for Web pages appe

Prevents users from changing dial-up settings.\n\n\nIf you enable this policy, the Settings button on the Connections tab in the

Prevents users from changing dial-up settings.\n\n\nIf you enable this policy, the Settings button on the Connections tab in the

Prevents Microsoft Internet Explorer from checking to see whether it is the default browser.\n\n\nIf you enable this policy, the

Prevents users from changing font settings.\n\n\nIf you enable this policy, users will not be able to change font settings for vi

The Home page in the Internet Options Settings is the default web page that internet explorer loads whenever it is run.\n\n\nIf

Prevents users from changing language preference settings.\n\n\nIf you enable this policy, users will not be able to set languag

Prevents users from changing the colors of links on Web pages.\n\n\nIf you enable this policy, the color settings for links appea

Prevents users from changing the default programs for messaging tasks.\n\n\nIf you enable this policy, the E-mail, Newsgroups, a

Prevents users from changing Profile Assistant settings.\n\n\nIf you enable this policy, the My Profile button appears dimmed in

This setting specifies to connect to the internet using the proxy server settings specified. A proxy server acts as an intermediar

This setting specifies to connect to the internet using the proxy server settings specified. A proxy server acts as an intermediar

Prevents users from changing ratings that help control the type of Internet content that can be viewed.\n\n\nIf you enable this po

Prevents users from changing the browser cache settings, such as the location and amount of disk space to use for the Temporary

Prevents users from viewing the Channel bar interface. Channels are Web sites that are automatically updated on their computer a

Prevents the shortcut menu from appearing when users click the right mouse button while using the browser.\n\n\nIf you enable t

Prevents users from determining which buttons appear on the Microsoft Internet Explorer and Windows Explorer standard toolbars

Prevents users from determining which toolbars are displayed in Microsoft Internet Explorer and Windows Explorer.\n\n\nIf you en

Prevents content from being downloaded from Web sites that users have subscribed to.\n\n\nWhen users make Web pages available fo

Prevents users from adding, editing, or removing schedules for offline viewing of Web pages and groups of Web pages that users h

Prevents users from editing an existing schedule for downloading Web pages for offline viewing.\n\n\nWhen users make Web pages av

Prevents branding of Internet programs, such as customization of Internet Explorer and Outlook Express logos and title bars, by an

Prevents users from exporting or importing favorite links and feeds by using the Import/Export Wizard.\n\n\nIf you enable this poli

Prevents users from running the Internet Connection Wizard.\n\n\nIf you enable this policy, the Setup button on the Connections

Prevents channel providers from recording information about when their channel pages are viewed by users who are working offline.

Prevents using the shortcut menu to open a link in a new browser window.\n\n\nIf you enable this policy, users cannot point to

Prevents Internet Explorer from checking whether a new version of the browser is available.\n\n\nIf you enable this policy, it prev

Prevents users from disabling channel synchronization in Microsoft Internet Explorer.\n\n\nChannels are Web sites that are autom

Prevents users from clearing the preconfigured settings for Web pages to be downloaded for offline viewing.\n\n\nWhen users make

Prevents users from saving a program or file that Microsoft Internet Explorer has downloaded to the hard disk.\n\n\nIf you enabl

Prevents the Internet Explorer splash screen from appearing when users start the browser.\n\n\nIf you enable this policy, the spla

Specifies that programs using the Microsoft Software Distribution Channel will not notify users when they install new components.

Removes the Advanced tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are preve

Removes the Advanced tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are preve

Removes the Connections tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are pre

Removes the Connections tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are pre

If you enable this policy setting, users are prevented from seeing and changing ratings, certificates, AutoComplete, Wallet, and Pr

If you enable this policy setting, users are prevented from seeing and changing ratings, certificates, AutoComplete, Wallet, and Pr

Removes the General tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are unable

Removes the General tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are unable

Removes the Privacy tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are prevented

Removes the Privacy tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are prevented

Removes the Programs tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are preve

Removes the Programs tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are preve

Prevents users from restoring default settings for home and search pages.\n\n\nIf you enable this policy, the Reset Web Settings

Removes the Security tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, it prevents users

Removes the Security tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, it prevents users

This feature represents the setup of WinFX Runtime Components. WinFX is the next generation platform for Windows, utilizing t




















Specifies that error messages will be displayed to users if problems occur with proxy scripts.\n\n\nIf you enable this policy, err

This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security




















This policy setting prevents users from using the Reset Internet Explorer Settings feature. Reset Internet Explorer Settings will al

This policy setting prevents users from using the Reset Internet Explorer Settings feature. Reset Internet Explorer Settings will al

This policy setting allows you to manage whether users have the ability to allow or deny add-ons through Add-On Manager.\n\n\nIf

This policy setting allows you to manage whether users have the ability to allow or deny add-ons through Add-On Manager.\n\n\nIf

This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certifi




















This policy setting allows you to manage whether Internet Explorer will save encrypted pages that contain secure (HTTPS) informa

This policy setting allows you to manage whether Internet Explorer will save encrypted pages that contain secure (HTTPS) informa

This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you




















This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potent




This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potenti
















This policy setting allows you to manage whether Internet Explorer deletes the contents of the Temporary Internet Files folder aft

This policy setting allows you to manage whether Internet Explorer deletes the contents of the Temporary Internet Files folder aft

This policy setting allows users to run natively implemented scriptable XMLHTTP.\n\n\nIf you enable this policy setting, the use

This policy setting allows users to run natively implemented scriptable XMLHTTP.\n\n\nIf you enable this policy setting, the use

The Navigation bar includes features for navigating among Web pages, searching the Web using a selection of search tools, viewi

The Navigation bar includes features for navigating among Web pages, searching the Web using a selection of search tools, viewi

Prevents users from closing Microsoft Internet Explorer and Windows Explorer.\n\n\nIf you enable this policy, the Close command o

Prevents users from opening a new browser window from the File menu.\n\n\nIf this policy is enabled, users cannot open a new

Prevents users from opening a file or Web page from the File menu in Internet Explorer.\n\n\nIf you enable this policy, the O

Prevents users from saving the complete contents that are displayed on or run from a Web page, including the graphics, scripts,

Prevents users from saving Web pages from the browser File menu to their hard disk or to a network share.\n\n\nIf you enable th

Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Internet security zone.\n\n\

Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Local Intranet security zone

Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Local Computer security zon

Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Restricted Sites security zo

Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Trusted Sites security zone.

Prevents users from displaying tips for users who are switching from Netscape.\n\n\nIf you enable this policy, the For Netscap

Prevents users from sending feedback to Microsoft by clicking the Send Feedback command on the Help menu.\n\n\nIf you enable t

Prevents users from viewing or changing the Tip of the Day interface in Microsoft Internet Explorer.\n\n\nIf you enable this poli

Prevents users from running the Internet Explorer Tour from the Help menu in Internet Explorer.\n\n\nIf you enable this policy,

Prevents users from adding, removing, editing or viewing the list of Favorite links.\n\n\nThe Favorites list is a way to store pop

Prevents users from configuring unique identities by using Identity Manager.\n\n\nIdentity Manager enables users to create multip

This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the




















This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX cont





















Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received thr

This policy setting allows you to manage whether the Information Bar is displayed for Internet Explorer processes when file or code

Internet Explorer places zone restrictions on each Web page it opens, which are dependent upon the location of the Web page (Inter


The MK Protocol Security Restriction policy setting reduces attack surface area by preventing the MK protocol. Resources hosted o

Windows Explorer and Internet Explorer may be configured to prevent active content obtained through restricted protocols from runn



This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes.\n\n\nIf you enable this

This policy setting enables blocking of file download prompts that are not user initiated.\n\n\nIf you enable this policy setting, fi

Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restrictio

This policy setting allows you bypass prompting when scripts running within the Internet Explorer process attempt to perform a clip


Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received thr

This policy setting allows you to manage whether the Information Bar is displayed for Internet Explorer processes when file or code



The MK Protocol Security Restriction policy setting reduces attack surface area by preventing the MK protocol. Resources hosted o

Windows Explorer and Internet Explorer may be configured to prevent active content obtained through restricted protocols from runn



This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes.\n\n\nIf you enable this

This policy setting enables blocking of file download prompts that are not user initiated.\n\n\nIf you enable this policy setting, fi

Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restrictio

This policy setting allows you bypass prompting when scripts running within the Internet Explorer process attempt to perform a clip

For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restr


This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for


This policy setting controls whether local sites which are not explicitly mapped into any Security Zone are forced into the local Int

This policy setting controls whether local sites which are not explicitly mapped into any Security Zone are forced into the local Int

This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone.\n\n\nIf you enable

This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone.\n\n\nIf you enable

This policy setting controls whether sites which bypass the proxy server are mapped into the local Intranet security zone.\n\n\nI

This policy setting controls whether sites which bypass the proxy server are mapped into the local Intranet security zone.\n\n\nI





Designates a set of Microsoft Network (MSN) Investor controls as administrator-approved.\n\n\nThese controls enable users to vie

This policy setting allows you to manage permissions for Java applets.\n\n\nIf you enable this policy setting, you can choose opt




















This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference i




















This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other


































This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose fro




This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose fr
















These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for




















Applies proxy settings to all users of the same computer.\n\n\nIf you enable this policy, users cannot set user-specific proxy set

Designates a set of Microsoft ActiveX controls used to manipulate pop-up menus in the browser as administrator-approved.\n\n\nI

Designates the Microsoft Agent ActiveX control as administrator-approved.\n\n\nMicrosoft Agent is a set of software services that

Designates the Microsoft Chat ActiveX control as administrator-approved.\n\n\nThis control is used by Web authors to build text-b

Designates Microsoft Scriptlet Component as an administrator approved control. It is an Active X control which is used to render

Designates Microsoft Survey Control as an administrator approved control.\n\n\nIf you enable this policy, this control can be run

The navigation bar contains icons for a variety of features including navigating among web pages, searching the web using a sele

Designates a set of MSNBC controls as administrator-approved.\n\n\nThese controls enable enhanced browsing of news reports on th

This policy setting allows you to manage the opening of sub-frames and access of applications across different domains.\n\n\nIf




















Designates NetShow File Transfer Control as an administrator approved control.\n\n\nIf you enable this policy, this control can b

This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME snif




















This policy setting allows you to manage whether Internet Explorer will display animated pictures found in Web content. Generally o

This policy setting allows you to manage whether Internet Explorer will display animated pictures found in Web content. Generally o

This policy setting allows you to manage whether Internet Explorer will play sounds found in web content. Generally only sound file

This policy setting allows you to manage whether Internet Explorer will play sounds found in web content. Generally only sound file

This policy setting allows you to manage whether Internet Explorer will display videos found in Web content. Generally only embedde

This policy setting allows you to manage whether Internet Explorer will display videos found in Web content. Generally only embedde

This policy setting allows you to specify a list of web sites that will be allowed to open pop-up windows regardless of the Intern

This policy setting allows you to specify a list of web sites that will be allowed to open pop-up windows regardless of the Intern

This policy setting prevents users from performing the "Fix settings" functionality related to Security Settings Check.\n\n\nIf you en

This policy setting prevents users from performing the "Fix settings" functionality related to Security Settings Check.\n\n\nIf you en

This policy setting specifies the action that will be performed when searching from the Address bar. There are two possible acti

Internet Explorer treats as fatal any Secure Socket Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt navig

Internet Explorer treats as fatal any Secure Socket Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt navig

This policy setting prevents users from participating in the Customer Experience Improvement Program (CEIP).\n\n\nIf you enable

This policy setting prevents users from participating in the Customer Experience Improvement Program (CEIP).\n\n\nIf you enable

This policy setting prevents performance of the First Run Customize settings ability and controls what the user will see when they

This policy setting prevents performance of the First Run Customize settings ability and controls what the user will see when they

This policy setting prevents the setting of the code download path for each machine. The Internet Component Download service exp

This policy setting prevents the configuration of cipher strength update information URLs. When you log on to secure pages, acces

This policy setting is used to manage temporary Internet files and cookies associated with your Internet browsing history, available

This policy setting is used to manage temporary Internet files and cookies associated with your Internet browsing history, available

This policy setting allows you to disable the Internet Explorer search box, which includes a drop-down list of all installed search p

This policy setting allows you to disable the Internet Explorer search box, which includes a drop-down list of all installed search p

This policy setting prevents users from using Windows colors as a part of the display settings. By default, this functionality is tu

This policy setting allows the user to choose the default text size in Internet Explorer.\n\n\nIf you enable this policy setting, a u

This policy setting prevents users from configuring the background color in Internet Explorer.\n\n\nIf you enable this policy set

This policy setting allows you to manage whether users can choose text color in Internet Explorer.\n\n\nIf you enable this policy s

This policy setting prevents users from changing the color of Web page links they have already clicked. Appropriate color choices

This policy setting prevents users from changing the color of Web page links that they have not yet clicked. Appropriate color choi

This policy setting prevents users from specifying the color to which hyperlinks change when the mouse pointer pauses on them.\n\

This policy setting allows you to manage whether the listed processes respect add-on management user preferences (as entered int

Internet Explorer contains dynamic binary behaviors: components that encapsulate specific functionality for the HTML elements to wh

Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received th

This policy setting allows you to manage whether the Information Bar is displayed for specific processes when file or code installs



The MK Protocol Security Restriction policy setting reduces attack surface area by preventing the MK protocol. Resources hosted on t


This policy setting defines whether a reference to an object is accessible when the user navigates within the same domain or to a n




Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restriction

This policy setting allows administrators to define applications for which they want this feature to be prevented or allowed.\n\n\nD

This policy setting allows you to manage whether the listed processes respect add-on management user preferences (as entered int

Internet Explorer contains dynamic binary behaviors: components that encapsulate specific functionality for the HTML elements to wh

Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received th

This policy setting allows you to manage whether the Information Bar is displayed for specific processes when file or code installs



The MK Protocol Security Restriction policy setting reduces attack surface area by preventing the MK protocol. Resources hosted on t


This policy setting defines whether a reference to an object is accessible when the user navigates within the same domain or to a n




Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restriction

This policy setting allows administrators to define applications for which they want this feature to be prevented or allowed.\n\n\nD

This policy setting prevents you from setting the default search provider for the address bar and the Toolbar Search Box.\n\n\nIf y

This policy setting prevents you from setting the default search provider for the address bar and the Toolbar Search Box.\n\n\nIf y

This policy setting allows you to restrict the search providers that will appear in the search box in Internet Explorer to a list d

This policy setting allows you to restrict the search providers that will appear in the search box in Internet Explorer to a list d





This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be execu




















This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed




















This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nI




















This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you




















This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy set






This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy se














Disables using the F3 key to search in Internet Explorer and Windows Explorer.\n\n\nIf you enable this policy, the search functio

Makes the Customize button in the Search Assistant appear dimmed.\n\n\nThe Search Assistant is a tool that appears in the Search b

Prevents users from adding or removing sites from security zones. A security zone is a group of Web sites with the same security

Prevents users from changing security zone settings. A security zone is a group of Web sites with the same security level.\n\n\nIf

Applies security zone information to all users of the same computer. A security zone is a group of Web sites with the same securit

This policy setting allows you to manage whether Internet Explorer converts Unicode domain names to IDN format (Punycode) bef

This policy setting allows you to manage whether Internet Explorer converts Unicode domain names to IDN format (Punycode) bef

Designates Shockwave flash as an administrator approved control.\n\n\nIf you enable this policy, this control can be run in secur

This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose th


















This policy setting allows you to manage a list of sites that you want to associate with a particular security zone. These zone numbers have associated security settings that apply to all of the sites in the zone.\n\n\nInternet Explorer has 4 security zones, numbered 1-4, and these are used by this policy setting to associate sites to zones. They are: (1) Intranet zone, (2) Trusted Sites zone, (3) Internet zone, and (4) Restricted Sites zone. Security settings can be set for each of these zones through other policy settings, and their default settings are: Trusted Sites zone (Low template), Intranet zone (Medium-Low template), Internet zone (Medium template), and Restricted Sites zone (High template). (The Local Machine zone and its locked down equivalent have special security settings that protect your local computer.)\n\n\nIf you enable this policy setting, you can enter a list of sites and their related zone numbers. The association of a site with a zone will ensure that the security settings for the specified zone are applied to the site. For each entry that you add to the list, enter the following information:\n\n\nValuename – A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also include a specific protocol. For example, if you enter http://www.contoso.com as the valuename, other protocols are not affected. If you enter just www.contoso.com, then all protocols are affected for that site, including http, https, ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for www.contoso.com and www.contoso.com/mail would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict.\n\n\nValue - A number indicating the zone with which this site should be associated for security settings. The Internet Explorer zones described above are 1-4.\n\n\nIf you disable this policy setting, any such list is deleted and no site-to-zone assignments are permitted.\n\n\nIf this policy is not configured, users may choose their own site-to-zone assignments.

This policy setting allows you to manage a list of sites that you want to associate with a particular security zone. These zone numbers have associated security settings that apply to all of the sites in the zone.\n\n\nInternet Explorer has 4 security zones, numbered 1-4, and these are used by this policy setting to associate sites to zones. They are: (1) Intranet zone, (2) Trusted Sites zone, (3) Internet zone, and (4) Restricted Sites zone. Security settings can be set for each of these zones through other policy settings, and their default settings are: Trusted Sites zone (Low template), Intranet zone (Medium-Low template), Internet zone (Medium template), and Restricted Sites zone (High template). (The Local Machine zone and its locked down equivalent have special security settings that protect your local computer.)\n\n\nIf you enable this policy setting, you can enter a list of sites and their related zone numbers. The association of a site with a zone will ensure that the security settings for the specified zone are applied to the site. For each entry that you add to the list, enter the following information:\n\n\nValuename – A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also include a specific protocol. For example, if you enter http://www.contoso.com as the valuename, other protocols are not affected. If you enter just www.contoso.com, then all protocols are affected for that site, including http, https, ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for www.contoso.com and www.contoso.com/mail would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict.\n\n\nValue - A number indicating the zone with which this site should be associated for security settings. The Internet Explorer zones described above are 1-4.\n\n\nIf you disable this policy setting, any such list is deleted and no site-to-zone assignments are permitted.\n\n\nIf this policy is not configured, users may choose their own site-to-zone assignments.



This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL




















Restricts the amount of information downloaded for offline viewing.\n\n\nIf you enable this policy, you can set limits to the s

Prevents users from opening the Internet Options dialog box from the Tools menu in Microsoft Internet Explorer.\n\n\nIf you ena





This policy setting prevents users from performing the "Delete Browsing History" action in Internet Explorer.\n\n\nIf you enable th

This policy setting prevents users from performing the "Delete Browsing History" action in Internet Explorer.\n\n\nIf you enable th

This policy setting prevents the user from clearing forms. This is available as "Delete Forms" option in the "Delete Browsing Hist

This policy setting prevents the user from clearing forms. This is available as "Delete Forms" option in the "Delete Browsing Hist

This policy setting prevents the user from clearing passwords. This option is available as "Delete Passwords" option in the "Dele

This policy setting prevents the user from clearing passwords. This option is available as "Delete Passwords" option in the "Dele

This policy setting prevents the users from subscribing to a feed or deleting a subscribed feed.\n\n\nIf you enable this policy s

This policy setting prevents the users from subscribing to a feed or deleting a subscribed feed.\n\n\nIf you enable this policy s

This policy setting specifies that you want Internet Explorer to automatically resize large images so that they fit in the browser w

This policy setting controls whether to have background sync for feeds.\n\n\nIf you enable the policy setting, the ability to sync f

This policy setting controls whether to have background sync for feeds.\n\n\nIf you enable the policy setting, the ability to sync f

This policy setting allows checking for updates for Internet Explorer from the specified URL, included by default in Internet Expl

This policy setting prevents the text on the screen from being rendered using the ClearType technology that enhances the readabi

This policy setting prevents the text on the screen from being rendered using the ClearType technology that enhances the readabi

This policy setting allows you to configure the default behavior of new tab creation in Internet Explorer.\n\n\nIf you enable th

This policy setting allows you to configure the default behavior of new tab creation in Internet Explorer.\n\n\nIf you enable th

This policy setting allows you to define the user experience related to pop-up windows and tabbed browsing in Internet Explorer.

This policy setting allows you to define the user experience related to pop-up windows and tabbed browsing in Internet Explorer.

This policy setting allows you to configure the behavior of new windows in Internet Explorer.\n\n\nIf you enable this policy setti

This policy setting allows you to configure the behavior of new windows in Internet Explorer.\n\n\nIf you enable this policy setti

This setting specifies the update check interval. The default value is 30 days.\n\n\nIf you enable this policy setting, the user wil

This policy setting specifies how you want links on Web pages to be underlined. Select one of the following settings:\n• To underl

This policy setting allows you to manage the crash detection feature of add-on Management.\n\n\nIf you enable this policy setting

This policy setting allows you to manage the crash detection feature of add-on Management.\n\n\nIf you enable this policy setting

This policy setting allows you to turn off the Help menu in Internet Explorer.\n\n\nIf you enable this policy setting, users will no

This policy setting allows you to turn off the Help menu in Internet Explorer.\n\n\nIf you enable this policy setting, users will no

This policy setting prevents users from having enclosures (file attachments) downloaded from a feed to the user's computer.\n\

This policy setting prevents users from having enclosures (file attachments) downloaded from a feed to the user's computer.\n\

This policy setting prevents users from having Internet Explorer automatically detect if there is a feed available for an associated

This policy setting prevents users from having Internet Explorer automatically detect if there is a feed available for an associated

This policy setting controls the First Run response that users see on a zone by zone basis. When a user encounters a new control t




















This policy setting specifies whether, when there is a problem connecting with an Internet server, to provide a detailed description

This policy setting let you turn off Inline AutoComplete in Windows Explorer. Inline AutoComplete provides suggestions for what yo

This policy setting allows the user to enable a phishing filter that will warn if the Web site being visited is known for fraudulent

This policy setting allows the user to enable a phishing filter that will warn if the Web site being visited is known for fraudulent

You can allow Pop-ups from specific websites by adding the site to the exceptions list.\n\n\nIf you enable this policy, users will

You can allow Pop-ups from specific websites by adding the site to the exceptions list.\n\n\nIf you enable this policy, users will

You can block or allow pop-ups based on three filter levels:\n High – Block All Pop-ups\n Medium – Block most Automatic pop

You can block or allow pop-ups based on three filter levels:\n High – Block All Pop-ups\n Medium – Block most Automatic pop

This policy setting specifies if, as you move from one Web page to another, Internet Explorer fades out of the page you are leaving

This policy setting prevents the user from zooming into or out of a page to better see the content.\n\n\nIf you enable this policy

This policy setting prevents the user from zooming into or out of a page to better see the content.\n\n\nIf you enable this policy

This policy setting specifies whether graphical images should be included when pages are displayed.\n\n\nSometimes, pages that co

This policy setting allows you to manage pop-up management functionality in Internet Explorer.\n\n\nIf you enable this policy se

This policy setting allows you to manage pop-up management functionality in Internet Explorer.\n\n\nIf you enable this policy se

This policy setting specifies whether you will accept requests from Web sites for Profile Assistant information.\n\n\nIf you enable

This policy setting specifies whether you will accept requests from Web sites for Profile Assistant information.\n\n\nIf you enable

This policy setting allows you to turn off the Quick Tabs functionality in Internet Explorer.\n\n\nIf you enable this policy setting,

This policy setting allows you to turn off the Quick Tabs functionality in Internet Explorer.\n\n\nIf you enable this policy setting,

This policy setting specifies whether to use UTF-8, a standard that defines characters so they are readable in any language. Usi

This policy setting specifies whether you want Internet Explorer to smooth images, so they appear less jagged when displayed.\n\n\

This policy setting specifies whether smooth scrolling is used to display content at a predefined speed.\n\n\nIf you enable this pol

This policy setting allows you to turn off tabbed browsing and related entry points from the Internet Explorer user interface.\n\n\n

This policy setting allows you to turn off tabbed browsing and related entry points from the Internet Explorer user interface.\n\n\n

This AutoComplete feature suggests possible matches when users are entering Web addresses in the browser address bar.\n\n\nIf

This policy setting prevents users from using Internet Explorer as a feed reader. This setting has no impact on the RSS Platform.\n\

This policy setting prevents users from using Internet Explorer as a feed reader. This setting has no impact on the RSS Platform.\n\

This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when

This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when

The toolbar upgrade tool will check to see if incompatible toolbars or browser helper objects are installed when Internet Explorer

The toolbar upgrade tool will check to see if incompatible toolbars or browser helper objects are installed when Internet Explorer

This policy setting enables intranet mapping rules to be applied automatically when the computer belongs to a domain.\n\n\nIf you

This policy setting enables intranet mapping rules to be applied automatically when the computer belongs to a domain.\n\n\nIf you

This policy setting allows Internet Explorer to be launched automatically to complete the signup process after the branding is com

This policy setting logs information that is blocked by new features in Internet Explorer. The logged data is displayed in the Windo

This policy setting logs information that is blocked by new features in Internet Explorer. The logged data is displayed in the Windo

This policy setting allows an Information bar notification to be shown to the user when intranet content is loaded and the intranet

This policy setting allows an Information bar notification to be shown to the user when intranet content is loaded and the intranet

This policy setting lets you turn on inline AutoComplete for Web addresses. The AutoComplete feature provides suggestions for wha

This policy setting allows you to turn on or turn off the legacy "File, Edit, View, etc. ..." menus in Internet Explorer.\n\n\nIf you e

This policy setting allows you to turn on or turn off the legacy "File, Edit, View, etc. ..." menus in Internet Explorer.\n\n\nIf you e

Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in t




















This policy setting allows you to turn on your script debugger, if one is installed. Script debuggers are used by Web site develope

This AutoComplete feature can remember and suggest User names and passwords on Forms.\n\n\nIf you enable this setting, the

This policy setting specifies whether to display script errors when a page does not appear properly because of problems with its sc

This policy setting is used to make hyperlinks change color when the mouse pointer pauses on them.\n\n\nIf you enable this policy set

This policy setting determines if the Internet Connection Wizard was completed. If it was not completed, it launches the Internet

Specifies that Automatic Detection will be used to configure dial-up settings for users.\n\n\nAutomatic Detection uses a DHCP (Dyna

This policy setting controls whether Phishing Filter scans pages in this zone for phishing.\n\n\nIf you enable this policy setting, Phi




















This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end


This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end u


















This policy setting allows you to manage whether Internet Explorer uses UTF-8 for mailto links.\n\n\nIf you enable this policy set

This policy setting allows you to manage whether Internet Explorer uses UTF-8 for mailto links.\n\n\nIf you enable this policy set

This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or




















Prevents users from displaying the browser in full-screen (kiosk) mode, without the standard toolbar.\n\n\nIf you enable this pol

Prevents users from viewing the HTML source of Web pages by clicking the Source command on the View menu.\n\n\nIf you enabl

These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and




















This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into

This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into th



















These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its pagina




















Turns off the handwriting recognition error reporting tool.\n\n\nThe handwriting recognition error reporting tool enables users to

Turns off the handwriting recognition error reporting tool.\n\n\nThe handwriting recognition error reporting tool enables users to

Turns off the automatic learning component of handwriting recognition personalization. \n\n\nAutomatic learning enables the colle

Turns off the automatic learning component of handwriting recognition personalization. \n\n\nAutomatic learning enables the colle

Turns off handwriting recognition personalization so the handwriting recognition engine that ships with Windows Vista™ is used ins

Turns off handwriting recognition personalization so the handwriting recognition engine that ships with Windows Vista™ is used ins

If enabled then new targets may not be manually configured by entering the target name and target portal; already discovered

If enabled then only those sessions that are established via a persistent login will be established and no new persistent logins m

If enabled then do not allow the initiator CHAP secret to be changed. If disabled then the initiator CHAP secret may be changed.

If enabled then do not allow the initiator iqn name to be changed. If disabled then the initiator iqn name may be changed.

If enabled then only those connections that are configured for IPSec may be established. If disabled then connections that are

If enabled then discovered targets may not be manually configured. If disabled then discovered targets may be manually configu

If enabled then new iSNS servers may not be added and thus new targets discovered via those iSNS servers; existing iSNS se

If enabled then new target portals may not be added and thus new targets discovered on those portals; existing target portals

If enabled then only those sessions that are configured for mutual CHAP may be established. If disabled then sessions that ar

If enabled then only those sessions that are configured for one-way CHAP may be established. If disabled then sessions that ar

This policy setting controls whether the domain controller provides information about previous logons to client computers.\n\n\n

This policy setting allows you to specify which DNS host names and which DNS suffixes are mapped to a Kerberos realm.\n\n\nIf y

This policy setting configures the Kerberos client so that it can authenticate with interoperable Kerberos V5 realms, as defined b

This policy setting controls the Kerberos client's behavior in validating the KDC certificate. \n \nIf you enable this polic

This policy setting determines whether Diagnostic Policy Service (DPS) will diagnose memory leak problems. If you disable this po

This policy setting turns on the Mapper I/O network protocol driver.\n\n\nLLTDIO allows a computer to discover the topology of a n

This policy setting turns on the Responder network protocol driver.\n\n\nThe Responder allows a computer to participate in Link L

This setting forces the user to log on to the computer using the classic logon screen. By default, a workgroup is set to use the

Determines whether Windows XP waits for the network during computer startup and user logon. By default, Windows XP does not wait

Ignores the customized run list.\n\n\nYou can create a customized list of additional programs and documents that the system star

Ignores the customized run list.\n\n\nYou can create a customized list of additional programs and documents that the system star

Ignores customized run-once lists.\n\n\nYou can create a customized list of additional programs and documents that are started a

Ignores customized run-once lists.\n\n\nYou can create a customized list of additional programs and documents that are started a

Supresses the welcome screen.\n\n\nThis setting hides the welcome screen that is displayed on Windows 2000 Professional each t

Supresses the welcome screen.\n\n\nThis setting hides the welcome screen that is displayed on Windows 2000 Professional each t

By enabling the policy, Administrators hide the Switch user button in the Logon UI, the Start menu and the Task Manager.

Suppresses system status messages.\n\n\nIf you enable this setting, the system does not display a message reminding users to wa

Specifies additional programs or documents that Windows starts automatically when a user logs on to the system.\n\n\nTo use this s

Specifies additional programs or documents that Windows starts automatically when a user logs on to the system.\n\n\nTo use this s

Turn off the Windows Startup sound and prevent its customization in the Sound item of Control Panel.\n\n\nThe Microsoft Windows S

Directs the system to display highly detailed status messages.\n\n\nIf you enable this setting, the system displays status message

Specifies whether Windows Media Center can run.\n\n\nIf you enable this setting, Windows Media Center will not run.\n\n\nIf yo

Specifies whether Windows Media Center can run.\n\n\nIf you enable this setting, Windows Media Center will not run.\n\n\nIf yo

Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the sn



Prevents users from entering author mode.\n\n\nThis setting prevents users from opening the Microsoft Management Console (MM

Lets you selectively permit or prohibit the use of Microsoft Management Console (MMC) snap-ins.\n\n\n-- If you enable this setting,






































Permits or prohibits use of the Group Policy tab in property sheets for the Active Directory Users and Computers and Active Directory


















This policy setting turns off Windows Mobility Center.\n\n\nIf you enable this policy setting, the user is unable to invoke Windows

This policy setting turns off Windows Mobility Center.\n\n\nIf you enable this policy setting, the user is unable to invoke Windows

This policy setting turns off Windows presentation settings.\n\n\nIf you enable this policy setting, Windows presentation setting

This policy setting turns off Windows presentation settings.\n\n\nIf you enable this policy setting, Windows presentation setting

Specifies whether Windows Movie Maker can run.\n\n\nWindows Movie Maker is a feature of Windows Vista that can be used to edi

Specifies whether Windows Movie Maker can run.\n\n\nWindows Movie Maker is a feature of Windows Vista that can be used to edi

Note: Applies to Windows Movie Maker 2.1 only\n\n\nSpecifies whether Windows Movie Maker automatically downloads codecs.\n\

Note: Applies to Windows Movie Maker 2.1 only\n\n\nSpecifies whether Windows Movie Maker automatically downloads codecs.\n\

Specifies whether links to Web sites are available in Windows Movie Maker. These links include the "Windows Movie Maker on

Specifies whether links to Web sites are available in Windows Movie Maker. These links include the "Windows Movie Maker on

Note: Applies to Windows Movie Maker 2.1 only\n\n\nSpecifies whether users can send a final movie to a video hosting provid

Note: Applies to Windows Movie Maker 2.1 only\n\n\nSpecifies whether users can send a final movie to a video hosting provid

Determines the execution level for Microsoft Support Diagnostic Tool.\n\n\nMicrosoft Support Diagnostic Tool (MSDT) gathers diagno

Restricts the tool download policy for Microsoft Support Diagnostic Tool.\n\n\nMicrosoft Support Diagnostic Tool (MSDT) gathers

Allows Terminal Services administrators to install and configure programs remotely.\n\n\nBy default, system administrators can

Directs Windows Installer to use system permissions when it installs any program on the system.\n\n\nThis setting extends elevate

Directs Windows Installer to use system permissions when it installs any program on the system.\n\n\nThis setting extends elevate

This policy controls the percentage of disk space available to the Windows Installer baseline file cache.\n\n\nThe Windows Install

Saves copies of transform files in a secure location on the local computer.\n\n\nTransform files consist of instructions to modify

Allows Web-based programs to install software on the computer without notifying the user.\n\n\nBy default, when a script hosted b

The MsiLogging property in an installation package can be used to enable automatic logging of all install operations for the packa

Disables or restricts the use of Windows Installer.\n\n\nThis setting can prevent users from installing software on their system

Permits users to change installation options that typically are available only to system administrators.\n\n\nThis setting bypasses

Allows users to search for installation files during privileged installations.\n\n\nThis setting enables the Browse button in the

Allows users to upgrade programs during privileged installations.\n\n\nThis setting permits all users to install patches, even whe

Allows users to install programs from removable media, such as floppy disks and CD-ROMs, during privileged installations.\n\n\nT

This setting causes the Windows Installer to enforce strict rules for component upgrades - setting this may cause some updates t

Specifies the types of events that Windows Installer records in its transaction log for each installation. The log, Msi.log, appear

Prevents users from installing programs from removable media.\n\n\nIf a user tries to install a program from removable media,

This setting controls the ability to turn off all patch optimizations. \n\n\nIf you turn on this policy setting (set to 1), all Patch

This setting controls the ability of non-administrators to install updates that have been digitally signed by the application vendor

Prevents users from using Windows Installer to install patches.\n\n\nPatches are updates or upgrades that replace only those pro

This setting controls the ability for users or administrators to remove Windows Installer based updates. \n\n\nThis setting sho

Prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation.\n\

Prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation.\n\

The Restart Manager API can eliminate or reduce the number of system restarts that are required to complete an installation or upd

This setting allows you to configure user installs. To configure this setting, set it to enabled and use the drop-down list to select

Prevents users from searching for installation files when they add features or components to an installed program.\n\n\nThis setti

Specifies the order in which Windows Installer searches for installation files.\n\n\nBy default, the Windows Installer searches the

System Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal da

This policy setting allows the Network Access Protection (NAP) client to support the Windows XP version of the 802.1x Enforceme

This setting controls whether the Net Logon service will allow the use of older cryptography algorithms that are used in Window

Determines whether domain controllers (DC) will dynamically register DC Locator site-specific SRV records for the closest sites w

Defines whether a domain controller (DC) should attempt to verify with the PDC the password provided by a client if the DC faile

Determines which Domain Controller (DC) Locator DNS records are not registered by the Netlogon service.\n\n\nTo enable this

This policy setting allows you to control the processing of incoming mailslot messages by a local domain controller (DC).\n\n\

The Domain Controller (DC) Locator APIs return IP address of the DC with the other part of the information. Before the support o

Determines if Dynamic Registration of the domain controller (DC) locator DNS resource records is enabled. These DNS records are

Specifies the additional time for the computer to wait for the domain controller’s (DC) response when logging on to the network.\n\

When applications performing periodic searches for domain controllers (DC) are unable to find a DC, the value set in this setting

The Domain Controller Locator (DC Locator) service is used by clients to find domain controllers for their Active Directory domai

When applications performing periodic searches for domain controllers (DC) are unable to find a DC, the value set in this setting

Specifies whether the computers to which this setting is applied attempt DNS name resolution of a single-label domain names.\n\n

Specifies the level of debug output for the Net Logon service.\n\n\nThe Net Logon service outputs debug information to the log fil

When applications performing periodic searches for Domain Controllers (DCs) are unable to find a DC, the value set in this setting

Specifies the maximum size in bytes of the log file netlogon.log in the directory %windir%\debug when logging is enabled.\n\n\nBy d

Specifies the amount of time (in seconds) the DC locator remembers that a domain controller (DC) could not be found in a domain. Wh

This setting controls whether or not the Netlogon share created by the Net Logon service on a domain controller (DC) should suppo

Determines when a successful DC cache entry is refreshed. This setting is applied to caller programs that periodically attempt to

Determines when a successful DC cache entry is refreshed. This setting is applied to caller programs that do not periodically at

Specifies the Priority field in the SRV resource records registered by domain controllers (DC) to which this setting is applied. T

Specifies the Refresh Interval of the domain controller (DC) Locator DNS resource records for DCs to which this setting is appli

Determines the interval at which Netlogon performs the following scavenging operations:\n\n\n- Checks if a password on a secure

Specifies the Active Directory site to which computers belong.\n\n\nAn Active Directory site is one or more well-connected TCP/IP

Specifies the sites for which the domain controllers (DC) housing application directory partition should register the site-specifi

Specifies the sites for which the domain controllers (DC) register the site-specific DC Locator DNS SRV resource records. These

Specifies the sites for which the global catalogs (GC) should register site-specific GC locator DNS SRV resource records. These

This setting controls whether or not the Sysvol share created by the Net Logon service on a domain controller (DC) should support

The Domain Controller Locator (DC Locator) service is used by clients to find domain controllers for their Active Directory domai

Specifies the value for the Time-To-Live (TTL) field in Net Logon registered SRV resource records. These DNS records are dynamic

Specifies the Weight field in the SRV resource records registered by the domain controllers (DC) to which this setting is applied

Determines whether a user can view and change the properties of remote access connections that are available to all users of the

Determines whether users can delete all user remote access connections.\n\n\nTo create an all-user remote access connection, on

Determines whether users can enable/disable LAN connections.\n\n\nIf you enable this setting, the Enable and Disable options for

Determines whether nonadministrators can rename all-user remote access connections.\n\n\nTo create an all-user connection, on th

Determines whether nonadministrators can rename a LAN connection.\n\n\nIf you enable this setting, the Rename option is enabled

Determines whether users can rename LAN or all user remote access connections.\n\n\nIf you enable this setting, the Rename opti

Determines whether settings that existed in Windows 2000 Server family will apply to Administrators.\n\n\nThe set of Network Co

Determines whether users can change the properties of a LAN connection.\n\n\nThis setting determines whether the Properties menu

Determines whether Administrators and Network Configuration Operators can change the properties of components used by a LAN co

Determines whether users can view and change the properties of components used by a private or all-user remote access connectio

Determines whether the Advanced Settings item on the Advanced menu in Network Connections is enabled for administrators.\n\n\nT

Determines whether users can use the New Connection Wizard, which creates new network connections.\n\n\nIf you enable this sett

Determines whether the Remote Acccess Preferences item on the Advanced menu in Network Connections folder is enabled.\n\n\nThe

Determines whether administrators can add and remove network components for a LAN or remote access connection. This setting ha

Determines whether users can view and change the properties of their private remote access connections.\n\n\nPrivate connections

Determines whether users can connect and disconnect remote access connections.\n\n\nIf you enable this setting (and enable the "

Determines whether users can delete remote access connections.\n\n\nIf you enable this setting (and enable the "Enable Network C

Determines whether administrators can enable and disable the components used by LAN connections.\n\n\nIf you enable this setti

Determines whether a user can install and configure the Network Bridge.\n\n\nImportant: This settings is location aware. It on

Determines whether users can rename their private remote access connections.\n\n\nPrivate connections are those that are availabl

Determines whether users can configure advanced TCP/IP settings.\n\n\nIf you enable this setting (and enable the "Enable Networ

Prohibits use of Internet Connection Firewall on your DNS domain network.\n\n\nDetermines whether users can enable the Internet

Determines whether administrators can enable and configure the Internet Connection Sharing (ICS) feature of an Internet connec

Determines whether users can view the status for an active connection.\n\n\nConnection status is available from the connection st

This policy setting allows you to manage whether notifications are shown to the user when a DHCP-configured connection is unable

Disables the Connect to a Network Projector wizard so that users cannot connect to a network projector.\n\n\nIf you enable this p

Disables the Connect to a Network Projector wizard so that users cannot connect to a network projector.\n\n\nIf you enable this p

Determines whether network files remain available if the computer is suddenly disconnected from the server hosting the files.\n\n\n

Determines whether network files remain available if the computer is suddenly disconnected from the server hosting the files.\n\n\n

This policy setting lists network files and folders that are always available for offline use. This ensures that the the specified fil

This policy setting lists network files and folders that are always available for offline use. This ensures that the the specified fil

Determines whether the Offline Files feature is enabled.\n\n\nThis setting also disables the "Enable Offline Files" option on the

Deletes local copies of the user's offline files when the user logs off.\n\n\nThis setting specifies that automatically and manually

Configures the threshold value at which Offline Files considers a network connection to be "slow". Any network speed below this va

This policy setting allows you to enable and configure the slow-link mode of Offline Files.\n\n\nWhen Offline Files is operating i

Limits the percentage of the computer's disk space that can be used to store automatically cached offline files.\n\n\nThis setting

This setting determines whether offline files are encrypted.\n\n\nOffline files reside on a user's hard drive, not the network, and

Determines which events the Offline Files feature records in the event log.\n\n\nOffline Files records events in the Application l

Determines which events the Offline Files feature records in the event log.\n\n\nOffline Files records events in the Application l

Lists types of files that cannot be used offline.\n\n\nThis setting lets you exclude certain types of files from automatic and man

Determines how long the first reminder balloon for a network status change is displayed.\n\n\nReminder balloons appear when the

Determines how long the first reminder balloon for a network status change is displayed.\n\n\nReminder balloons appear when the

This policy limits the amount of the computer's disk space that can be used to store offline files.\n\n\nUsing this setting you can c

Determines how computers respond when they are disconnected from particular offline file servers. This setting overrides the defa

Determines how computers respond when they are disconnected from particular offline file servers. This setting overrides the defa

Disables the Offline Files folder.\n\n\nThis setting disables the "View Files" button on the Offline Files tab. As a result, users c

Disables the Offline Files folder.\n\n\nThis setting disables the "View Files" button on the Offline Files tab. As a result, users c

This policy setting allows you to manage a list of files or folders for which you wish to prohibit the 'Make Available Offline' option

This policy setting allows you to manage a list of files or folders for which you wish to prohibit the 'Make Available Offline' option

Prevents users from enabling, disabling, or changing the configuration of Offline Files.\n\n\nThis setting removes the Offline File

Prevents users from enabling, disabling, or changing the configuration of Offline Files.\n\n\nThis setting removes the Offline File

Determines how often reminder balloon updates appear.\n\n\nIf you enable this setting, you can select how often reminder balloon

Determines how often reminder balloon updates appear.\n\n\nIf you enable this setting, you can select how often reminder balloon

Determines how long updated reminder balloons are displayed.\n\n\nReminder balloons appear when the user's connection to a netw

Determines how long updated reminder balloons are displayed.\n\n\nReminder balloons appear when the user's connection to a netw

Prevents users from making network files and folders available offline.\n\n\nThis setting removes the "Make Available Offline" o

Prevents users from making network files and folders available offline.\n\n\nThis setting removes the "Make Available Offline" o

Makes subfolders available offline whenever their parent folder is made available offline.\n\n\nThis setting automatically extends t

Determines whether offline files are fully synchronized when users log off.\n\n\nThis setting also disables the "Synchronize all of

Determines whether offline files are fully synchronized when users log off.\n\n\nThis setting also disables the "Synchronize all of

Determines whether offline files are fully synchronized when users log on.\n\n\nThis setting also disables the "Synchronize all of

Determines whether offline files are fully synchronized when users log on.\n\n\nThis setting also disables the "Synchronize all of

Determines whether offline files are synchonized before a computer is suspended.\n\n\nIf you enable this setting, offline files a

Determines whether offline files are synchonized before a computer is suspended.\n\n\nIf you enable this setting, offline files a

Hides or displays reminder balloons, and prevents users from changing the setting.\n\n\nReminder balloons appear above the Offlin

Hides or displays reminder balloons, and prevents users from changing the setting.\n\n\nReminder balloons appear above the Offlin

This policy setting allows you to turn on economical application of administratively assigned Offline Files.\n\n\nIf you enable this

By default, when a Peer Group is created that allows for password-authentication (or the password for such a Group is changed), P

This policy setting limits a node to resolving, but not publishing, names in a specific Peer Name Resolution Protocol (PNRP) clo



This setting sets the seed server for the global cloud to a specified node in the enterprise. The Peer Name Resolution Protocol (

This setting sets the seed server for the link local cloud to a specified node in the enterprise.\n\n\nThe Peer Name Resolution Pro

This setting sets the seed server for the site local cloud to a specified node in the enterprise.\n\n\nThe Peer Name Resolution Pr

This setting turns off Microsoft Peer-to-Peer Networking Services in its entirety, and will cause all dependent applications to stop

This setting disables PNRP protocol from advertising the computer or from searching other computers on the local subnet in the gl

This setting disables PNRP protocol from advertising the computer or from searching other computers on the local subnet in the li

This setting disables PNRP protocol from advertising the computer or from searching other computers on the local subnet in the si

This policy setting enables or disables PNRP cloud creation.\n\n\nPNRP is a distributed name resolution protocol allowing Inte



Configure the Parental Controls feature.\n\n\nIf you turn on this setting, the Parental Controls control panel will be visible on a

This policy setting determines whether the Program Compatibility Assistant (PCA) will diagnose DLL load or COM object creation

This policy setting configures the Program Compatibility Assistant (PCA) to diagnose failures with application installations. \n\n\

This policy setting determines whether the Program Compatibility Assistant (PCA) will diagnose failures with application installer

This policy setting configures the Program Compatibility Assistant (PCA) to diagnose failures with programs under User Account Co

This policy setting determines whether the Program Compatibility Assistant (PCA) will diagnose drivers blocked due to compatibility

Turns off Tablet PC Pen Training.\n\n\nIf you enable this policy setting, users cannot open Tablet PC Pen Training.\n\n\nIf you d

Turns off Tablet PC Pen Training.\n\n\nIf you enable this policy setting, users cannot open Tablet PC Pen Training.\n\n\nIf you d

Removes access to the performance center control panel OEM and Microsoft branding links.\n\n\nIf you enable this setting, the OE

Removes access to the performance center control panel OEM and Microsoft branding links.\n\n\nIf you enable this setting, the OE

Removes access to the performance center control panel page. \n\n\nIf you enable this setting, some settings within the performanc

Removes access to the performance center control panel page. \n\n\nIf you enable this setting, some settings within the performanc

Removes access to the performance center control panel solutions to performance problems.\n\n\nIf you enable this setting, the so

Removes access to the performance center control panel solutions to performance problems.\n\n\nIf you enable this setting, the so

Determines the execution level for Windows Boot Performance Diagnostics.\n\n\nIf you enable this policy setting, you must select

Determines the execution level for Windows Standby/Resume Performance Diagnostics.\n\n\nIf you enable this policy setting, you

Determines the execution level for Windows System Responsiveness Diagnostics.\n\n\nIf you enable this policy setting, you must s

Determines the execution level for Windows Shutdown Performance Diagnostics.\n\n\nIf you enable this policy setting, you must se

Dictates whether or not Windows is allowed to use standby states when sleeping the computer. \n \nWhen this policy is enab

Dictates whether or not Windows is allowed to use standby states when sleeping the computer. \n \nWhen this policy is enab

Specifies the action that Windows takes when battery capacity reaches the critical battery notification level.\n\n\nPossible action

Specifies the percentage of battery capacity remaining that triggers the critical battery notification action.\n\n\nIf you enable this

This setting allows you to configure whether power is automatically turned off when Windows shutdown completes. This setting

Specifies the action that Windows takes when battery capacity reaches the low battery notification level.\n\n\nPossible actions in

Specifies the percentage of battery capacity remaining that triggers the low battery notification action.\n\n\nIf you enable this poli

This settings allows you to configure client computers to always lock when resuming from a hibernate or suspend.\n\n\nIf you enab

Specifies whether or not the user is prompted for a password when the system resumes from sleep. \n\n\nIf you enable this polic

Specifies whether or not the user is prompted for a password when the system resumes from sleep. \n\n\nIf you enable this polic

Specifies the active power plan from a list of default Windows power plans. To specify a custom power plan, use the Custom Activ

Specifies the action that Windows takes when a user closes the lid on a mobile PC.\n\n\nPossible actions include:\n\n\n-Take no ac

Specifies the action that Windows takes when a user closes the lid on a mobile PC.\n\n\nPossible actions include:\n\n\n-Take no ac

Specifies the action that Windows takes when a user presses the power button.\n\n\nPossible actions include:\n\n\n-Take no action

Specifies the action that Windows takes when a user presses the power button.\n\n\nPossible actions include:\n\n\n-Take no action

Specifies the action that Windows takes when a user presses the sleep button.\n\n\nPossible actions include:\n\n\n-Take no action

Specifies the action that Windows takes when a user presses the sleep button.\n\n\nPossible actions include:\n\n\n-Take no action

Specifies the action that Windows takes when a user presses the user interface sleep button.\n\n\nPossible actions include:\n\n\n-

Specifies the action that Windows takes when a user presses the user interface sleep button.\n\n\nPossible actions include:\n\n\n-

Specifies an active power plan when you enter a power plan’s GUID.\n\n\nRetrieve the custom power plan GUID by using powerc

Specifies the period of inactivity before Windows transitions the system to hibernate.\n\n\nIf you enable this policy setting, you

Specifies the period of inactivity before Windows transitions the system to hibernate.\n\n\nIf you enable this policy setting, you

Specifies the period of inactivity before Windows transitions the system to sleep.\n\n\nIf you enable this policy setting, you must

Specifies the period of inactivity before Windows transitions the system to sleep.\n\n\nIf you enable this policy setting, you must

Manages how Windows controls the setting that specifies how long a computer must be inactive before Windows turns off the comp

Manages how Windows controls the setting that specifies how long a computer must be inactive before Windows turns off the comp

Disables Hybrid Sleep.\n\n\nIf you enable this policy setting, a hiberfile is not generated when the system transitions to sleep (St

Disables Hybrid Sleep.\n\n\nIf you enable this policy setting, a hiberfile is not generated when the system transitions to sleep (St

Disables a user notification when the battery capacity remaining equals the low battery notification level.\n\n\nIf you enable this p

Specifies the period of inactivity before Windows turns off the display.\n\n\nIf you enable this policy, you must provide a value,

Specifies the period of inactivity before Windows turns off the display.\n\n\nIf you enable this policy, you must provide a value,

Specifies the period of inactivity before Windows turns off the hard disk.\n\n\nIf you enable this policy, you must provide a value

Specifies the period of inactivity before Windows turns off the hard disk.\n\n\nIf you enable this policy, you must provide a value

Enables applications and services to prevent the system from sleeping.\n\n\nIf you enable this policy setting, an application or s

Enables applications and services to prevent the system from sleeping.\n\n\nIf you enable this policy setting, an application or s

This policy setting lets you hide the list or restore of previous versions of files that are on local disks. The previous versions could

This policy setting lets you hide the list or restore of previous versions of files that are on local disks. The previous versions could

This policy setting lets you hide the list or restore of previous versions of files that are on file shares. The previous versions could

This policy setting lets you hide the list or restore of previous versions of files that are on file shares. The previous versions could

This setting lets you hide entries in the list of previous versions of a file in which the previous version is located on backup m

This setting lets you hide entries in the list of previous versions of a file in which the previous version is located on backup m

This setting lets you suppress the Restore button in the previous versions property page when the user has selected a previous version


This setting lets you suppress the Restore button in the previous versions property page when the user has selected a previous versi

This setting lets you suppress the Restore button in the previous versions property page when the user has selected a previous versi



This policy sets the maximum number of printers (of each type) that the Add Printer wizard will display on a computer on a managed

This policy sets the maximum number of printers (of each type) that the Add Printer wizard will display on a computer on an unmana

This policy controls whether the print spooler will accept client connections. \n\n\nWhen the policy is unconfigured, the spooler w

Determines whether the computer's shared printers can be published in Active Directory.\n\n\nIf you enable this setting or do not con

Determines whether the domain controller can prune (delete from Active Directory) the printers published by this computer.\n\n\nB

When printing through a print server, determines whether the print spooler on the client will process print jobs itself, or pass th

Determines whether the Add Printer Wizard automatically publishes the computer's shared printers in Active Directory.\n\n\nIf you e

Adds a link to an Internet or intranet Web page to the Add Printer Wizard.\n\n\nYou can use this setting to direct users to a Web

Allows users to use the Add Printer Wizard to search the network for shared printers.\n\n\nIf you enable this setting or do not co

Directs the system to periodically verify that the printers published by this computer still appear in Active Directory. This setting

Specifies the default location criteria used when searching for printers.\n\n\nThis setting is a component of the Location Trackin

Adds a customized Web page link to the Printers folder.\n\n\nBy default, the Printers folder includes a link to the Microsoft Sup

Specifies the Active Directory location where searches for printers begin.\n\n\nThe Add Printer Wizard gives users the option of se

Specifies how often the pruning service on a domain controller contacts computers to verify that their printers are operational.\

Sets the priority of the pruning thread.\n\n\nThe pruning thread, which runs only on domain controllers, deletes printer objects fr

Specifies how many times the pruning service on a domain controller repeats its attempt to contact a computer before pruning the c

Determines whether printers using kernel-mode drivers may be installed on the local computer. Kernel-mode drivers have access to

Specifies whether or not to log events when the pruning service on a domain controller attempts to contact a computer before pruning

This policy restricts clients computers to use package point and print only.\n\n\nIf this setting is enabled, users will only be able

Restricts package point and print to approved servers.\n\n\nIf this setting is enabled, users will only be able to package point and

This policy setting controls the servers that a client machine can connect to for point and print, and the security prompts for

Enables the physical Location Tracking support feature of Windows printers.\n\n\nLocation tracking lets you design a location sch

Prevents users from using familiar methods to add local and network printers.\n\n\nThis setting removes the Add Printer option from

Prevents users from deleting local and network printers.\n\n\nIf a user tries to delete a printer, such as by using the Delete opti

Announces the presence of shared printers to print browse master servers for the domain.\n\n\nOn domains with Active Directory, s

Determines whether the pruning service on a domain controller prunes printer objects that are not automatically republished when

Determines whether Internet printing is activated on this server.\n\n\nInternet printing lets you display printers on Web pages so

Prevents users from viewing or installing published programs from the network. \n\n\nThis setting prevents users from accessing

This setting prevents users from accessing "Installed Updates" page from the "View installed updates" task.\n\n\n"Installed Updat

This setting prevents users from accessing "Programs and Features" to view, uninstall, change, or repair programs that are curre

This setting removes the Set Program Access and Defaults page from the Programs Control Panel. As a result, users cannot view

This setting prevents users from accessing the "Turn Windows features on or off" task from the Programs Control Panel in Catego

This setting prevents users from access the "Get new programs from Windows Marketplace" task from the Programs Control Panel i

This setting prevents users from using the Programs Control Panel in Category View and Programs and Features in Classic View.\

This policy setting allows you to set the number of retries for synchronization on failure servers.\n\n\nIf you enable this policy,

This policy setting allows you to set the interval in seconds between retries for synchronization failures.\n\n\nIf you enable this p

This policy setting allows you to manage the extensive logging feature for the Password Sync component.\n\n\nIf you enable this p

This policy setting allows you to manage the Windows to Network Information Service(NIS) password sync feature (for Unix users

Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Best Effort service type (Serv

Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Best Effort service type (Serv

Specifies an alternate link layer (Layer-2) priority value for packets with the Best Effort service type (ServiceTypeBestEffort). The

Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Controlled Load service type

Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Controlled Load service type

Specifies an alternate link layer (Layer-2) priority value for packets with the Controlled Load service type (ServiceTypeControlledL

Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Guaranteed service type (Ser

Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Guaranteed service type (Ser

Specifies an alternate link layer (Layer-2) priority value for packets with the Guaranteed service type (ServiceTypeGuaranteed). Th

Specifies the maximum number of outstanding packets permitted on the system. When the number of outstanding packets reaches this

Determines the percentage of connection bandwidth that the system can reserve. This value limits the combined bandwidth reservatio

Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Network Control service type

Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Network Control service type

Specifies an alternate link layer (Layer-2) priority value for packets with the Network Control service type (ServiceTypeNetworkCont

Specifies an alternate link layer (Layer-2) priority value for packets that do not conform to the flow specification. The Packet Sch

Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Qualitative service type (Serv

Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Qualitative service type (Serv

Specifies an alternate link layer (Layer-2) priority value for packets with the Qualitative service type (ServiceTypeQualitative). Th

Determines the smallest unit of time that the Packet Scheduler uses when scheduling packets for transmission. The Packet Scheduler

Determines the execution level for Windows Resource Exhaustion Detection and Resolution.\n\n\nIf you enable this policy setting,

Defines when the Shutdown Event Tracker System State Data feature is activated.\n\n\nThe system state data file contains informat

The Shutdown Event Tracker can be displayed when you shut down a workstation or server. This is an extra set of questions t

The Persistent System Timestamp allows the system to detect the time of unexpected shutdowns by writing the current time to disk

This setting controls whether or not unplanned shutdown events can be reported when error reporting is enabled.\n\n\nWhen this set

This policy setting enables Remote Assistance invitations to be generated with improved encryption so that only computers running

The "Display warning message before sharing control" policy setting allows you to specify a custom message to display before a u

This policy setting allows you to turn on or turn off Offer (Unsolicited) Remote Assistance on this computer. \n\n\nIf you e

This policy setting allows you to enable or disable Solicited (Ask for) Remote Assistance on this computer. \n\n\nIf you enable

This policy setting allows you to improve performance in low bandwidth scenarios.\n\n\nThis setting is incrementally scaled from "N

This policy setting allows you to turn logging on or off. Log files are located in the user's Documents folder under Remote Assistance

Configure access to all removable storage classes.\n\n\nThis policy setting takes precedence over any individual removable storag

Configure access to all removable storage classes.\n\n\nThis policy setting takes precedence over any individual removable storag

This policy setting grants normal users direct access to removable storage devices in remote sessions.\n\n\nIf you enable this po

This policy setting denies read access to the CD and DVD removable storage class.\n\n\nIf you enable this policy setting, read acc

This policy setting denies read access to the CD and DVD removable storage class.\n\n\nIf you enable this policy setting, read acc

This policy setting denies write access to the CD and DVD removable storage class.\n\n\nIf you enable this policy setting, write a

This policy setting denies write access to the CD and DVD removable storage class.\n\n\nIf you enable this policy setting, write a

This policy setting denies read access to custom removable storage classes.\n\n\nIf you enable this policy setting, read access w

This policy setting denies read access to custom removable storage classes.\n\n\nIf you enable this policy setting, read access w

This policy setting denies write access to custom removable storage classes.\n\n\nIf you enable this policy setting, write access

This policy setting denies write access to custom removable storage classes.\n\n\nIf you enable this policy setting, write access

This policy setting denies read access to the Floppy Drives removable storage class, including USB Floppy Drives.\n\n\nIf you enab

This policy setting denies read access to the Floppy Drives removable storage class, including USB Floppy Drives.\n\n\nIf you enab

This policy setting denies write access to the Floppy Drives removable storage class, including USB Floppy Drives.\n\n\nIf you enab

This policy setting denies write access to the Floppy Drives removable storage class, including USB Floppy Drives.\n\n\nIf you enab

This policy setting denies read access to removable disks.\n\n\nIf you enable this policy setting, read access will be denied to th

This policy setting denies read access to removable disks.\n\n\nIf you enable this policy setting, read access will be denied to th

This policy setting denies write access to removable disks.\n\n\nIf you enable this policy setting, write access will be denied to t

This policy setting denies write access to removable disks.\n\n\nIf you enable this policy setting, write access will be denied to t

This policy setting denies read access to the Tape Drive removable storage class.\n\n\nIf you enable this policy setting, read acc

This policy setting denies read access to the Tape Drive removable storage class.\n\n\nIf you enable this policy setting, read acc

This policy setting denies write access to the Tape Drive removable storage class.\n\n\nIf you enable this policy setting, write ac

This policy setting denies write access to the Tape Drive removable storage class.\n\n\nIf you enable this policy setting, write ac

Set the amount of time (in seconds) that the system will wait to reboot in order to enforce a change in access rights to removable s

Set the amount of time (in seconds) that the system will wait to reboot in order to enforce a change in access rights to removable s

This policy setting denies read access to removable disks, which may include media players, cellular phones, auxiliary displays, a

This policy setting denies read access to removable disks, which may include media players, cellular phones, auxiliary displays, a

This policy setting denies write access to removable disks, which may include media players, cellular phones, auxiliary displays, a

This policy setting denies write access to removable disks, which may include media players, cellular phones, auxiliary displays, a

Directs the RPC Runtime to ignore delegation failures if delegation was asked for.\n\n\nWindows Server 2003 family includes a

Directs the RPC Runtime to assume the specified timeout as the idle connection timeout even if the IIS server running the RPC

Directs the RPC Runtime to generate extended error information when an error occurs.\n\n\nExtended error information includes th

If you enable this setting, it directs the RPC Runtime on an RPC server to restrict unauthenticated RPC clients connecting to RPC

Enabling this setting directs RPC Clients that need to communicate with the Endpoint Mapper Service to authenticate as long as

\n\n\n\nDetermines whether the RPC Runtime maintains RPC state information for the system, and how much information it maintain

This policy setting allows user logon scripts to run when the logon cross-forest, DNS suffixes are not configured and NetBIOS or W

Determines how long the system waits for scripts applied by Group Policy to run.\n\n\nThis setting limits the total time allowed f

Hides the instructions in logon scripts written for Windows NT 4.0 and earlier.\n\n\nLogon scripts are batch files of instruction

Displays the instructions in logoff scripts as they run.\n\n\nLogoff scripts are batch files of instructions that run when the user l

Directs the system to wait for the logon scripts to finish running before it starts the Windows Explorer interface program and cr

Directs the system to wait for the logon scripts to finish running before it starts the Windows Explorer interface program and cr

Displays the instructions in logon scripts as they run.\n\n\nLogon scripts are batch files of instructions that run when the user lo

Displays the instructions in shutdown scripts as they run.\n\n\nShutdown scripts are batch files of instructions that run when the

Lets the system run startup scripts simultaneously.\n\n\nStartup scripts are batch files that run before the user is invited to log o

Displays the instructions in startup scripts as they run.\n\n\nStartup scripts are batch files of instructions that run before the u

This policy setting allows encrypted items to be indexed. If you enable this policy setting, indexing disregards encryption flags (ac

This policy setting allows words that contain diacritic characters to be treated as separate words. If you enable this policy setting,

Store indexer database in this directory. This directory must be located on a local fixed drive.

If enabled, Search and Indexing Options control panel applet does not allow opening the advanced options dialog. Otherwise it ca

Enable this policy setting to prevent the indexing of the content of e-mail attachments. If enabled, indexing service components (i

If enabled, files on network shares made available offline are not indexed. Otherwise they are indexed. This policy setting is not

Enable this policy setting to prevent indexing of any Microsoft Outlook items. The default behavior is to automatically index Outloo

Enable this policy setting to prevent indexing public folders in Microsoft Office Outlook. When this policy setting is disabled

Enabling this policy setting prevents indexing of mail items on a Microsoft Exchange server when Microsoft Outlook is run in unca

This policy setting specifies whether Security Center is turned on or off for computers that are joined to an Active Directory do

This policy setting allows you to set the refresh interval for Server Manager. Each refresh provides Server Manager with updated

This policy setting allows you to turn off the automatic display of the Initial Configuration Tasks window at logon. \n\n\nIf you e

This policy setting allows you to turn off the automatic display of the Manage Your Server page. \n\n\nIf you enable this policy

This policy setting allows you to turn off the automatic display of Server Manager at logon.\n\n\nIf you enable this policy settin

Specifies an alternate location for Windows installation files.\n\n\nTo enable this setting, and enter the fully qualified path to

Specifies an alternate location for Windows Service Pack installation files.\n\n\nTo enable this setting, enter the fully qualifie

Determines whether the user can publish DFS roots in Active Directory.\n\n\nIf you enable this setting or do not configure it, user

Determines whether the user can publish shared folders in Active Directory.\n\n\nIf you enable this setting or do not configure it,

By default users are allowed to share files within their profile to other users on their network once an administrator opts in the co

Prevents Windows from running the programs you specify in this setting.\n\n\nIf you enable this setting, users cannot run progr

Disables the Windows registry editor Regedit.exe.\n\n\nIf this setting is enabled and the user tries to start a registry editor, a

Prevents users from running the interactive command prompt, Cmd.exe. This setting also determines whether batch files (.cmd and

Limits the Windows programs that users have permission to run on the computer.\n\n\nIf you enable this setting, users can only

This policy setting prevents the display of the Welcome Center at user logon. \n\n\nIf you enable this policy setting, the Welcom

Sidebar gadgets can be deployed as compressed files, either digitally signed or unsigned.\nIf you enable this setting, Windows S

Sidebar gadgets can be deployed as compressed files, either digitally signed or unsigned.\nIf you enable this setting, Windows S

The Windows Sidebar contains a link to allow users to download more gadgets from a website. Microsoft hosts a default website whe

The Windows Sidebar contains a link to allow users to download more gadgets from a website. Microsoft hosts a default website whe

The Windows Sidebar will run gadgets that are located in the profile space of the user. Gadgets are small applets that are run by

The Windows Sidebar will run gadgets that are located in the profile space of the user. Gadgets are small applets that are run by

Windows Sidebar is a feature that allows the use of gadgets, which are small applets that may display information or utilities to

Windows Sidebar is a feature that allows the use of gadgets, which are small applets that may display information or utilities to

This policy setting deletes all data stored on Windows SideShow-compatible devices (running Microsoft firmware) when a user logs o

This policy setting deletes all data stored on Windows SideShow-compatible devices (running Microsoft firmware) when a user logs o

This policy setting requires users to enter a default personal identification number (PIN) to unlock and access data on the devic

This policy setting requires users to enter a default personal identification number (PIN) to unlock and access data on the devic

This policy setting turns off the option to periodically wake the computer to update information on Windows SideShow-compatible

This policy setting turns off the option to periodically wake the computer to update information on Windows SideShow-compatible

This policy setting turns off Windows SideShow.\n\n\nIf you enable this policy setting, the Windows SideShow Control Panel will

This policy setting turns off Windows SideShow.\n\n\nIf you enable this policy setting, the Windows SideShow Control Panel will

This policy setting lets you allow certificates without an Extended Key Usage (EKU) set to be used for logon.\n\n\nUnder previous

This policy setting lets you determine whether the integrated unblock feature will be available in the logon User Interface (UI).\n\

This policy setting lets you allow signature key-based certificates to be enumerated and available for logon.\n\n\nIf you enable thi

This policy setting permits those certificates to be displayed for logon that are either expired or not yet valid.\n\n\nUnder previous

This policy setting lets you determine whether an optional field will be displayed during logon and elevation that allows a user to

This policy setting allows you to manage the clean up behavior of root certificates. If you enable this policy setting then root certi

This policy setting allows you to manage the displayed message when a smart card is blocked.\n\n\nIf you enable this policy setti

This policy settings lets you configure if all your valid logon certificates are displayed.\n\n\nDuring the certificate renewal peri

This policy setting allows you to manage the reading of all certificates from the smart card for logon.\n\n\nDuring logon Windows wil

This policy setting prevents plaintext PINs from being returned by Credential Manager. \n\n\nIf you enable this policy setting, Cr

This policy setting lets you reverse the subject name from how it is stored in the certificate when displaying it during logon.

This policy setting allows you to manage the certificate propagation that occurs when a smart card is inserted.\n\n\nIf you enable o

This policy setting allows you to manage the root certificate propagation that occurs when a smart card is inserted.\n\n\nIf you ena

This policy setting allows you to set an update interval for pushing Network Information Service (NIS) maps to NIS subordinate serve

This policy setting allows you to manage the Server for Network Information Service extensive logging feature.\n\n\nIf you enable

Configures a list of the communities defined to the Simple Network Management Protocol (SNMP) service.\n\n\nSNMP is a protoc

This setting determines the permitted list of hosts that can submit a query to the Simple Network Management (SNMP) agent runn

This setting allows Trap configuration for the Simple Network Management Protocol (SNMP) agent.\n\n\nSimple Network Managemen

Specifies whether Sound Recorder can run.\n\n\nSound Recorder is a feature of Microsoft Windows Vista that can be used to recor

Specifies whether Sound Recorder can run.\n\n\nSound Recorder is a feature of Microsoft Windows Vista that can be used to recor

Lets users run a 16-bit program in a dedicated (not shared) Virtual DOS Machine (VDM) process.\n\n\nAll DOS and 16-bit progr

This policy only applies to the classic version of the start menu and does not affect the new style start menu.\n\n\nAdds the "L

If you enable this setting, the Run command is added to the Start menu. If you disable or do not configure this setting, the R

Clear history of recently opened documents on exit.\n\n\nIf you enable this setting, the system deletes shortcuts to recently u

If you enable this policy setting, the recent programs list in the start menu will be blank for each new user.\n\n\nIf you disable

This setting affects the taskbar.\n\n\nThe taskbar includes the Start button, buttons for currently running tasks, custom toolba

Prevents the operating system and installed programs from creating and displaying shortcuts to recently opened documents.\n\n\n

If you enable this policy the start menu search box will not search for communications.\n\n\nIf you disable or do not configure th

If you enable this policy the start menu search box will not search for files.\n\n\nIf you disable or do not configure this policy, th

If you enable this policy the start menu search box will not search for internet history or favorites.\n\n\nIf you disable or do not co

If you enable this policy the start menu search box will not search for programs.\n\n\nIf you disable or do not configure this poli

Prevents the system from conducting a comprehensive search of the target drive to resolve a shortcut.\n\n\nBy default, when the syst

Prevents the system from using NTFS tracking features to resolve a shortcut.\n\n\nBy default, when the system cannot find the target

This setting affects the presentation of the Start menu.\n\n\nThe classic Start menu in Windows 2000 Professional allows users

Displays Start menu shortcuts to partially installed programs in gray text.\n\n\nThis setting makes it easier for users to distingui

This setting affects the notification area (previously called the "system tray") on the taskbar.\n\n\nDescription: The notification ar

This setting affects the taskbar, which is used to switch between running applications.\n\n\nThe taskbar includes the Start button,

Removes the Taskbar and Start Menu item from Settings on the Start menu. This setting also prevents the user from opening the T

This setting affects the taskbar buttons used to switch between running programs.\n\n\nTaskbar grouping consolidates similar appl

Hides the menus that appear when you right-click the taskbar and items on the taskbar, such as the Start button, the clock, an

If you enable this setting, the "All Programs" item is removed from the simple Start menu.\n\n\nIf you disable this setting or do

This policy setting prevents users from performing the following commands from the Start menu or Windows Security screen: S

Hides pop-up text on the Start menu and in the notification area.\n\n\nWhen you hold the cursor over an item on the Start menu or i

Prevents the clock in the system notification area from being displayed.\n\n\nIf you enable this setting, the clock will not be displa

Removes items in the All Users profile from the Programs menu on the Start menu.\n\n\nBy default, the Programs menu contains it

Removes the Default Programs link from the Start menu.\n\n\nClicking the Default Programs link from the Start menu opens the D

Removes the Documents icon from the Start menu and its submenus.\n\n\nThis setting only removes the icon. It does not prevent

Prevents users from using the drag-and-drop method to reorder or remove items on the Start menu. Also, it removes context menu

Prevents users from adding the Favorites menu to the Start menu or classic Start menu.\n\n\nIf you enable this setting, the Dis

If you enable this setting, the frequently used programs list is removed from the Start menu.\n\n\nIf you disable this setting or d

If you enable this policy the start menu will not show a link to the Games folder.\n\n\nIf you disable or do not configure this poli

Removes the Help command from the Start menu.\n\n\nThis setting only affects the Start menu. It does not remove the Help m

Prevents users from connecting to the Windows Update Web site.\n\n\nThis setting blocks user access to the Windows Update We

Removes the "Log Off <username>" item from the Start menu and prevents users from restoring it.\n\n\nIf you enable this se

Removes the Music icon from the Start Menu.

Prevents users from running Network Connections.\n\n\nThis setting prevents the Network Connections folder from opening. This

Removes the Network icon from the Start Menu.

Removes the Pictures icon from the Start Menu.

If you enable this setting, the "Pinned Programs" list is removed from the Start menu, and the Internet and Email checkboxes ar

Prevents Control Panel, Printers, and Network Connections from running.\n\n\nThis setting removes the Control Panel, Printers,

Removes the Recent Items menu from the Start menu. Removes the Documents menu from the classic Start menu.\n\n\nThe Recent It

Allows you to remove the Run command from the Start menu, Internet Explorer, and Task Manager.\n\n\nIf you enable this setting,

If you enable this policy, the "See all results" link will not be shown when the user performs a search in the start menu search bo

Removes the Search link from the Start menu, and disables some Windows Explorer search elements. Note that this does not rem

If you enable this setting, the "Undock PC" button is removed from the simple Start Menu, and your PC cannot be undocked.\n\n\

If you enable this policy the start menu will not show a link to the user's storage folder.\n\n\nIf you disable or do not configure th

Remove the user name label from the Start Menu.\n\n\nNote: This setting does not apply to Windows Vista. To remove the user

Hides all folders on the user-specific (top) section of the Start menu. Other items appear, but folders are hidden.\n\n\nThis setti

This policy setting controls whether the QuickLaunch bar is displayed in the Taskbar.\n\n\nIf you enable this policy setting, the Q

This setting affects the notification area, also called the "system tray."\n\n\nThe notification area is located in the task bar, gen

Disables personalized menus.\n\n\nWindows personalizes long menus by moving recently used items to the top of the menu and hidi

Disables user tracking.\n\n\nThis setting prevents the system from tracking the programs users run, the paths they navigate, a

User folders links launch a folder view of users files instead of a library view.

This setting assigns the email address(es) to which notifications will be sent. Use a semicolon (;) to separate multiple email add

This setting assigns the address of the SMTP server that sends out notifications.\n\n\nIf you enable this setting, Windows System

This setting directs the Accounting feature to log data on the accounting server at the specified time interval.\n\n\nIf you ena

This setting turns the Accounting feature On or Off.\n\n\nIf you enable this setting, Windows System Resource Manager (WSRM) wi

Allows you to turn off the Configuration Interface for System Restore.\n\n\nSystem Restore enables users, in the event of a problem

Determines whether System Restore is turned on or off.\n\n\nSystem Restore enables users, in the event of a problem, to restore the

Prevents the Tablet PC Input Panel icon from appearing next to any text entry area in applications where this behavior is availabl

Prevents the Tablet PC Input Panel icon from appearing next to any text entry area in applications where this behavior is availabl

Prevents the Tablet PC Input Panel icon from appearing next to any text entry area in applications where this behavior is available

Prevents the Tablet PC Input Panel icon from appearing next to any text entry area in applications where this behavior is available

\n\nIncludes rarely used Chinese, Kanji, and Hanja characters when handwriting is converted to typed text. This policy applies onl

\n\nIncludes rarely used Chinese, Kanji, and Hanja characters when handwriting is converted to typed text. This policy applies onl

Prevents Input Panel tab from appearing on the edge of the Tablet PC screen.\n\n\nTablet PC Input Panel is a Tablet PC accessory

Prevents Input Panel tab from appearing on the edge of the Tablet PC screen.\n\n\nTablet PC Input Panel is a Tablet PC accessory

Switches the gesture set used for editing from the common handheld computer gestures to the Simplified Chinese (PRC) standard ges

Switches the gesture set used for editing from the common handheld computer gestures to the Simplified Chinese (PRC) standard ges

Turns off the integration of application auto complete lists with Tablet PC Input Panel in applications where this behavior is avail

Turns off the integration of application auto complete lists with Tablet PC Input Panel in applications where this behavior is avail

Adjusts password security settings in Tablet PC Input Panel. These settings include using the on-screen keyboard by default, pre

Adjusts password security settings in Tablet PC Input Panel. These settings include using the on-screen keyboard by default, pre

Turns off both the more tolerant scratch-out gestures that were added in Windows Vista and the Z-shaped scratch-out gesture that

Turns off both the more tolerant scratch-out gestures that were added in Windows Vista and the Z-shaped scratch-out gesture that

Prevents start of InkBall game.\n\n\nIf you enable this policy, the InkBall game will not run.\n\n\nIf you disable this policy, the Ink

Prevents start of InkBall game.\n\n\nIf you enable this policy, the InkBall game will not run.\n\n\nIf you disable this policy, the Ink

Prevents printing to Journal Note Writer.\n\n\nIf you enable this policy, the Journal Note Writer printer driver will not allow printing to

Prevents printing to Journal Note Writer.\n\n\nIf you enable this policy, the Journal Note Writer printer driver will not allow printing to

Prevents the snipping tool from running.\n\n\nIf you enable this policy setting, the Snipping Tool will not run.\n\n\nIf you disable th

Prevents the snipping tool from running.\n\n\nIf you enable this policy setting, the Snipping Tool will not run.\n\n\nIf you disable th

Prevents start of Sticky Notes.\n\n\nIf you enable this policy, the Sticky Notes accessory will not run.\n\n\nIf you disable this pol

Prevents start of Sticky Notes.\n\n\nIf you enable this policy, the Sticky Notes accessory will not run.\n\n\nIf you disable this pol

Prevents start of Windows Journal.\n\n\nIf you enable this policy, the Windows Journal accessory will not run.\n\n\nIf you disable

Prevents start of Windows Journal.\n\n\nIf you enable this policy, the Windows Journal accessory will not run.\n\n\nIf you disable

Removes the Back->ESC mapping that normally occurs when menus are visible, and for applications that subscribe to this behav

Removes the Back->ESC mapping that normally occurs when menus are visible, and for applications that subscribe to this behav

Makes pen flicks and all related features unavailable.\n\n\nIf you enable this policy, pen flicks and all related features are unavaila

Makes pen flicks and all related features unavailable.\n\n\nIf you enable this policy, pen flicks and all related features are unavaila

Makes pen flicks learning mode unavailable.\n\n\nIf you enable this policy, pen flicks are still available but learning mode is not.

Makes pen flicks learning mode unavailable.\n\n\nIf you enable this policy, pen flicks are still available but learning mode is not.

Prevents the user from launching an application from a Tablet PC hardware button.\n\n\nIf you enable this policy, applications

Prevents the user from launching an application from a Tablet PC hardware button.\n\n\nIf you enable this policy, applications

Prevents press and hold actions on hardware buttons, so that only one action is available per button.\n\n\nIf you enable this policy

Prevents press and hold actions on hardware buttons, so that only one action is available per button.\n\n\nIf you enable this policy

Turns off Tablet PC hardware buttons.\n\n\nIf you enable this policy, no actions will occur when the buttons are pressed, and th

Turns off Tablet PC hardware buttons.\n\n\nIf you enable this policy, no actions will occur when the buttons are pressed, and th

Disables visual pen action feedback, except for press and hold feedback.\n\n\nIf you enable this policy, all visual pen action fe

Disables visual pen action feedback, except for press and hold feedback.\n\n\nIf you enable this policy, all visual pen action fe

Prevents the user from making any changes to the taskbar settings through the Taskbar Properties dialog.\n\n\nIf you enable this se

Prevents users from adding or removing toolbars.\n\n\nIf you enable this policy setting the user will not be allowed to add or remov

Prevents users from moving taskbar to another screen dock location.\n\n\nIf you enable this policy setting the user will not be able

Prevents users from rearranging toolbars.\n\n\nIf you enable this setting the user will not be able to drag or drop toolbars to the t

Prevent users from resizing the taskbar.\n\n\nIf you enable this policy setting the user will not be able to resize their taskbar to b

Prevents the battery meter in the system control area from being displayed. If you enable this setting, the battery meter will not be

Prevents the networking icon in the system control area from being displayed. If you enable this setting, the networking icon will n

Prevents the volume control icon in the system control area from being displayed. If you enable this setting, the volume control ico

If you enable this setting no notification balloons will be shown to the user.\n\n\nIf you disable or do not configure this setting bal

If you enable this setting the taskbar thumbnails will not be shown, and the system will use standard text for the tooltips.\n\n\nIf

This setting removes the "Open advanced properties for this task when I click Finish" checkbox from the last page of the Schedul

This setting removes the "Open advanced properties for this task when I click Finish" checkbox from the last page of the Schedul

Prevents users from viewing and changing the properties of an existing task.\n\n\nThis setting removes the Properties item from

Prevents users from viewing and changing the properties of an existing task.\n\n\nThis setting removes the Properties item from

Prevents users from starting and stopping tasks manually.\n\n\nThis setting removes the Run and End Task items from the context

Prevents users from starting and stopping tasks manually.\n\n\nThis setting removes the Run and End Task items from the context

Limits newly scheduled to items on the user's Start menu, and prevents the user from changing the scheduled program for existin

Limits newly scheduled to items on the user's Start menu, and prevents the user from changing the scheduled program for existin

Prevents users from adding or removing tasks by moving or copying programs in the Scheduled Tasks folder.\n\n\nThis setting di

Prevents users from adding or removing tasks by moving or copying programs in the Scheduled Tasks folder.\n\n\nThis setting di

Prevents users from creating new tasks.\n\n\nThis setting removes the Add Scheduled Task item that starts the New Task Wizard.

Prevents users from creating new tasks.\n\n\nThis setting removes the Add Scheduled Task item that starts the New Task Wizard.

Prevents users from deleting tasks from the Scheduled Tasks folder.\n\n\nThis setting removes the Delete command from the Edit

Prevents users from deleting tasks from the Scheduled Tasks folder.\n\n\nThis setting removes the Delete command from the Edit

This policy setting allows you to specify whether users can run unsigned Remote Desktop Protocol (.rdp) files and .rdp files from

This policy setting allows you to specify whether users can run unsigned Remote Desktop Protocol (.rdp) files and .rdp files from

This policy setting allows you to specify whether users can run Remote Desktop Protocol (.rdp) files from a publisher that signed t

This policy setting allows you to specify whether users can run Remote Desktop Protocol (.rdp) files from a publisher that signed t

Specifies whether users can choose where to play the remote computer's audio output during a Terminal Services session (audio r

This policy setting determines whether the client computer redirects its time zone settings to the Terminal Services session.\n\n\

This policy setting allows you to configure remote access to computers using Terminal Services.\n\n\nIf you enable this polic

Specifies whether Terminal Services always prompts the client for a password upon connection. \n\n\nYou can use this setting to

This policy setting determines whether the desktop is always displayed after a client connects to a remote computer or an initial

Specifies whether to allow Remote Desktop Connection clients to automatically reconnect to Terminal Services sessions if their n

This policy setting allows you to enter a keep-alive interval to ensure that the session state on the terminal server is consistent

This policy setting allows you to specify whether the client will establish a connection to the terminal server when the client cann

This policy setting allows you to specify the name of a farm to join in TS Session Broker. TS Session Broker uses the farm nam

This policy setting allows you to specify the TS Session Broker server that the terminal server uses to track and redirect user

This policy setting determines whether an administrator attempting to connect remotely to the console of a server can log off an ad

This policy setting allows you to specify whether to prevent the mapping of client printers in Terminal Services sessions. \n\n\nYou

Specifies whether to prevent the sharing of clipboard contents (clipboard redirection) between a remote computer and a client comp

Specifies whether to prevent the redirection of data to client COM ports from the remote computer in a Terminal Services session.

Specifies whether to prevent the mapping of client drives in a Terminal Services session (drive redirection). \n\n\nBy default, Ter

Specifies whether to disable the administrator rights to customize security permissions in the Terminal Services Configuration to

Specifies whether to prevent the redirection of data to client LPT ports during a Terminal Services session. \n\n\nYou can use this

Controls whether passwords can be saved on this computer from Terminal Services clients.\n\n\nIf you enable this setting the pas

Controls whether a user can save passwords using a Terminal Services client.\n\n\nIf you enable this setting the password saving

This policy setting allows you to control the redirection of smart card devices in a Terminal Services session.\n\n\nIf you enabl

This policy setting allows you to control the redirection of supported Plug and Play devices, such as Windows Portable Devices,

Specifies whether Terminal Services retains a user's per-session temporary folders at logoff. \n\n\nYou can use this setting to mai

This policy setting allows you to specify whether the client default printer is automatically set as the default printer in a Termina

This policy setting allows you to prevent Terminal Services from creating session-specific temporary folders.\n\n\nYou can use th

If you enable this policy setting, when Terminal Services clients cannot connect directly to a remote computer (a terminal server

Specifies whether desktop wallpaper is displayed to remote clients connecting via Terminal Services. \n\n\nYou can use this sett

This policy setting determines whether notifications are displayed on a terminal server when there are problems with TS Licensing tha

This policy setting allows you to specify whether the terminal server should join a farm in TS Session Broker. TS Session Broker

This policy setting allows you to specify the terminal servers to which a Terminal Services license server will offer Terminal

This policy setting allows you to specify the maximum color resolution (color depth) for Terminal Services connections.\n\n\nYou

Specifies whether Terminal Services limits the number of simultaneous connections to the server. \n\n\nYou can use this setting

This policy setting allows you to specify which version of Terminal Services client access license (TS CAL) a Terminal Services

This policy setting determines whether a user will be prompted on the client computer to provide credentials for a remote connect

This policy setting allows you to remove the "Disconnect" option from the Shut Down Windows dialog box on Terminal Services cli

Specifies whether to remove the Windows Security item from the Settings menu on Terminal Services clients. You can use this se

Specifies whether a Terminal Server requires secure RPC communication with all clients or allows unsecured communication.\n\n\n

Specifies whether to require the use of a specific security layer to secure communications between clients and terminal servers

This policy setting allows you to specify whether to require user authentication for remote connections to the terminal server b

This policy setting allows you to restrict users to a single remote Terminal Services session.\n\n\nIf you enable this policy setti

This policy setting allows you to specify the name of the certificate template that determines which certificate is automatically sel

Specifies whether to require the use of a specific encryption level to secure communications between clients and terminal server

This policy setting allows you to specify which Remote Desktop Protocol (RDP) compression algorithm to use.\n\n\nBy default, se

This policy setting allows you to specify the network path that Terminal Services uses for roaming user profiles.\n\n\nBy default

This policy setting allows you to specify the level of remote control permitted in a Terminal Services session.\n\n\nYou can use t

This policy setting allows you to specify the level of remote control permitted in a Terminal Services session.\n\n\nYou can use t

This policy setting allows you to specify the type of Terminal Services client access license (TS CAL) that is required to connect

This policy setting allows you to specify the maximum amount of time that an active Terminal Services session can be idle (witho

This policy setting allows you to specify the maximum amount of time that an active Terminal Services session can be idle (witho

This policy setting allows you to specify the maximum amount of time that a Terminal Services session can be active before it is

This policy setting allows you to specify the maximum amount of time that a Terminal Services session can be active before it is

This policy setting allows you to configure a time limit for disconnected Terminal Services sessions.\n\n\nYou can use this polic

This policy setting allows you to configure a time limit for disconnected Terminal Services sessions.\n\n\nYou can use this polic

Specifies the authentication method that clients must use when attempting to connect to a terminal server through a TS Gateway serv

Specifies the address of the TS Gateway server that clients must use when attempting to connect to a terminal server. You can enf

Specifies whether Terminal Services uses the specified network share or local directory path as the root of the user's home direc

This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA1) certificate thumbprints that represent trusted Remo

This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA1) certificate thumbprints that represent trusted Remo

This policy setting allows you to specify the terminal server fallback printer driver behavior.\n\n\nBy default, the terminal server fa

Configures Terminal Services to run a specified program automatically upon connection.\n\n\nYou can use this setting to specify a

Configures Terminal Services to run a specified program automatically upon connection.\n\n\nYou can use this setting to specify a

Specifies whether to terminate a timed-out Terminal Services session instead of disconnecting it. \n\n\nYou can use this setting to

Specifies whether to terminate a timed-out Terminal Services session instead of disconnecting it. \n\n\nYou can use this setting to

This policy setting allows you to specify the redirection method to use when a client device reconnects to an existing Terminal Se

This policy setting allows you to specify whether Terminal Services uses a mandatory profile for all users connecting remotely to t

This policy setting allows you to specify the order in which a terminal server attempts to locate Terminal Services license severs

This policy setting allows you to specify whether remote users can start any program on the terminal server when they start a

This policy setting allows you to specify whether the client computer redirects its time zone settings to the Terminal Services se

This policy setting allows you to specify whether the desktop is always displayed after a client connects to a remote computer or w

This policy setting allows you to specify whether to prevent the sharing of clipboard contents (clipboard redirection) between a r

This policy setting allows you to specify whether the default client printer is the only printer redirected in Terminal Services sessi

This policy setting allows you to specify whether the default client printer is the only printer redirected in Terminal Services sessi

This policy setting allows you to specify whether desktop wallpaper is displayed to clients when they are connected to a remote s

This policy setting allows you to specify how long a user's RemoteApp session will remain in a disconnected state before the ses

This policy setting allows you to specify how long a user's RemoteApp session will remain in a disconnected state before the ses

This policy setting allows you to specify whether the Terminal Services Easy Print printer driver is used first to install all client pr

This policy setting allows you to specify whether the Terminal Services Easy Print printer driver is used first to install all client pr

This policy setting allows you to specify whether to use the TS Session Broker load balancing feature to balance the load between

Turns off the caching of thumbnails in hidden thumbs.db files.\n\n\nThis policy setting allows you to configure Windows Explorer t

Disables the display of thumbnails on network folders in Windows Explorer.\n\n\nWindows Explorer displays thumbnails on network

Disables the display of thumbnails in Windows Explorer.\n\n\nWindows Explorer displays thumbnails by default.\n\n\nIf you enabl

Turn off Tablet PC touch input\n\n\nTurns off touch input, which allows the user to interact with their computer using their finger.\

Turn off Tablet PC touch input\n\n\nTurns off touch input, which allows the user to interact with their computer using their finger.\

This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands blocked by Window

This policy setting allows you to enforce or ignore the computer's default list of blocked Trusted Platform Module (TPM) comma

This policy setting allows you to enforce or ignore the computer's local list of blocked Trusted Platform Module (TPM) command

This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of Trusted Platform Module (TPM

This setting lets you prevent users from selecting a local disk (internal or external) for storing file backups.\n\n\nIf this setting is

This setting lets you prevent users from selecting a local disk (internal or external) for storing file backups.\n\n\nIf this setting is

This setting lets you prevent users from selecting a network shared folder for storing file backups.\n\n\nIf this setting is enabled,

This setting lets you prevent users from selecting a network shared folder for storing file backups.\n\n\nIf this setting is enabled,

This setting lets you prevent users from selecting optical media (CD/DVD) for storing file backups.\n\n\nIf this setting is enabled,

This setting lets you prevent users from selecting optical media (CD/DVD) for storing file backups.\n\n\nIf this setting is enabled,

This setting lets you disable the Backup Status and Configuration program, which links to the file backup, file restore, and Com

This setting lets you disable the Backup Status and Configuration program, which links to the file backup, file restore, and Com

This setting lets you disable file backup functionality.\n\n\nIf this setting is enabled, the file backup program is disabled.\n\n\nIf

This setting lets you disable file backup functionality.\n\n\nIf this setting is enabled, the file backup program is disabled.\n\n\nIf

This setting lets you disable Complete PC Backup functionality.\n \nIf this setting is enabled, the Complete PC Backup pro

This setting lets you disable Complete PC Backup functionality.\n \nIf this setting is enabled, the Complete PC Backup pro

This setting lets you disable file restore functionality.\n\n\nIf this setting is enabled, the file restore program is disabled.\n\n\nIf

This setting lets you disable file restore functionality.\n\n\nIf this setting is enabled, the file restore program is disabled.\n\n\nIf

This setting adds the Administrator security group to the roaming user profile share.\n\n\nOnce an administrator has configured a us

Restores the definitions of the %HOMESHARE% and %HOMEPATH% environment variables to those used in Windows NT 4.0 and earlier

Determines whether the system saves a copy of a user’s roaming profile on the local computer's hard drive when the user logs off.\

This policy setting allows an administrator to automatically delete user profiles on system restart that have not been used within

This setting disables the more secure default setting for the user’s roaming user profile folder.\n\n\nOnce an administrator has c

Disables the slow link detection feature.\n\n\nSlow link detection measures the speed of the connection between a user's computer

Microsoft Windows will always unload the users registry, even if there are any open handles to the per-user registry keys at user l

This policy will automatically log off a user when Windows cannot load their profile.\n\n\nIf Windows cannot access the user profil

Lets you add to the list of folders excluded from the user's roaming profile.\n\n\nThis setting lets you exclude folders that are n

Determines whether the system retains a roaming user’s Windows Installer and Group Policy based software installation data on thei

This policy setting sets the maximum size of each user profile and determines the system's response when a user profile reaches th

Determines how many times the system tries to unload and update the registry portion of a user profile. When the number of trials

This policy setting allows you to specify which network directories will be synchronized only at logon and logoff via Offline Files.

This setting determines if roaming user profiles are available on a particular computer. By default, when roaming profile users log

This setting determines if the changes a user makes to their roaming profile are merged with the server copy of their profile.\n\n\

This policy setting provides users with the ability to download their roaming profile, even when a slow network connection with t

If the user has a roaming user profile or remote home directory and the network is currently unavailable, Microsoft Windows waits

Specifies whether Microsoft Windows should use the specified network path as the roaming user profile path for all users logging on

Defines a slow connection for roaming user profiles.\n\n\nIf the server on which the user's roaming user profile resides takes lo

Determines how long the system waits for a user response before it uses a default value.\n\n\nThe default value is applied when

Directs the system to wait for the remote copy of the roaming user profile to load, even when loading is slow. Also, the system wai

This policy setting allows you to configure the algorithm and key size used by BitLocker Drive Encryption. This policy setting app

This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the Bit

This policy setting allows you to specify the default path that is displayed when the BitLocker Drive Encryption setup wizard promp

This policy setting allows you to configure whether the BitLocker Drive Encryption setup wizard will ask the user to save BitLock

This policy setting allows you to configure whether the BitLocker Drive Encryption setup wizard will ask the user to set up an ad

This policy setting controls computer restart performance at the risk of exposing BitLocker secrets. BitLocker secrets include ke

This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of BitLocker Drive Encryption re

Specifies whether the Windows NTP Client synchronizes time from the domain hierarchy or a manually configured NTP server. Spe

Specifies whether the Windows NTP Client is enabled. Enabling the Windows NTP Client allows your computer to synchronize its

Specifies whether the Windows NTP Server is enabled. Enabling the Windows NTP Server allows your computer to service NTP

Specifies a set of parameters for all time providers installed on your system. There are two sets of parameters: clock discipl

Determines the execution level for Diagnostic Policy Service (DPS) scenarios.\n\n\nIf you enable this policy setting, you must sele

Determines the data retention limit for Diagnostic Policy Service (DPS) scenario data.\n\n\nIf you enable this policy setting, you

Windows Calendar is a feature that allows users to manage appointments and tasks by creating personal calendars, publishing the

Windows Calendar is a feature that allows users to manage appointments and tasks by creating personal calendars, publishing the

This policy setting allows you to manage whether backups of only system volumes is allowed or both OS and data volumes can b

This policy setting allows you to manage whether backups of a machine can run to locally attached storage or not.\n\n\nIf you ena

This policy setting allows you to manage whether backups of a machine can run to a network share or not.\n\n\nIf you enable this

This policy setting allows you to manage whether backups of a machine can run to an optical media or not.\n\n\nIf you enable thi

This policy setting allows you to manage whether run-once backups of a machine can be run or not.\n\n\nIf you enable this polic

Windows Meeting Space is a feature that enables quick, face-to-face collaboration for sharing programs and handouts and for pas

Windows Meeting Space is a feature that enables quick, face-to-face collaboration for sharing programs and handouts and for pas

Windows Meeting Space is a feature that enables quick, face-to-face collaboration for sharing programs and handouts and for passi

Windows Meeting Space is a feature that enables quick, face-to-face collaboration for sharing programs and handouts and for passi

This policy setting affects the ability of users to install or uninstall color profiles.\n\n\nIf you enable this policy setting, users will

This policy setting affects the ability of users to install or uninstall color profiles.\n\n\nIf you enable this policy setting, users will

This policy setting allows the configuration of wireless settings using Windows Connect Now (WCN). The WCN Registrar enables the

This policy setting prohibits access to Windows Connect Now (WCN) wizards. If this policy setting is enabled, the wizards are disab

This policy setting prohibits access to Windows Connect Now (WCN) wizards. If this policy setting is enabled, the wizards are disab

Checks for new signatures before running scheduled scans.\n\n\nIf you enable this policy setting, the scheduled scan checks for

Adjusts membership in Microsoft SpyNet. \n\n\nMicrosoft SpyNet is the online community that helps you choose how to respond to

Downloads the full signature set, rather than only the signatures that have been updated since the last signature download. Downloa

Enables logging detection data during Real-time Protection when Windows Defender detects known good files. Logging detections pro

Enables logging detections during Real-time Protection when Windows Defender detects unknown files. Logging detections provides y

Turns off Real-Time Protection (RTP) prompts for unknown detection.\n\n\nIf you enable this policy setting, Windows Defender do

Turns off Windows Defender Real-Time Protection, and no more scans are scheduled.\n\n\nIf you enable this policy setting, Win

This policy setting allows you to configure Windows Defender to check and install definition updates from Windows Update when

This setting is designed to ensure that shell extensions can operate on a per-user basis. If you enable this setting, Windows

Allows you to have Windows Explorer display a confirmation dialog whenever a file is deleted or moved to the Recycle Bin.\n\n\nIf

When a file or folder is deleted in Windows Explorer, a copy of the file or folder is placed in the Recycle Bin. Using this setting

Prevents users from submitting alternate logon credentials to install a program.\n\n\nThis setting suppresses the "Install Program

Determines whether Windows traces shortcuts back to their sources when it cannot find the target on the user's system.\n\n\nShortcut

Hide the Back button in the Open dialog box.\n\n\nThis policy setting lets you remove new features added in Microsoft Windows 20

Removes the shortcut bar from the Open dialog box.\n\n\nThis setting, and others in this folder, lets you remove new features a

Removes the list of most recently used files from the Open dialog box.\n\n\nIf you disable this setting or do not configure it, th

Removes the icons representing selected hard drives from My Computer and Windows Explorer. Also, the drive letters representing t

Removes the Manage item from the Windows Explorer context menu. This context menu appears when you right-click Windows Ex

Configures the list of items displayed in the Places Bar in the Windows File/Open dialog. If enable this setting you can specify

Limits the percentage of a volume's disk space that can be used to store deleted files.\n\n\nIf you enable this setting, the user

Determines how many shortcuts the system can display in the Documents menu on the Start menu.\n\n\nThe Documents menu cont

Removes computers in the user's workgroup and domain from lists of network resources in Windows Explorer and Network Locati

Removes all computers outside of the user's workgroup or local domain from lists of network resources in Windows Explorer and

Prevents users from using My Computer to gain access to the content of selected drives.\n\n\nIf you enable this setting, users ca

Prevents users from using Windows Explorer or Network Locations to map or disconnect network drives.\n\n\nIf you enable this s

Windows Explorer allows you to create and modify re-writable CDs if you have a CD writer connected to your PC.\n\n\nIf you enabl

Removes the DFS tab from Windows Explorer.\n\n\nThis setting removes the DFS tab from Windows Explorer and from other progr

Removes the File menu from My Computer and Windows Explorer.\n\n\nThis setting does not prevent users from using other met

Removes the Hardware tab.\n\n\nThis setting removes the Hardware tab from Mouse, Keyboard, and Sounds and Audio Devices in Con

Removes the Search button from the Windows Explorer toolbar.\n\n\nThis setting removes the Search button from the Standard

Removes the Security tab from Windows Explorer.\n\n\nIf you enable this setting, users opening the Properties dialog box for all file

Removes the Shared Documents folder from My Computer.\n\n\nWhen a Windows client is in a workgroup, a Shared Documents icon

Disables the "Hide keyboard navigation indicators until I use the ALT key" option in Display in Control Panel.\n\n\nWhen this Di

Prevents users from selecting the option to animate the movement of windows, menus, and lists.\n\n\nIf you enable this setting, t

Removes shortcut menus from the desktop and Windows Explorer. Shortcut menus appear when you right-click an item.\n\n\nIf yo

Removes the Folder Options item from all Windows Explorer menus and removes the Folder Options item from Control Panel. As a r

Prompts users for alternate logon credentials during network-based installations.\n\n\nThis setting displays the "Install Program

This settings controls whether the thumbnail views are cached.\n\n\nIf you enable this setting, thumbnail views are not cached.\

This policy setting allows you to configure the amount of functionality that the shell protocol can have. When using the full functio

This policy setting allows you to configure the amount of functionality that the shell protocol can have. When using the full functio

Turn off Windows+X hotkeys.\n\n\nKeyboards with a Windows key provide users with shortcuts to common shell features. For exa

This setting allows an administrator to revert specific Windows Shell behavior to classic Shell behavior.\n\n\nIf you enable thi

Hides the file scan progress window.\n\n\nThis window provides status information to sophisticated users, but it might confuse nov

Specifies the maximum amount of disk space that can be used for the Windows File Protection file cache.\n\n\nWindows File Prot

Determines when Windows File Protection scans protected files. This setting directs Windows File Protection to enumerate and scan

Specifies an alternate location for the Windows File Protection cache.\n\n\nTo enable this setting, enter the fully qualified loca

Allows unsolicited incoming messages from specified systems that authenticate using the IPSec transport.\n\n\nIf you enable this

Defines the set of Internet Control Message Protocol (ICMP) message types that Windows Firewall allows. Utilities can use ICMP

Defines the set of Internet Control Message Protocol (ICMP) message types that Windows Firewall allows. Utilities can use ICMP

Allows inbound file and printer sharing. To do this, Windows Firewall opens UDP ports 137 and 138, and TCP ports 139 and 445.\n

Allows inbound file and printer sharing. To do this, Windows Firewall opens UDP ports 137 and 138, and TCP ports 139 and 445.\n

Allows remote administration of this computer using administrative tools such as the Microsoft Management Console (MMC) and

Allows remote administration of this computer using administrative tools such as the Microsoft Management Console (MMC) and

Allows this computer to receive inbound Remote Desktop requests. To do this, Windows Firewall opens TCP port 3389.\n\n\nIf you

Allows this computer to receive inbound Remote Desktop requests. To do this, Windows Firewall opens TCP port 3389.\n\n\nIf you

Allows this computer to receive unsolicited inbound Plug and Play messages sent by network devices, such as routers with built

Allows this computer to receive unsolicited inbound Plug and Play messages sent by network devices, such as routers with built

Allows administrators to use the Windows Firewall component in Control Panel to define a local port exceptions list. Windows Firewa

Allows administrators to use the Windows Firewall component in Control Panel to define a local port exceptions list. Windows Firewa

Allows administrators to use the Windows Firewall component in Control Panel to define a local program exceptions list. Windows Fi

Allows administrators to use the Windows Firewall component in Control Panel to define a local program exceptions list. Windows Fi

Allows Windows Firewall to record information about the unsolicited incoming messages that it receives.\n\n\nIf you enable this p

Allows Windows Firewall to record information about the unsolicited incoming messages that it receives.\n\n\nIf you enable this p

Allows you to view and change the inbound port exceptions list defined by Group Policy. Windows Firewall uses two port exception l

Allows you to view and change the inbound port exceptions list defined by Group Policy. Windows Firewall uses two port exception l

Allows you to view and change the program exceptions list defined by Group Policy. Windows Firewall uses two program exception li

Allows you to view and change the program exceptions list defined by Group Policy. Windows Firewall uses two program exception li

Specifies that Windows Firewall blocks all unsolicited incoming messages. This policy setting overrides all other Windows Firewal

Specifies that Windows Firewall blocks all unsolicited incoming messages. This policy setting overrides all other Windows Firewal

Prevents Windows Firewall from displaying notifications to the user when a program requests that Windows Firewall add the progra

Prevents Windows Firewall from displaying notifications to the user when a program requests that Windows Firewall add the progra

Prevents this computer from receiving unicast responses to its outgoing multicast or broadcast messages.\n\n\nIf you enable th

Prevents this computer from receiving unicast responses to its outgoing multicast or broadcast messages.\n\n\nIf you enable th

Turns on Windows Firewall.\n\n\nIf you enable this policy setting, Windows Firewall runs and ignores the "Computer Configuratio

Turns on Windows Firewall.\n\n\nIf you enable this policy setting, Windows Firewall runs and ignores the "Computer Configuratio

Windows Mail will not check your newsgroup servers for Communities support.

Windows Mail will not check your newsgroup servers for Communities support.

Denies or allows access to the Windows Mail application.\n\n\nIf you enable this setting, access to the Windows Mail application i

Denies or allows access to the Windows Mail application.\n\n\nIf you enable this setting, access to the Windows Mail application i

Prevents Windows Media Digital Rights Management (DRM) from accessing the Internet (or intranet).\n\n\nWhen enabled, Windows Me

Enables a screen saver to interrupt playback.\n\n\nThis policy displays a screen saver during playback of digital media accordin

Specifies the HTTP proxy settings for Windows Media Player.\n\n\nThis policy specifies the proxy settings for the HTTP protocol

Specifies the MMS proxy settings for Windows Media Player.\n\n\nThis policy specifies the proxy settings for the MMS protocol. W

Specifies whether network buffering uses the default or a specified number of seconds.\n\n\nThis policy specifies that the defaul

Specifies the RTSP proxy settings for Windows Media Player.\n\n\nThis policy specifies the proxy settings for the RTSP protocol

Prevents the anchor window from being displayed when Windows Media Player is in skin mode.\n\n\nThis policy hides the anchor w

Do Not Show First Use Dialog Boxes\n\n\nThis policy prevents the Privacy Options and Installation Options dialog boxes from bein

Hides the Network tab.\n\n\nThis policy hides the Network tab in Windows Media Player. The default network settings are used un

Hides the Privacy tab.\n\n\nThis policy hides the Privacy tab in Windows Media Player. The default privacy settings are used for

Hides the Security tab.\n\n\nThis policy hides the Security tab in Windows Media Player. The default security settings for the opt

Prevents users from being prompted to update Windows Media Player.\n\n\nThis policy prevents the Player from being updated and

Prevents media information for CDs and DVDs from being retrieved from the Internet.\n\n\nThis policy prevents the Player from a

Prevents Windows Media Player from downloading codecs.\n\n\nThis policy prevents the Player from automatically downloading co

This policy prevents a shortcut icon for the Player from being added to the user's desktop.\n\n\nWhen this policy is not configur

Prevents media sharing from Windows Media Player.\n\n\nThis policy prevents any user on this computer from sharing digital m

Prevents media information for music files from being retrieved from the Internet.\n\n\nThis policy prevents the Player from au

This policy prevents a shortcut for the Player from being added to the Quick Launch bar.\n\n\nWhen this policy is not configured

Prevents radio station presets from being retrieved from the Internet.\n\n\nThis policy prevents the Player from automatically retri

Prevents video smoothing from occurring.\n\n\nThis policy prevents video smoothing, which can improve video playback on compu

Enables Windows Media Player to be shown only in skin mode, using a specified skin.\n\n\nThis policy displays the Player only in

Specifies that Windows Media Player can attempt to use selected protocols when receiving streaming media from a server running

Allows you to disable Windows Messenger.\n\n\nIf you enable this setting, Windows Messenger will not run.\n\n\nIf you disable

Allows you to disable Windows Messenger.\n\n\nIf you enable this setting, Windows Messenger will not run.\n\n\nIf you disable

Windows Messenger is automatically loaded and running when a user logs on to a Windows XP computer. You can use this setting

Windows Messenger is automatically loaded and running when a user logs on to a Windows XP computer. You can use this setting

This policy setting allows you to manage whether the Windows Remote Management (WinRM) service automatically listens on the net

This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Basic authentication.\n\n\nI

This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Basic authentication fro

This policy setting allows you to manage whether the Windows Remote Management (WinRM) client sends and receives unencrypte

This policy setting allows you to manage whether the Windows Remote Management (WinRM) service sends and receives unencrypt

This policy setting allows you to manage whether the Windows Remote Management (WinRM) client will not use Digest authentication.

This policy setting allows you to manage whether the Windows Remote Management (WinRM) client will not use Kerberos authenticat

This policy setting allows you to manage whether the Windows Remote Management (WinRM) service will not accept Kerberos credent

This policy setting allows you to manage whether the Windows Remote Management (WinRM) client will not use Negotiate authenticat

This policy setting allows you to manage whether the Windows Remote Management (WinRM) service will not accept Negotiate authent

This policy setting allows you to manage whether Windows Remote Management (WinRM) client uses the list specified in TrustedHostsL

Configures access to remote shells.\n\n\nIf you enable this policy setting and set it to False, new remote shell connections will be

Configures the maximum number of users able to concurrently perform remote operations on the same system using remote CMD shell.

Configures maximum time in milliseconds remote shell will stay open without any user activity until it is automatically deleted.\n\

Configures maximum total amount of memory that can be allocated by any active remote shell and all its child processes.\n\n\nAny

Configures the maximum number of processes any shell operations are allowed to launch.\n\n\nAny number from 0 to 0x7FFFFFFF can

Configures maximum number of concurrent shells any user can remotely open on the same system.\n\n\nAny number from 0 to 0x7FFFFF

Configures maximum time in milliseconds that the remote command or script will be allowed to execute.\n\n\n Any value from

Specifies whether Automatic Updates should automatically install certain updates that neither interrupt Windows services nor resta

Specifies whether, when logged on, non-administrative users will receive update notifications based on the configuration settings

This policy setting allows you to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when t

Specifies the hours that Windows will use to determine how long to wait before checking for available updates. The exact wait time

Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updatin

Specifies the amount of time for Automatic Updates to wait before proceeding with a scheduled restart.\n\n\nIf the status is set to

This policy setting allows you to manage whether the 'Install Updates and Shut Down' option is allowed to be the default choice

This policy setting allows you to manage whether the 'Install Updates and Shut Down' option is allowed to be the default choice

This policy setting allows you to manage whether the 'Install Updates and Shut Down' option is displayed in the Shut Down Window

This policy setting allows you to manage whether the 'Install Updates and Shut Down' option is displayed in the Shut Down Window

Specifies the target group name or names that should be used to receive updates from an intranet Microsoft update service.\n\n\nIf

Specifies whether the Windows Update will use the Windows Power Management features to automatically wake up the system from hi

Specifies that to complete a scheduled installation, Automatic Updates will wait for the computer to be restarted by any user who i

This setting allows you to remove access to Windows Update.\n\n\nIf you enable this setting, all Windows Update features are

Specifies the amount of time for Automatic Updates to wait before prompting again with a scheduled restart.\n\n\nIf the status is

Specifies the amount of time for Automatic Updates to wait, following system startup, before proceeding with a scheduled installati

Specifies an intranet server to host updates from Microsoft Update. You can then use this update service to automatically update

Specifies whether Automatic Updates will deliver both important as well as recommended updates from the Windows Update updat

This setting controls automatic updates to a user's computer.\n\n\nWhenever a user connects to the Internet, Windows searches

The number of minutes the system will wait for the hung logon sessions before proceeding with the system shutdown.\n\n\nIf this se

This policy controls the legacy remote shutdown interface (named pipe). The named pipe remote shutdown interface is needed in

Specifies an alternate user interface.\n\n\nThe Explorer program (%windir%\explorer.exe) creates the familiar Windows interface, bu

This policy setting controls whether or not software can simulate the Secure Attention Sequence (SAS).\n\n\nIf you enable this po

This policy setting controls whether or not the system displays information about previous logons and logon failures to the use

This policy controls whether the logged on user should be notified when his logon hours are about to expire. By default, a user is

This policy controls whether the logged on user should be notified if the logon server could not be contacted during logon and he

This policy controls whether the logged on user should be notified if the logon server could not be contacted during logon and he

This policy controls which action will be taken when the logon hours expire for the logged on user. The actions include lock the

This policy setting specifies whether Windows will allow console applications and GUI applications without visible top-level wind

Set up the menu name and URL for the custom Internet search provider.\n\n\nIf you enable this setting, the specified menu name an

Reboot Required Logoff Required Active Directory Schema or Domain RequirementsNo No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No Yes None

No Yes None

No Yes None

No Yes None

No Yes None

No Yes None

No Yes None

No Yes None

No Yes None

No Yes None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No Yes None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No no None

No No None

No No None

No No None

No No Yes

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No Yes

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No no None

No No None

No No None

No No None

No no None

No no None

No no None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No Yes None

No Yes None

No No None

No No None

No No None

No No Yes

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No Yes

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

Yes No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

No No None

Yes No None

No Yes None

No No None

No No None

No No None

No Yes None

No Yes None

No Yes None

No No None

No No None

Policy Path

Computer Configuration\Windows Settings\Account Policies\Password Policy






Computer Configuration\Windows Settings\Account Policies\Account Lockout Policy



Computer Configuration\Windows Settings\Local Policies\Kerberos Policy





Computer Configuration\Windows Settings\Local Policies\Audit Policy









Computer Configuration\Windows Settings\Local Policies\User Rights Assignment













































Computer Configuration\Windows Settings\Local Policies\Security Options



















































































Computer Configuration\Windows Settings\Security Settings\Event Log












Computer Configuration\Windows Settings\Security Settings\Restricted Groups

Computer Configuration\Windows Settings\Security Settings\System Services

Computer Configuration\Windows Settings\Security Settings\Registry

Computer Configuration\Windows Settings\Security Settings\File System

Full Policy Name

Enforce password history

Maximum password age

Minimum password age

Minimum password length

Password must meet complexity requirement

Store passwords using reversible encryption for all users in the domain

Account lockout duration

Account lockout threshold

Reset lockout counter after

Enforce user logon restrictions

Maximum lifetime for service ticket

Maximum lifetime for user ticket

Maximum lifetime for user ticket renewal

Maximum tolerance for computer clock synchronization

Audit account logon events

Audit account management

Audit directory service access

Audit logon events

Audit object access

Audit policy change

Audit privilege use

Audit process tracking

Audit system events

Access this computer from the network

Access Credential Manager as a trusted caller

Act as part of the operating system

Add workstations to a domain

Adjust memory quotas for a process

Allow log on locally

Allow log on through Terminal Services

Backup files and directories

Bypass traverse checking

Change the system time

Change the time zone

Create a pagefile

Create a token object

Create global objects

Create permanent shared objects

Create Symbolic Links

Debug programs

Deny access to this computer from the network

Deny log on as a batch job

Deny log on as a service

Deny log on locally

Deny log on through Terminal Services

Enable computer and user accounts to be trusted for delegation

Force shutdown from a remote system

Generate security audits

Impersonate a client after authentication

Increase a process working set

Increase scheduling authority

Load and unload device drivers

Lock pages in memory

Log on as a batch job

Log on as a service

Log on locally

Manage auditing and security log

Modify an object label

Modify firmware environment values

Perform volume maintenance tasks

Profile single process

Profile system performance

Remove computer from docking station

Replace a process level token

Restore files and directories

Shut down the system

Synchronize directory service data

Take ownership of files or other objects

Accounts: Administrator account status

Accounts: Guest account status

Accounts: Limit local account use of blank passwords to console logon only

Accounts: Rename administrator account

Accounts: Rename guest account

Audit: Audit the accesss of global system objects

Audit: Audit the use of Backup and Restore privilege


Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings

Audit: Shut down system immediately if unable to log security audits


DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax

DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax

Devices: Allow undock without having to log on

Devices: Allowed to format and eject removable media

Devices: Prevent users from installing printer drivers

Devices: Restrict CD-ROM access to locally logged-on user only

Devices: Restrict floppy access to locally logged-on user only

Devices: Unsigned driver installation behavior

Domain controller: Allow server operators to schedule tasks

Domain controller: LDAP server signing requirements

Domain controller: Refuse machine account password changes

Domain member: Digitally encrypt or sign secure channel data (always)

Domain member: Digitally encrypt secure channel data (when possible)

Domain member: Digitally sign secure channel data (when possible)

Domain member: Disable machine account password changes

Domain member: Maximum machine account password age

Domain member: Require strong (Windows 2000 or later) session key

Interactive logon: Do not display last user name

Interactive logon: Do not require CTRL+ALT+DELETE

Interactive logon: Message text for users attempting to logon

Interactive logon: Message title for users attempting to logon

Interactive logon: Number of previous logons to cache (in case domain controller is not available)

Interactive logon: Prompt user to change password before expiration

Interactive logon: Require Domain Controller authentication to unlock workstation

Interactive logon: Require smart card

Interactive logon: Smart card removal behavior

Microsoft network client: Digitally sign communications (always)

Microsoft network client: Digitally sign communications (if server agrees)

Microsoft network client: Send unencrypted password to third-party SMB servers

Microsoft network server: Amount of idle time required before suspending session

Microsoft network server: Digitally sign communications (always)

Microsoft network server: Digitally sign communications (if client agrees)

Microsoft network server: Disconnect clients when logon hours expire

Network access: Allow anonymous SID/Name translation

Network access: Do not allow anonymous enumeration of SAM accounts

Network access: Do not allow anonymous enumeration of SAM accounts and shares

Network access: Do not allow storage of credentials or .NET Passports for network authentication

Network access: Let Everyone permissions apply to anonymous users

Network access: Named Pipes that can be accessed anonymously

Network access: Remotely accessible registry paths


Network access: Remotely accessible registry paths and subpaths

Network access: Restrict anonymous access to Named Pipes and Shares

Network access: Shares that can be accessed anonymously

Network access: Sharing and security model for local accounts

Network security: Do not store LAN Manager hash value on next password change

Network security: Force logoff when logon hours expire

Network security: LAN Manager authentication level

Network security: LDAP client signing requirements

Network security: Minimum session security for NTLM SSP based (including secure RPC) clients

Network security: Minimum session security for NTLM SSP based (including secure RPC) servers

Recovery console: Allow automatic administrative logon

Recovery console: Allow floppy copy and access to all drives and all folders

Shutdown: Allow system to be shut down without having to log on

Shutdown: Clear virtual memory pagefile

System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing

System Cryptography: Force strong key protection for user keys stored on the computer

System objects: Default owner for objects created by members of the Administrators group

System objects: Require case insensitivity for non-Windows subsystems

System objects: Strengthen default permissions of internal system objects (e.g., Symbolic Links)

System settings: Optional subsystems

System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies

Admin Approval Mode for the Built-in Administrator account

Behavior of the elevation prompt for administrators in Admin Approval Mode

Behavior of the elevation prompt for standard users

Detect application installations and prompt for elevation

Only elevate executables that are signed and validated

Only elevate UIAccess applications that are installed in secure locations

Run all administrators in Admin Approval Mode

Switch to the secure desktop when prompting for elevation

Virtualize file and registry write failures to per-user locations

Allow UIAccess applications to prompt for elevation without using the secure desktop.

Maximum application log size

Maximum security log size

Maximum system log size

Prevent local guests group from accessing application log

Prevent local guests group from accessing security log

Prevent local guests group from accessing system log

Retain application log

Retain security log

Retain system log

Retention method for application log

Retention method for security log

Retention method for system log

Restricted Groups

System Services

Registry

File System

Supported On

Windows XP SP2, Windows Server 2003
























Windows Vista, Windows Server 2008




Windows Server 2003



























Windows XP SP2

































Windows Server 2003






























Windows XP SP2

Windows Server 2003

Windows Server 2003

Windows Server 2003














Windows Server 2003




Windows Server 2003

Windows Server 2003










Windows Vista SP1, Windows Server 2008

















Explain Text

This setting is used by Credential Manager during Backup/Restore. No accounts should have this privilege, as it is only assigne

Enforce password history

This security setting determines the number of unique new passwords that have to be associated with a user account before an old password can be reused. The value must be between 0 and 24 passwords.

This policy enables administrators to enhance security by ensuring that old passwords are not reused continually.

Default:

24 on domain controllers.0 on stand-alone servers.

Note: By default, member computers follow the configuration of their domain controllers.To maintain the effectiveness of the password history, do not allow passwords to be changed immediately after they were just changed by also enabling the Minimum password age security policy setting. For information about the minimum password age security policy setting, see Minimum password age.

Maximum password age

This security setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If the maximum password age is between 1 and 999 days, the Minimum password age must be less than the maximum password age. If the maximum password age is set to 0, the minimum password age can be any value between 0 and 998 days.

Note: It is a security best practice to have passwords expire every 30 to 90 days, depending on your environment. This way, an attacker has a limited amount of time in which to crack a user's password and have access to your network resources.

Default: 42.

Minimum password age

This security setting determines the period of time (in days) that a password must be used before the user can change it. You can set a value between 1 and 998 days, or you can allow changes immediately by setting the number of days to 0.

The minimum password age must be less than the Maximum password age, unless the maximum password age is set to 0, indicating that passwords will never expire. If the maximum password age is set to 0, the minimum password age can be set to any value between 0 and 998.

Configure the minimum password age to be more than 0 if you want Enforce password history to be effective. Without a minimum password age, users can cycle through passwords repeatedly until they get to an old favorite. The default setting does not follow this recommendation, so that an administrator can specify a password for a user and then require the user to change the administrator-defined password when the user logs on. If the password history is set to 0, the user does not have to choose a new password. For this reason, Enforce password history is set to 1 by default.

Default:


Note: By default, member computers follow the configuration of their domain controllers.

Minimum password length

This security setting determines the least number of characters that a password for a user account may contain. You can set a value of between 1 and 14 characters, or you can establish that no password is required by setting the number of characters to 0.

Default:



Password must meet complexity requirements

This security setting determines whether passwords must meet complexity requirements.

If this policy is enabled, passwords must meet the following minimum requirements:

Not contain the user's account name or parts of the user's full name that exceed two consecutive charactersBe at least six characters in lengthContain characters from three of the following four categories:English uppercase characters (A through Z)English lowercase characters (a through z)Base 10 digits (0 through 9)Non-alphabetic characters (for example, !, $, #, %)Complexity requirements are enforced when passwords are changed or created.

Default:

Enabled on domain controllers.Disabled on stand-alone servers.


Store passwords using reversible encryption

This security setting determines whether the operating system stores passwords using reversible encryption.

This policy provides support for applications that use protocols that require knowledge of the user's password for authentication purposes. Storing passwords using reversible encryption is essentially the same as storing plaintext versions of the passwords. For this reason, this policy should never be enabled unless application requirements outweigh the need to protect password information.

This policy is required when using Challenge-Handshake Authentication Protocol (CHAP) authentication through remote access or Internet Authentication Services (IAS). It is also required when using Digest Authentication in Internet Information Services (IIS).

Default: Disabled.

Account lockout duration

This security setting determines the number of minutes a locked-out account remains locked out before automatically becoming unlocked. The available range is from 0 minutes through 99,999 minutes. If you set the account lockout duration to 0, the account will be locked out until an administrator explicitly unlocks it.

If an account lockout threshold is defined, the account lockout duration must be greater than or equal to the reset time.

Default: None, because this policy setting only has meaning when an Account lockout threshold is specified.

Account lockout threshold

This security setting determines the number of failed logon attempts that causes a user account to be locked out. A locked-out account cannot be used until it is reset by an administrator or until the lockout duration for the account has expired. You can set a value between 0 and 999 failed logon attempts. If you set the value to 0, the account will never be locked out.

Failed password attempts against workstations or member servers that have been locked using either CTRL+ALT+DELETE or password-protected screen savers count as failed logon attempts.

Default: 0.

Reset account lockout counter after

This security setting determines the number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts. The available range is 1 minute to 99,999 minutes.

If an account lockout threshold is defined, this reset time must be less than or equal to the Account lockout duration.

Default: None, because this policy setting only has meaning when an Account lockout threshold is specified.

Enforce user logon restrictions

This security setting determines whether the Kerberos V5 Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the user account. Validation of each request for a session ticket is optional, because the extra step takes time and it may slow network access to services.

Default: Enabled.

Maximum lifetime for service ticket

This security setting determines the maximum amount of time (in minutes) that a granted session ticket can be used to access a particular service. The setting must be greater than 10 minutes and less than or equal to the setting for Maximum lifetime for user ticket.

If a client presents an expired session ticket when it requests a connection to a server, the server returns an error message. The client must request a new session ticket from the Kerberos V5 Key Distribution Center (KDC). Once a connection is authenticated, however, it no longer matters whether the session ticket remains valid. Session tickets are used only to authenticate new connections with servers. Ongoing operations are not interrupted if the session ticket that is used to authenticate the connection expires during the connection.

Default: 600 minutes (10 hours).

Maximum lifetime for user ticket

This security setting determines the maximum amount of time (in hours) that a user's ticket-granting ticket (TGT) may be used. When a user's TGT expires, a new one must be requested or the existing one must be "renewed."

Default: 10 hours.

Maximum lifetime for user ticket renewal

This security setting determines the period of time (in days) during which a user's ticket-granting ticket (TGT) may be renewed.

Default: 7 days.

Maximum tolerance for computer clock synchronization

This security setting determines the maximum time difference (in minutes) that Kerberos V5 tolerates between the time on the client clock and the time on the domain controller running Windows Server 2003 that provides Kerberos authentication.

To prevent "replay attacks," Kerberos V5 uses time stamps as part of its protocol definition. For time stamps to work properly, the clocks of the client and the domain controller need to be in sync as much as possible. In other words, both computers must be set to the same time and date. Because the clocks of two computers are often out of sync, administrators can use this policy to establish the maximum acceptable difference to Kerberos V5 between a client clock and domain controller clock. If the difference between a client clock and the domain controller clock is less than the maximum time difference that is specified in this policy, any time stamp that is used in a session between the two computers is considered to be authentic.

Important

This setting is not persistent. If you configure this setting and then restart the computer, this setting reverts to the default value.

Default: 5 minutes.

Audit account logon events

This security setting determines whether to audit each instance of a user logging on to or logging off from another computer in which this computer is used to validate the account. Account logon events are generated when a domain user account is authenticated on a domain controller. The event is logged in the domain controller's security log. Logon events are generated when a local user is authenticated on a local computer. The event is logged in the local security log. Account logoff events are not generated.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when an account logon attempt succeeds. Failure audits generate an audit entry when an account logon attempt fails.

To set this value to No auditing, in the Properties dialog box for this policy setting, select the Define these policy settings check box and clear the Success and Failure check boxes.

If success auditing for account logon events is enabled on a domain controller, an entry is logged for each user who is validated against that domain controller, even though the user is actually logging on to a workstation that is joined to the domain.

Default: Success.

Audit account management

This security setting determines whether to audit each event of account management on a computer. Examples of account management events include:

A user account or group is created, changed, or deleted.A user account is renamed, disabled, or enabled.A password is set or changed.If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when any account management event succeeds. Failure audits generate an audit entry when any account management event fails. To set this value to No auditing, in the Properties dialog box for this policy setting, select the Define these policy settings check box and clear the Success and Failure check boxes.

Default:

Success on domain controllers.No auditing on member servers.

Audit directory service access

This security setting determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified.

By default, this value is set to no auditing in the Default Domain Controller Group Policy object (GPO), and it remains undefined for workstations and servers where it has no meaning.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a user successfully accesses an Active Directory object that has a SACL specified. Failure audits generate an audit entry when a user unsuccessfully attempts to access an Active Directory object that has a SACL specified. To set this value to No auditing, in the Properties dialog box for this policy setting, select the Define these policy settings check box and clear the Success and Failure check boxes.

Note that you can set a SACL on an Active Directory object by using the Security tab in that object's Properties dialog box. This is the same as Audit object access, except that it applies only to Active Directory objects and not to file system and registry objects.

Default:

Success on domain controllers.Undefined for a member computer.

Audit logon events

This security setting determines whether to audit each instance of a user logging on to or logging off from a computer.

Account logon events are generated on domain controllers for domain account activity and on local computers for local account activity. If both account logon and logon audit policy categories are enabled, logons that use a domain account generate a logon or logoff event on the workstation or server, and they generate an account logon event on the domain controller. Additionally, interactive logons to a member server or workstation that use a domain account generate a logon event on the domain controller as the logon scripts and policies are retrieved when a user logs on. For more information about account logon events, see Audit account logon events.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a logon attempt succeeds. Failure audits generate an audit entry when a logon attempt fails.


Default: Success.

Audit object access

This security setting determines whether to audit the event of a user accessing an objectùfor example, a file, folder, registry key, printer, and so forthùthat has its own system access control list (SACL) specified.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a user successfully accesses an object that has an appropriate SACL specified. Failure audits generate an audit entry when a user unsuccessfully attempts to access an object that has a SACL specified.


Note that you can set a SACL on a file system object using the Security tab in that object's Properties dialog box.

Default: No auditing.

Audit policy change

This security setting determines whether to audit every incident of a change to user rights assignment policies, audit policies, or trust policies.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a change to user rights assignment policies, audit policies, or trust policies is successful. Failure audits generate an audit entry when a change to user rights assignment policies, audit policies, or trust policies fails.


Default:


Audit privilege use

This security setting determines whether to audit each instance of a user exercising a user right.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit this type of event at all. Success audits generate an audit entry when the exercise of a user right succeeds. Failure audits generate an audit entry when the exercise of a user right fails.


Default: No auditing.

Audits are not generated for use of the following user rights, even if success audits or failure audits are specified for Audit privilege use. Enabling auditing of these user rights tend to generate many events in the security log which may impede your computer's performance. To audit the following user rights, enable the FullPrivilegeAuditing registry key.

Bypass traverse checkingDebug programsCreate a token objectReplace process level tokenGenerate security auditsBack up files and directoriesRestore files and directories

Caution

Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Audit process tracking

This security setting determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when the process being tracked succeeds. Failure audits generate an audit entry when the process being tracked fails.


Default: No auditing

Audit system events

This security setting determines whether to audit when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a system event is executed successfully. Failure audits generate an audit entry when a system event is attempted unsuccessfully.


Default:


Access this computer from the network

This user right determines which users and groups are allowed to connect to the computer over the network. Terminal Services are not affected by this user right.

Default on workstations and servers:AdministratorsBackup OperatorsUsersEveryone

Default on domain controllers:AdministratorsAuthenticated UsersEnterprise Domain ControllersEveryonePre-Windows 2000 Compatible Access

Act as part of the operating system

This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user.

Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned. If your organization only uses servers that are members of the Windows Server 2003 family, you do not need to assign this privilege to your users. However, if your organization uses servers running Windows 2000 or Windows NT 4.0, you might need to assign this privilege to use applications that exchange passwords in plaintext.

Caution

Assigning this user right can be a security risk. Only assign this user right to trusted users.

Default: None.

Add workstations to domain

This security setting determines which groups or users can add workstations to a domain.

This security setting is valid only on domain controllers. By default, any authenticated user has this right and can create up to 10 computer accounts in the domain.

Adding a computer account to the domain allows the computer to participate in Active Directoryûbased networking. For example, adding a workstation to a domain enables that workstation to recognize accounts and groups that exist in Active Directory.

Default: Authenticated Users on domain controllers.

Note: Users who have the Create Computer Objects permission on the Active Directory computers container can also create computer accounts in the domain. The distinction is that users with permissions on the container are not restricted to the creation of only 10 computer accounts. In addition, computer accounts that are created by means of Add workstations to domain have Domain Administrators as the owner of the computer account, while computer accounts that are created by means of permissions on the computers container have the creator as the owner of the computer account. If a user has permissions on the container and also has the Add workstations to domain user right, the computer is added, based on the computer container permissions rather than on the user right.

Adjust memory quotas for a process

This privilege determines who can change the maximum memory that can be consumed by a process.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

Note: This privilege is useful for system tuning, but it can be misused, for example, in a denial-of-service attack.

Default: AdministratorsLocal ServiceNetwork Service.

Allow log on locally

This logon right determines which users can interactively log on to this computer. Logons initiated by pressing CTRL+ALT+DEL sequence on the attached keyboard requires the user to have this logon right. Additionally this logon right may be required by some service or administrative applications that can log on users. If you define this policy for a user or group, you must also give the Administrators group this right.

Default on workstations and servers: AdministratorsBackup OperatorsUsers.

Default on domain controllers: Account OperatorsAdministratorsBackup OperatorsPrint OperatorsServer Operators.

Allow log on through Terminal Services

This security setting determines which users or groups have permission to log on as a Terminal Services client.

Default:

On workstation and servers: Administrators, Remote Desktop Users.On domain controllers: Administrators.

Important

This setting does not have any effect on Windows 2000 computers that have not been updated to Service Pack 2.

Back up files and directories

This user right determines which users can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system.

Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:

Traverse Folder/Execute FileList Folder/Read DataRead AttributesRead Extended AttributesRead Permissions

Caution

Assigning this user right can be a security risk. Since there is no way to be sure that a user is backing up data, stealing data, or copying data to be distributed, only assign this user right to trusted users.

Default on workstations and servers: AdministratorsBackup Operators.

Default on domain controllers:AdministratorsBackup OperatorsServer Operators

Bypass traverse checking

This user right determines which users can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories.


Default on workstations and servers:AdministratorsBackup OperatorsUsersEveryoneLocal ServiceNetwork Service

Default on domain controllers:AdministratorsAuthenticated UsersEveryoneLocal ServiceNetwork ServicePre-Windows 2000 Compatible Access

Change the system time

This user right determines which users and groups can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs. If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred.


Default on workstations and servers:AdministratorsLocal Service

Default on domain controllers:AdministratorsServer OperatorsLocal Service

Change the Time Zone

This user right determines which users and groups can change the time zone used by the computer for displaying the local time, which is the computer's system time plus the time zone offset. System time itself is absolute and is not affected by a change in the time zone.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of the workstations and servers.

Default: Administrators, Users

Create a pagefile

This user right determines which users and groups can call an internal application programming interface (API) to create a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users.

For information about how to specify a paging file size for a given drive, see To change the size of the virtual memory paging file.

Default: Administrators.

Create a token object

This security setting determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token.

This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System.

Caution

Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system.Default: None

Create global objects

This user right is required for a user account to create global objects during Terminal Services sessions. Users can still create session-specific objects without being assigned this user right.

Caution

Assigning this user right can be a security risk. Assign this user right only to trusted users.

Default:

AdministratorsLocal ServiceNetwork ServiceService

Create permanent shared objects

This user right determines which accounts can be used by processes to create a directory object using the object manager.

This user right is used internally by the operating system and is useful to kernel-mode components that extend the object namespace. Because components that are running in kernel mode already have this user right assigned to them, it is not necessary to specifically assign it.

Default: None.

Create Symbolic Links

This privilege determines if the user can create a symbolic link from the computer he is logged on to.

Default: Administrator

WARNING: This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that arenÆt designed to handle them.

NoteThis setting can be used in conjunction a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type ôfsutil behavior set symlinkevalution /?ö at the command line to get more information about fsutil and symbolic links.

Debug programs

This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications to not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components.

Caution


Default: Administrators

Deny access to this computer from the network

This security setting determines which users are prevented from accessing a computer over the network. This policy setting supersedes the Access this computer from the network policy setting if a user account is subject to both policies.

Default: None.

Deny log on as a batch job

This security setting determines which accounts are prevented from being able to log on as a batch job. This policy setting supersedes the Log on as a batch job policy setting if a user account is subject to both policies.

Default: None.

Deny log on as a service

This security setting determines which service accounts are prevented from registering a process as a service. This policy setting supersedes the Log on as a service policy setting if an account is subject to both policies.

Note: This security setting does not apply to the System, Local Service, or Network Service accounts.

Default: None.

Deny log on locally

This security setting determines which users are prevented from logging on at the computer. This policy setting supersedes the Allow log on locally policy setting if an account is subject to both policies.

Important

If you apply this security policy to the Everyone group, no one will be able to log on locally.

Default: None.

Deny log on through Terminal Services

This security setting determines which users and groups are prohibited from logging on as a Terminal Services client.

Default: None.

Important

This setting does not have any effect on Windows 2000 computers that have not been updated to Service Pack 2.

Enable computer and user accounts to be trusted for delegation

This security setting determines which users can set the Trusted for Delegation setting on a user or computer object.

The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set.


Caution

Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources.

Default: Administrators on domain controllers.

Force shutdown from a remote system

This security setting determines which users are allowed to shut down a computer from a remote location on the network. Misuse of this user right can result in a denial of service.


Default:

On workstations and servers: Administrators.On domain controllers: Administrators, Server Operators.

Generate security audits

This security setting determines which accounts can be used by a process to add entries to the security log. The security log is used to trace unauthorized system access. Misuse of this user right can result in the generation of many auditing events, potentially hiding evidence of an attack or causing a denial of service if the Audit: Shut down system immediately if unable to log security audits security policy setting is enabled. For more information see Audit: Shut down system immediately if unable to log security audits

Default: Local ServiceNetwork Service.

Impersonate a client after authentication

Assigning this privilege to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels.

Caution


Default:

AdministratorsLocal ServiceNetwork ServiceService

Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started.

In addition, a user can also impersonate an access token if any of the following conditions exist.

The access token that is being impersonated is for this user.The user, in this logon session, created the access token by logging on to the network with explicit credentials.The requested level is less than Impersonate, such as Anonymous or Identify.Because of these factors, users do not usually need this user right.

For more information, search for "SeImpersonatePrivilege" in the Microsoft Platform SDK.

Warning

If you enable this setting, programs that previously had the Impersonate privilege may lose it, and they may not run.

Increase a process working set

This privilege determines which user accounts can increase or decrease the size of a process’s working set. Increase a process working set

This privilege determines which user accounts can increase or decrease the size of a process’s working set.

Default: Users

The working set of a process is the set of memory pages currently visible to the process in physical RAM memory. These pages are resident and available for an application to use without triggering a page fault. The minimum and maximum working set sizes affect the virtual memory paging behavior of a process.

Warning: Increasing the working set size for a process decreases the amount of physical memory available to the rest of the system.

Increase scheduling priority

This security setting determines which accounts can use a process with Write Property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface.


Load and unload device drivers

This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users.

Caution

Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system.

Default on workstations and servers: Administrators.

Default on domain controllers:AdministratorsPrint Operators

Lock pages in memory

This security setting determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM).

Default: None.

Log on as a batch job

This security setting allows a user to be logged on by means of a batch-queue facility and is provided only for compatibility with older versions of Windows.

For example, when a user submits a job by means of the task scheduler, the task scheduler logs that user on as a batch user rather than as an interactive user.

Default: AdministratorsBackup Operators.

Log on as a service

This security setting determines which service accounts can register a process as a service.

Default: Network Service.

Log on locally

Determines which users can log on to the computer.

Important

Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally (http://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website.

Default:

• On workstations and servers: Administrators, Backup Operators, Power Users, Users, and Guest.• On domain controllers: Account Operators, Administrators, Backup Operators, and Print Operators.

Manage auditing and security log

This security setting determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys.

This security setting does not allow a user to enable file and object access auditing in general. For such auditing to be enabled, the Audit object access setting in Computer Configuration\Windows Settings\Security Settings\Local Policies\\Audit Policies must be configured.

You can view audited events in the security log of the Event Viewer. A user with this privilege can also view and clear the security log.


Modify an object label

This privilege determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Processes running under a user account can modify the label of an object owned by that user to a lower level without this privilege.

Default: None

Modify firmware environment values

This security setting determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor.

On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system.On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties.On all computers, this user right is required to install or upgrade Windows.

Note: This security setting does not affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties. For information about how to modify these variables, see To add or change the values of environment variables.


Perform volume maintenance tasks

Description

This security setting determines which users and groups can run maintenance tasks on a volume, such as remote defragmentation.

Use caution when assigning this user right. Users with this user right can explore disks and extend files in to memory that contains other data. When the extended files are opened, the user might be able to read and modify the acquired data.

Default: Administrators

Profile single process

This security setting determines which users can use performance monitoring tools to monitor the performance of nonsystem processes.


Profile system performance

This security setting determines which users can use performance monitoring tools to monitor the performance of system processes.


Remove computer from docking station

This security setting determines whether a user can undock a portable computer from its docking station without logging on.

If this policy is enabled, the user must log on before removing the portable computer from its docking station. If this policy is disabled, the user may remove the portable computer from its docking station without logging on.


Replace a process level token

This security setting determines which user accounts can call the CreateProcessAsUser() application programming interface (API) so that one service can start another. An example of a process that uses this user right is Task Scheduler. For information about Task Scheduler, see Task Scheduler overview.

Default: Network Service, Local Service.

Restore files and directories

This security setting determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object.

Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:

Traverse Folder/Execute FileWrite

Caution

Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, only assign this user right to trusted users.

Default:

Workstations and servers: Administrators, Backup Operators.Domain controllers: Administrators, Backup Operators, Server Operators.

Shut down the system

This security setting determines which users who are logged on locally to the computer can shut down the operating system using the Shut Down command. Misuse of this user right can result in a denial of service.

Default on Workstations: Administrators, Backup Operators, Users.

Default on Servers: Administrators, Backup Operators.

Default on Domain controllers: Administrators, Backup Operators, Server Operators, Print Operators.

Synchronize directory service data

This security setting determines which users and groups have the authority to synchronize all directory service data. This is also known as Active Directory synchronization.

Defaults: None.

Take ownership of files or other objects

This security setting determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads.

Caution

Assigning this user right can be a security risk. Since owners of objects have full control of them, only assign this user right to trusted users.


Accounts: Administrator account status

This security setting determines whether the local Administrator account is enabled or disabled.

Notes

If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password.Disabling the Administrator account can become a maintenance issue under certain circumstances. For example, in a domain environment, if the secure channel that constitutes your join fails for any reason, and there is no other local Administrator account, you must restart in Safe Mode to fix the problem that is causing your join status to be broken.Under Safe Mode boot, the Administrator account is always enabled, regardless of this setting.

Default: Enabled.

Accounts: Guest account status

This security setting determines if the Guest account is enabled or disabled.

Default: Disabled.

Note: If the Guest account is disabled and the security option Network Access: Sharing and Security Model for local accounts is set to Guest Only, network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail.

Accounts: Limit local account use of blank passwords to console logon only

This security setting determines whether local accounts that are not password protected can be used to logon from locations other than the physical computer console. If enabled, then local accounts that are not password protected will only be able to log on at the computer's keyboard.

Default: Enabled.

Warning:

Computers that are not in physically secure locations should always enforce strong password policies for all local user accounts. Otherwise, anyone with physical access to the computer can log on using a user account that does not have a password. This is especially important for portable computers.If you apply this security policy to the Everyone group, no one will be able to log on through terminal services.

Notes

This setting does not affect logons that use domain accounts.It is possible for applications that use remote interactive logons to bypass this setting.

Accounts: Rename administrator account

This security setting determines whether a different account name is associated with the security identifier (SID) for the account Administrator. Renaming the well-known Administrator account makes it slightly more difficult for unauthorized persons to guess this privileged user name and password combination.

Default: Administrator.

Accounts: Rename guest account

This security setting determines whether a different account name is associated with the security identifier (SID) for the account "Guest." Renaming the well-known Guest account makes it slightly more difficult for unauthorized persons to guess this user name and password combination.

Default: Guest.

Audit: Audit the access of global system objects

This security setting determines whether to audit the access of global system objects.

If this policy is enabled, it causes system objects, such as mutexes (mutual exclusive), events, semaphores (locking mechanisms used inside resource managers or resource dispensers) and DOS devices, to be created with a default system access control list (SACL). If the Audit object access audit policy is also enabled, access to these system objects is audited.

Note: When configuring this security setting, changes will not take effect until you restart Windows.

Default: Disabled.


This security setting determines whether to audit the use of all user privileges, including Backup and Restore, when the Audit privilege use policy is in effect. Enabling this option when the Audit privilege use policy is also enabled generates an audit event for every file that is backed up or restored.

If you disable this policy, then use of the Backup or Restore privilege is not audited even when Audit privilege use is enabled.


Default: Disabled.


This security setting determines whether to audit the use of all user privileges, including Backup and Restore, when the Audit privilege use policy is in effect. Enabling this option when the Audit privilege use policy is also enabled generates an audit event for every file that is backed up or restored.

If you disable this policy, then use of the Backup or Restore privilege is not audited even when Audit privilege use is enabled.

Default: Disabled.

Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings.

Windows Vista and later versions of Windows allow audit policy to be managed in a more precise way using audit policy subcategories. Setting audit policy at the category level will override the new subcategory audit policy feature. To allow audit policy to be managed using subcategories without requiring a change to Group Policy, there is a new registry value in Windows Vista and later versions, SCENoApplyLegacyAuditPolicy, which prevents the application of category-level audit policy from Group Policy and from the Local Security Policy administrative tool.

If the category level audit policy set here is not consistent with the events that are currently being generated, the cause might be that this registry key is set.

Default: Disabled


This security setting determines whether the system shuts down if it is unable to log security events.

If this security setting is enabled, it causes the system to stop if a security audit cannot be logged for any reason. Typically, an event fails to be logged when the security audit log is full and the retention method that is specified for the security log is either Do Not Overwrite Events or Overwrite Events by Days.

If the security log is full and an existing entry cannot be overwritten, and this security option is enabled, the following Stop error appears:

STOP: C0000244 {Audit Failed}An attempt to generate a security audit failed.To recover, an administrator must log on, archive the log (optional), clear the log, and reset this option as desired. Until this security setting is reset, no users, other than a member of the Administrators group will be able to log on to the system, even if the security log is not full.


Default: Disabled.


This security setting determines whether the system shuts down if it is unable to log security events.

If this security setting is enabled, it causes the system to stop if a security audit cannot be logged for any reason. Typically, an event fails to be logged when the security audit log is full and the retention method that is specified for the security log is either Do Not Overwrite Events or Overwrite Events by Days.

If the security log is full and an existing entry cannot be overwritten, and this security option is enabled, the following Stop error appears:

STOP: C0000244 {Audit Failed}An attempt to generate a security audit failed.To recover, an administrator must log on, archive the log (optional), clear the log, and reset this option as desired. Until this security setting is reset, no users, other than a member of the Administrators group will be able to log on to the system, even if the security log is not full.

Default: Disabled.

DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax

This policy setting determines which users or groups can access DCOM application remotely or locally. This setting is used to control the attack surface of the computer for DCOM applications.

You can use this policy setting to specify access permissions to all the computers to particular users for DCOM applications in the enterprise. When you specify the users or groups that are to be given permission, the security descriptor field is populated with the Security Descriptor Definition Language representation of those groups and privileges. If the security descriptor is left blank, the policy setting is defined in the template, but it is not enforced. Users and groups can be given explicit Allow or Deny privileges on both local access and remote access.

The registry settings that are created as a result of enabling the DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax policy setting take precedence over (have higher priority) the previous registry settings in this area. Remote Procedure Call Services (RpcSs) checks the new registry keys in the Policies section for the computer restrictions, and these registry entries take precedence over the existing registry keys under OLE. This means that previously existing registry settings are no longer effective, and if you make changes to the existing settings, computer access permissions for users are not changed. Use care in configuring their list of users and groups.

The possible values for this policy setting are:

ò Blank. This represents the local security policy way of deleting the policy enforcement key. This value deletes the policy and then sets it as Not defined state. The Blank value is set by using the ACL editor and emptying the list, and then pressing OK.

ò SDDL. This is the Security Descriptor Definition Language representation of the groups and privileges you specify when you enable this policy.

ò Not Defined. This is the default value.

NoteIf the administrator is denied permission to access DCOM applications due to the changes made to DCOM in Windows, the administrator can use the DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax policy setting to manage DCOM access to the computer. The administrator can specify which users and groups can access the DCOM application on the computer both locally and remotely by using this setting. This will restore control of the DCOM application to the administrator and users. To do this, open the DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax setting, and click Edit Security. Specify the groups you want to include and the computer access permissions for those groups. This defines the setting and sets the appropriate SDDL value.

DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax

This policy setting determines which users or groups can launch or activate DCOM applications remotely or locally. This setting is used to control the attack surface of the computer for DCOM applications.

You can use this setting to grant access to all the computers to users of DCOM applications. When you define this setting, and specify the users or groups that are to be given permission, the security descriptor field is populated with the Security Descriptor Definition Language representation of those groups and privileges. If the security descriptor is left blank, the policy setting is defined in the template, but it is not enforced. Users and groups can be given explicit Allow or Deny privileges on local launch, remote launch, local activation, and remote activation.

The registry settings that are created as a result of this policy take precedence over the previous registry settings in this area. Remote Procedure Call Services (RpcSs) checks the new registry keys in the Policies section for the computer restrictions; these entries take precedence over the existing registry keys under OLE.

The possible values for this Group Policy setting are:

ò Blank. This represents the local security policy way of deleting the policy enforcement key. This value deletes the policy and then sets it to Not defined state. The Blank value is set by using the ACL editor and emptying the list, and then pressing OK.

ò SDDL. This is the Security Descriptor Definition Language representation of the groups and privileges you specify when you enable this policy.

ò Not Defined. This is the default value.

NoteIf the administrator is denied access to activate and launch DCOM applications due to the changes made to DCOM in this version of Windows, this policy setting can be used for controlling the DCOM activation and launch to the computer. The administrator can specify which users and groups can launch and activate DCOM applications on the computer both locally and remotely by using the DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax policy setting. This restores control of the DCOM application to the administrator and specified users. To do this, open the DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax setting, and click Edit Security. Specify the groups you want to include and the computer launch permissions for those groups. This defines the setting and sets the appropriate SDDL value.

User Account Control: Admin Approval Mode for the Built-in Administrator account

This security setting determines the behavior of Admin Approval mode for the Built-in Administrator account.

The options are:

ò Enabled: The Built-in Administrator will logon in Admin Approval Mode. By default any operation that requires elevation of privilege will prompt the Consent Admin to choose either Permit or Deny.

ò Disabled: The Built-in Administrator will logon in XP compatible mode and run all applications by default with full administrative privilege.

Default: Disabled

Devices: Allow undock without having to log on

This security setting determines whether a portable computer can be undocked without having to log on. If this policy is enabled, logon is not required and an external hardware eject button can be used to undock the computer. If disabled, a user must log on and have the Remove computer from docking station privilege to undock the computer.

Default: Enabled.

Caution

Disabling this policy may tempt users to try and physically remove the laptop from its docking station using methods other than the external hardware eject button. Since this may cause damage to the hardware, this setting, in general, should only be disabled on laptop configurations that are physically securable.

Devices: Allowed to format and eject removable media

This security setting determines who is allowed to format and eject removable NTFS media. This capability can be given to:

AdministratorsAdministrators and Interactive Users

Default: This policy is not defined and only Administrators have this ability.

Devices: Prevent users from installing printer drivers

For a computer to print to a network printer, the driver for that network printer must be installed on the local computer. This security setting determines who is allowed to install a printer driver as part of adding a network printer. If this setting is enabled, only Administrators can install a printer driver as part of adding a network printer. If this setting is disabled, any user can install a printer driver as part of adding a network printer.

Default on servers: Enabled.Default on workstations: Disabled

Notes

This setting does not affect the ability to add a local printer.This setting does not affect Administrators.

Devices: Restrict CD-ROM access to locally logged-on user only

This security setting determines whether a CD-ROM is accessible to both local and remote users simultaneously.

If this policy is enabled, it allows only the interactively logged-on user to access removable CD-ROM media. If this policy is enabled and no one is logged on interactively, the CD-ROM can be accessed over the network.

Default: This policy is not defined and CD-ROM access is not restricted to the locally logged-on user.

Devices: Restrict floppy access to locally logged-on user only

This security setting determines whether removable floppy media are accessible to both local and remote users simultaneously.

If this policy is enabled, it allows only the interactively logged-on user to access removable floppy media. If this policy is enabled and no one is logged on interactively, the floppy can be accessed over the network.

Default: This policy is not defined and floppy disk drive access is not restricted to the locally logged-on user.

Devices: Unsigned driver installation behavior

This security setting determines what happens when an attempt is made to install a device driver (by means of Setup API) that has not been tested by the Windows Hardware Quality Lab (WHQL).

The options are:

Silently succeedWarn but allow installationDo not allow installationDefault: Warn but allow installation.

Domain controller: Allow server operators to schedule tasks

This security setting determines if Server Operators are allowed to submit jobs by means of the AT schedule facility.

Note: This security setting only affects the AT schedule facility; it does not affect the Task Scheduler facility.Default: This policy is not defined, which means that the system treats it as disabled.

Domain controller: LDAP server signing requirements

This security setting determines whether the LDAP server requires signing to be negotiated with LDAP clients, as follows:

None: Data signing is not required in order to bind with the server. If the client requests data signing, the server supports it.Require signature: Unless TLS\SSL is being used, the LDAP data signing option must be negotiated.

Default: This policy is not defined, which has the same effect as None.

Caution

If you set the server to Require Signature, you must also set the client. Not setting the client results in loss of connection with the server.

Notes

This setting does not have any impact on LDAP simple bind or LDAP simple bind through SSL. No Microsoft LDAP clients that are shipped with Windows XP Professional use LDAP simple bind or LDAP simple bind through SSL to talk to a domain controller.If signing is required, then LDAP simple bind and LDAP simple bind through SSL requests are rejected. No Microsoft LDAP clients running Windows XP Professional or the Windows Server 2003 family use LDAP simple bind or LDAP simple bind through SSL to bind to directory service.

Domain controller: Refuse machine account password changes

This security setting determines whether domain controllers will refuse requests from member computers to change computer account passwords. By default, member computers change their computer account passwords every 30 days. If enabled, the domain controller will refuse computer account password change requests.

If it is enabled, this setting does not allow a domain controller to accept any changes to a computer account's password.

Default: This policy is not defined, which means that the system treats it as Disabled.

Domain member: Digitally encrypt or sign secure channel data (always)

This security setting determines whether all secure channel traffic initiated by the domain member must be signed or encrypted.

When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc.

This setting determines whether or not all secure channel traffic initiated by the domain member meets minimum security requirements. Specifically it determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. If this policy is enabled, then the secure channel will not be established unless either signing or encryption of all secure channel traffic is negotiated. If this policy is disabled, then encryption and signing of all secure channel traffic is negotiated with the Domain Controller in which case the level of signing and encryption depends on the version of the Domain Controller and the settings of the following two policies:

Domain member: Digitally encrypt secure channel data (when possible)Domain member: Digitally sign secure channel data (when possible)

Default: Enabled.

Notes:

If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic.If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic.Logon information transmitted over the secure channel is always encrypted regardless of whether encryption of ALL other secure channel traffic is negotiated or not.

Domain member: Digitally encrypt secure channel data (when possible)

This security setting determines whether a domain member attempts to negotiate encryption for all secure channel traffic that it initiates.

When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM passthrough authentication, LSA SID/name Lookup etc.

This setting determines whether or not the domain member attempts to negotiate encryption for all secure channel traffic that it initiates. If enabled, the domain member will request encryption of all secure channel traffic. If the domain controller supports encryption of all secure channel traffic, then all secure channel traffic will be encrypted. Otherwise only logon information transmitted over the secure channel will be encrypted. If this setting is disabled, then the domain member will not attempt to negotiate secure channel encryption.

Default: Enabled.

Important

There is no known reason for disabling this setting. Besides unnecessarily reducing the potential confidentiality level of the secure channel, disabling this setting may unnecessarily reduce secure channel throughput, because concurrent API calls that use the secure channel are only possible when the secure channel is signed or encrypted.

Note: Domain controllers are also domain members and establish secure channels with other domain controllers in the same domain as well as domain controllers in trusted domains.

Domain member: Digitally sign secure channel data (when possible)

This security setting determines whether a domain member attempts to negotiate signing for all secure channel traffic that it initiates.

When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc.

This setting determines whether or not the domain member attempts to negotiate signing for all secure channel traffic that it initiates. If enabled, the domain member will request signing of all secure channel traffic. If the Domain Controller supports signing of all secure channel traffic, then all secure channel traffic will be signed which ensures that it cannot be tampered with in transit.

Default: Enabled.

Notes:

If the policy Domain member: Digitally encrypt or sign secure channel data (always) is enabled, then this policy is assumed to be enabled regardless of its current setting.Domain controllers are also domain members and establish secure channels with other domain controllers in the same domain as well as domain controllers in trusted domains.

Domain member: Disable machine account password changes

Determines whether a domain member periodically changes its computer account password. If this setting is enabled, the domain member does not attempt to change its computer account password. If this setting is disabled, the domain member attempts to change its computer account password as specified by the setting for Domain Member: Maximum age for machine account password, which by default is every 30 days.

Default: Disabled.

Notes

This security setting should not be enabled. Computer account passwords are used to establish secure channel communications between members and domain controllers and, within the domain, between the domain controllers themselves. Once it is established, the secure channel is used to transmit sensitive information that is necessary for making authentication and authorization decisions.This setting should not be used in an attempt to support dual-boot scenarios that use the same computer account. If you want to dual-boot two installations that are joined to the same domain, give the two installations different computer names.

Domain member: Maximum machine account password age

This security setting determines how often a domain member will attempt to change its computer account password.

Default: 30 days.

Important

This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers.

Domain member: Require strong (Windows 2000 or later) session key

This security setting determines whether 128-bit key strength is required for encrypted secure channel data.

When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller within the domain. This secure channel is used to perform operations such as NTLM passthrough authentication, LSA SID/name Lookup, and so on.

Depending on what version of Windows is running on the domain controller that the domain member is communicating with and the settings of the parameters:

Domain member: Digitally encrypt or sign secure channel data (always)Domain member: Digitally encrypt secure channel data (when possible)Some or all of the information that is transmitted over the secure channel will be encrypted. This policy setting determines whether or not 128-bit key strength is required for the secure channel information that is encrypted.

If this setting is enabled, then the secure channel will not be established unless 128-bit encryption can be performed. If this setting is disabled, then the key strength is negotiated with the domain controller.

Default: Disabled.

Important

In order to take advantage of this policy on member workstations and servers, all domain controllers that constitute the member's domain must be running Windows 2000 or later.In order to take advantage of this policy on domain controllers, all domain controllers in the same domain as well as all trusted domains must run Windows 2000 or later.

Interactive logon: Do not display last user name

This security setting determines whether the name of the last user to log on to the computer is displayed in the Windows logon screen.

If this policy is enabled, the name of the last user to successfully log on is not displayed in the Log On to Windows dialog box.

If this policy is disabled, the name of the last user to log on is displayed.

Default: Disabled.

Interactive logon: Do not require CTRL+ALT+DEL

This security setting determines whether pressing CTRL+ALT+DEL is required before a user can log on.

If this policy is enabled on a computer, a user is not required to press CTRL+ALT+DEL to log on. Not having to press CTRL+ALT+DEL leaves users susceptible to attacks that attempt to intercept the users' passwords. Requiring CTRL+ALT+DEL before users log on ensures that users are communicating by means of a trusted path when entering their passwords.

If this policy is disabled, any user is required to press CTRL+ALT+DEL before logging on to Windows (unless they are using a smart card for Windows logon).

Default on domain-computers: Disabled.Default on stand-alone computers: Enabled.

Interactive logon: Message text for users attempting to log on

This security setting specifies a text message that is displayed to users when they log on.

This text is often used for legal reasons, for example, to warn users about the ramifications of misusing company information or to warn them that their actions may be audited.

Default: No message.

Interactive logon: Message title for users attempting to log on

This security setting allows the specification of a title to appear in the title bar of the window that contains the Interactive logon: Message text for users attempting to log on.

Default: No message.

Interactive logon: Number of previous logons to cache (in case domain controller is not available)

All previous users' logon information is cached locally so that, in the event that a domain controller is unavailable during subsequent logon attempts, they are able to log on . If a domain controller is unavailable and a user's logon information is cached, the user is prompted with a message that reads as follows:

Windows cannot connect to a server to confirm your logon settings. You have been logged on using previously stored account information. If you changed your account information since you last logged on to this computer, those changes will not be reflected in this session.

If a domain controller is unavailable and a user's logon information is not cached, the user is prompted with this message:

The system cannot log you on now because the domain <DOMAIN_NAME> is not available.

In this policy setting, a value of 0 disables logon caching. Any value above 50 only caches 50 logon attempts.

Default: 10

Interactive logon: Prompt user to change password before expiration

Determines how far in advance (in days) users are warned that their password is about to expire. With this advance warning, the user has time to construct a password that is sufficiently strong.

Default: 14 days.

Interactive logon: Require Domain Controller authentication to unlock

Logon information must be provided to unlock a locked computer. For domain accounts, this security setting determines whether a domain controller must be contacted to unlock a computer. If this setting is disabled, a user can unlock the computer using cached credentials. If this setting is enabled, a domain controller must authenticate the domain account that is being used to unlock the computer.

Default: Disabled.

Important

This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers.

Interactive logon: Require smart card

This security setting requires users to log on to a computer using a smart card.

The options are:

Enabled: Users can only log on to the computer using a smart card.Disabled. Users can log on to the computer using any method.Default: Disabled.

Important

This setting will apply to any computers running Windows 2000 through changes in the registry, but the security setting is not viewable through the Security Configuration Manager tool set.

Interactive logon: Smart card removal behavior

This security setting determines what happens when the smart card for a logged-on user is removed from the smart card reader.

The options are:

ò No Actionò Lock Workstationò Force Logoffò Disconnect if a remote Terminal Services session

If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session.

If you click Force Logoff in the Properties dialog box for this policy, the user is automatically logged off when the smart card is removed.

If you click Disconnect if a remote Terminal Services session, removal of the smart card disconnects the session without logging the user off. This allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped terminal, without having to log on again.

Default: This policy is not defined, which means that the system treats it as No action.

On Windows Vista and above: In order for this setting to work, the Smart Card Removal Policy service must be started.

Microsoft network client: Digitally sign communications (always)

This security setting determines whether packet signing is required by the SMB client component.

The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted.

If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server.

Default: Disabled.

Important

For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client: Digitally sign communications (if server agrees).Computers that have this policy set will not be able to communicate with computers that do not have server-side packet signing enabled. By default, server-side packet signing is enabled only on domain controllers running Windows 2000 and later.Server-side packet signing can be enabled on computers running Windows 2000 and later by setting Microsoft network server: Digitally sign communications (if client agrees)Server-side packet signing can be enabled on computers running Windows NT 4.0 Service Pack 3 and later by setting the following registry value to 1:HKLM\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature

Server-side packet signing cannot be enabled on computers running Windows 95 or Windows 98.

Notes

All Windows operating systems support both a client-side SMB component and a server-side SMB component. To take advantage of SMB packet signing, both the client-side SMB component and server-side SMB component that are involved in a communication must have SMB packet signing either enabled or required. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings:Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing.Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled.Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing.Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled.If server-side SMB signing is required, a client will not be able to establish a session with that server, unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers. Similarly, if client-side SMB signing is required, that client will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers.If server-side SMB signing is enabled, SMB packet signing will be negotiated with clients that have client-side SMB signing enabled.Using SMB packet signing can impose up to a 15 percent performance hit on file service transactions.

Microsoft network client: Digitally sign communications (if server agrees)

This security setting determines whether the SMB client attempts to negotiate SMB packet signing.

The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB client component attempts to negotiate SMB packet signing when it connects to an SMB server.

If this setting is enabled, the Microsoft network client will ask the server to perform SMB packet signing upon session setup. If packet signing has been enabled on the server, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing.

Default: Enabled.

Notes

All Windows operating systems support both a client-side SMB component and a server-side SMB component. To take advantage of SMB packet signing, both the client-side SMB component and server-side SMB component that are involved in a communication must have SMB packet signing either enabled or required. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings:Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing.Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled.Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing.Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled.If server-side SMB signing is required, a client will not be able to establish a session with that server unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers.Similarly, if client-side SMB signing is required, that client will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers.If server-side SMB signing is enabled, SMB packet signing will be negotiated with clients that have client-side SMB signing enabled.Using SMB packet signing can degrade performance up to 15 percent on file service transactions.

Microsoft network client: Send unencrypted password to connect to third-party SMB servers

If this security setting is enabled, the Server Message Block (SMB) redirector is allowed to send plaintext passwords to non-Microsoft SMB servers that do not support password encryption during authentication.

Sending unencrypted passwords is a security risk.

Default: Disabled.

Microsoft network server: Amount of idle time required before suspending a session

This security setting determines the amount of continuous idle time that must pass in a Server Message Block (SMB) session before the session is suspended due to inactivity.

Administrators can use this policy to control when a computer suspends an inactive SMB session. If client activity resumes, the session is automatically reestablished.

For this policy setting, a value of 0 means to disconnect an idle session as quickly as is reasonably possible. The maximum value is 99999, which is 208 days; in effect, this value disables the policy.

Default:This policy is not defined, which means that the system treats it as 15 minutes for servers and undefined for workstations.

Microsoft network server: Digitally sign communications (always)

This security setting determines whether packet signing is required by the SMB server component.

The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent "man-in-the-middle" attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB client is permitted.

If this setting is enabled, the Microsoft network server will not communicate with a Microsoft network client unless that client agrees to perform SMB packet signing. If this setting is disabled, SMB packet signing is negotiated between the client and server.

Default:

Disabled for member servers.Enabled for domain controllers.

Notes

All Windows operating systems support both a client-side SMB component and a server-side SMB component. To take advantage of SMB packet signing, both the client-side SMB component and server-side SMB component that are involved in a communication must have SMB packet signing either enabled or required. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings:Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing.Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled.Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing.Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled.If server-side SMB signing is required, a client will not be able to establish a session with that server unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers.Similarly, if client-side SMB signing is required, that client will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers.If server-side SMB signing is enabled, SMB packet signing will be negotiated with clients that have client-side SMB signing enabled.Using SMB packet signing can degrade performance up to 15 percent on file service transactions.

Important

For this policy to take effect on computers running Windows 2000, server-side packet signing must also be enabled. To enable server-side SMB packet signing, set the following policy:Microsoft network server: Digitally sign communications (if server agrees)

For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the Windows 2000 server:HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature

Computers that have this policy set will not communicate with computers that do not have client-side packet signing enabled. Client-side packet signing can be enabled on computers running Windows 2000 and later by setting the following policy:

Microsoft network server: Digitally sign communications (if client agrees)

This security setting determines whether the SMB server will negotiate SMB packet signing with clients that request it.

The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB server will negotiate SMB packet signing when an SMB client requests it.

If this setting is enabled, the Microsoft network server will negotiate SMB packet signing as requested by the client. That is, if packet signing has been enabled on the client, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing.

Default: Enabled on domain controllers only.

Important

Tor Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the server running Windows 2000: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature

Notes

All Windows operating systems support both a client-side SMB component and a server-side SMB component. To take advantage of SMB packet signing, both the client-side SMB component and server-side SMB component that are involved in a communication must have SMB packet signing either enabled or required. For Windows 2000 and above, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings:Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing.Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled.Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing.Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled.If server-side SMB signing is required, a client will not be able to establish a session with that server unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers.Similarly, if client-side SMB signing is required, that client will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers.If server-side SMB signing is enabled, SMB packet signing will be negotiated with clients that have client-side SMB signing enabled.Using SMB packet signing can impose up to a 15 percent performance hit on file service transactions.

Microsoft network server: Disconnect clients when logon hours expire

This security setting determines whether to disconnect users who are connected to the local computer outside their user account's valid logon hours. This setting affects the Server Message Block (SMB) component.

When this policy is enabled, it causes client sessions with the SMB Service to be forcibly disconnected when the client's logon hours expire.

If this policy is disabled, an established client session is allowed to be maintained after the client's logon hours have expired.

Default on Windows Vista: Enabled.Default on Windows XP: Disabled

Network access: Allow anonymous SID/name translation

This security setting determines if an anonymous user can request security identifier (SID) attributes for another user.

If this policy is enabled, a user with knowledge of an administrator's SID could contact a computer that has this policy enabled and use the SID to get the administrator's name.

Default on workstations and member servers: Disabled.Default on domain controllers: Enabled.

Network access: Do not allow anonymous enumeration of SAM accounts

This security setting determines what additional permissions will be granted for anonymous connections to the computer.

Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust.

This security option allows additional restrictions to be placed on anonymous connections as follows:

Enabled: Do not allow enumeration of SAM accounts. This option replaces Everyone with Authenticated Users in the security permissions for resources.Disabled: No additional restrictions. Rely on default permissions.

Default on workstations: Enabled.Default on server:Disabled.

Important

This policy has no impact on domain controllers.

Network access: Do not allow anonymous enumeration of SAM accounts and shares

This security setting determines whether anonymous enumeration of SAM accounts and shares is allowed.

Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. If you do not want to allow anonymous enumeration of SAM accounts and shares, then enable this policy.

Default: Disabled.

Network access: Do not allow storage of credentials or .NET Passports for network authentication

This security setting determines whether Stored User Names and Passwords saves passwords, credentials, or .NET Passports for later use when it gains domain authentication.

If it is enabled, this setting prevents the Stored User Names and Passwords from storing passwords and credentials.

Note: When configuring this security setting, changes will not take effect until you restart Windows.For more information about Stored User Names and Passwords, see Stored User Names and Passwords.

Default: Disabled.

Network access: Let Everyone permissions apply to anonymous users

This security setting determines what additional permissions are granted for anonymous connections to the computer.

Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. By Default, the Everyone security identifier (SID) is removed from the token created for anonymous connections. Therefore, permissions granted to the Everyone group do not apply to anonymous users. If this option is set, anonymous users can only access those resources for which the anonymous user has been explicitly given permission.

If this policy is enabled, the Everyone SID is added to the token that is created for anonymous connections. In this case, anonymous users are able to access any resource for which the Everyone group has been given permissions.

Default: Disabled.

Network access: Named pipes that can be accessed anonymously

This security setting determines which communication sessions (pipes) will have attributes and permissions that allow anonymous access.

Default: None.


This security setting determines which registry paths can be accessed over the network, regardless of the users or groups listed in the access control list (ACL) of the winreg registry key.

Default:

System\\CurrentControlSet\\Control\\ProductOptionsSystem\\CurrentControlSet\\Control\\Server ApplicationsSoftware\\Microsoft\\Windows NT\\CurrentVersion

Caution

Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. Note: This security setting is not available on earlier versions of Windows. The security setting that appears on computers running Windows XP, "Network access: Remotely accessible registry paths" corresponds to the "Network access: Remotely accessible registry paths and subpaths" security option on members of the Windows Server 2003 family. For more information, see Network access: Remotely accessible registry paths and subpaths.Default:

System\CurrentControlSet\Control\ProductOptionsSystem\CurrentControlSet\Control\Server ApplicationsSoftware\Microsoft\Windows NT\CurrentVersion


This security setting determines which registry paths can be accessed over the network, regardless of the users or groups listed in the access control list (ACL) of the winreg registry key.

Default:

System\\CurrentControlSet\\Control\\ProductOptionsSystem\\CurrentControlSet\\Control\\Server ApplicationsSoftware\\Microsoft\\Windows NT\\CurrentVersion

Caution

Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. Note: This security setting is not available on earlier versions of Windows. The security setting that appears on computers running Windows XP, "Network access: Remotely accessible registry paths" corresponds to the "Network access: Remotely accessible registry paths and subpaths" security option on members of the Windows Server 2003 family. For more information, see Network access: Remotely accessible registry paths and subpaths.Default:

System\CurrentControlSet\Control\ProductOptionsSystem\CurrentControlSet\Control\Server ApplicationsSoftware\Microsoft\Windows NT\CurrentVersion

Network access: Remotely accessible registry paths and subpaths

This security setting determines which registry paths and subpaths can be accessed over the network, regardless of the users or groups listed in the access control list (ACL) of the winreg registry key.

Default:

System\\CurrentControlSet\\Control\\Print\\PrintersSystem\\CurrentControlSet\\Services\\EventlogSoftware\\Microsoft\\OLAP ServerSoftware\\Microsoft\\Windows NT\\CurrentVersion\\PrintSoftware\\Microsoft\\Windows NT\\CurrentVersion\\WindowsSystem\\CurrentControlSet\\Control\\ContentIndexSystem\\CurrentControlSet\\Control\\Terminal ServerSystem\\CurrentControlSet\\Control\\Terminal Server\\UserConfigSystem\\CurrentControlSet\\Control\\Terminal Server\\DefaultUserConfigurationSoftware\\Microsoft\\Windows NT\\CurrentVersion\\PerflibSystem\\CurrentControlSet\\Services\\SysmonLogSystem\\CurrentControlSet\\Services\\CertSvcSystem\\CurrentControlSet\\Services\\Wins

Caution

Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Note: On Windows XP, this security setting was called "Network access: Remotely accessible registry paths." If you configure this setting on a member of the Windows Server 2003 family that is joined to a domain, this setting is inherited by computers running Windows XP, but will appear as the "Network access: Remotely accessible registry paths" security option. For more information, see Network access: Remotely accessible registry paths and subpaths.

Network access: Restrict anonymous access to Named Pipes and Shares

When enabled, this security setting restricts anonymous access to shares and pipes to the settings for:

Network access: Named pipes that can be accessed anonymouslyNetwork access: Shares that can be accessed anonymouslyDefault: Enabled.

Network access: Shares that can be accessed anonymously

This security setting determines which network shares can accessed by anonymous users.

Default: None specified.

Network access: Sharing and security model for local accounts

This security setting determines how network logons using local accounts are authenticated. If this setting is set to Classic, network logons that use local account credentials authenticate by using those credentials. The Classic model allows fine control over access to resources. By using the Classic model, you can grant different types of access to different users for the same resource.If this setting is set to Guest only, network logons that use local accounts are automatically mapped to the Guest account. By using the Guest model, you can have all users treated equally. All users authenticate as Guest, and they all receive the same level of access to a given resource, which can be either Read-only or Modify.

Default on domain omputers: Classic.Default on stand-alone computers: Guest only

Important

With the Guest only model, any user who can access your computer over the network (including anonymous Internet users) can access your shared resources. You must use the Windows Firewall or other similar device to protect your computer from unauthorized access. Similarly, with the Classic model, local accounts must be password protected; otherwise, those user accounts can be used by anyone to access shared system resources.

Note:

This setting does not affect interactive logons that are performed remotely by using such services as Telnet or Terminal ServicesThis policy will have no impact on computers running Windows 2000.When the computer is not joined to a domain, this setting also modifies the Sharing and Security tabs in the Windows Explorer to correspond to the sharing and security model that is being used.

Network security: Do not store LAN Manager hash value on next password change

This security setting determines if, at the next password change, the LAN Manager (LM) hash value for the new password is stored. The LM hash is relatively weak and prone to attack, as compared with the cryptographically stronger Windows NT hash. Since the LM hash is stored on the local computer in the security database the passwords can be compromised if the security database is attacked.

Default on Windows Vista: EnabledDefault on Windows XP: Disabled.

Important

Windows 2000 Service Pack 2 (SP2) and above offer compatibility with authentication to previous versions of Windows, such as Microsoft Windows NT 4.0.This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP, and the Windows Server 2003 family to communicate with computers running Windows 95 and Windows 98.

Network security: Force logoff when logon hours expire

This security setting determines whether to disconnect users who are connected to the local computer outside their user account's valid logon hours. This setting affects the Server Message Block (SMB) component.

When this policy is enabled, it causes client sessions with the SMB server to be forcibly disconnected when the client's logon hours expire.

If this policy is disabled, an established client session is allowed to be maintained after the client's logon hours have expired.

Default: Enabled.

Note: This security setting behaves as an account policy. For domain accounts, there can be only one account policy. The account policy must be defined in the Default Domain Policy, and it is enforced by the domain controllers that make up the domain. A domain controller always pulls the account policy from the Default Domain Policy Group Policy object (GPO), even if there is a different account policy applied to the organizational unit that contains the domain controller. By default, workstations and servers that are joined to a domain (for example, member computers) also receive the same account policy for their local accounts. However, local account policies for member computers can be different from the domain account policy by defining an account policy for the organizational unit that contains the member computers. Kerberos settings are not applied to member computers.

Network security: LAN Manager authentication level

This security setting determines which challenge/response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers as follows:

Send LM & NTLM responses: Clients use LM and NTLM authentication and never use NTLMv2 session security; domain controllers accept LM, NTLM, and NTLMv2 authentication.Send LM & NTLM - use NTLMv2 session security if negotiated: Clients use LM and NTLM authentication and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication.Send NTLM response only: Clients use NTLM authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication.Send NTLMv2 response only: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication.Send NTLMv2 response only\\refuse LM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM (accept only NTLM and NTLMv2 authentication).Send NTLMv2 response only\\refuse LM & NTLM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM and NTLM (accept only NTLMv2 authentication).

Important

This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP Professional, and the Windows Server 2003 family to communicate with computers running Windows NT 4.0 and earlier over the network. For example, at the time of this writing, computers running Windows NT 4.0 SP4 and earlier did not support NTLMv2. Computers running Windows 95 and Windows 98 did not support NTLM.

Default:

Send LM & NTLM responses on server.Undefined on workstations.

Network security: LDAP client signing requirements

This security setting determines the level of data signing that is requested on behalf of clients issuing LDAP BIND requests, as follows:

None: The LDAP BIND request is issued with the options that are specified by the caller.Negotiate signing: If Transport Layer Security/Secure Sockets Layer (TLS\SSL) has not been started, the LDAP BIND request is initiated with the LDAP data signing option set in addition to the options specified by the caller. If TLS\SSL has been started, the LDAP BIND request is initiated with the options that are specified by the caller.Require signature: This is the same as Negotiate signing. However, if the LDAP server's intermediate saslBindInProgress response does not indicate that LDAP traffic signing is required, the caller is told that the LDAP BIND command request failed.

Caution

If you set the server to Require signature, you must also set the client. Not setting the client results in a loss of connection with the server.

Note: This setting does not have any impact on ldap_simple_bind or ldap_simple_bind_s. No Microsoft LDAP clients that are shipped with Windows XP Professional use ldap_simple_bind or ldap_simple_bind_s to talk to a domain controller.

Default: Negotiate signing.

Network security: Minimum session security for NTLM SSP based (including secure RPC) clients

This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are:

Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated.Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated.

Default: No requirements.

Network security: Minimum session security for NTLM SSP based (including secure RPC) servers

This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are:

Require NTLMv2 session security: The connection will fail if message integrity is not negotiated.Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated.

Default: No requirements.

Recovery console: Allow automatic administrative logon

This security setting determines if the password for the Administrator account must be given before access to the system is granted. If this option is enabled, the Recovery Console does not require you to provide a password, and it automatically logs on to the system.

Default: This policy is not defined and automatic administrative logon is not allowed.

Recovery console: Allow floppy copy and access to all drives and all folders

Enabling this security option makes the Recovery Console SET command available, which allows you to set the following Recovery Console environment variables:

AllowWildCards: Enable wildcard support for some commands (such as the DEL command).AllowAllPaths: Allow access to all files and folders on the computer.AllowRemovableMedia: Allow files to be copied to removable media, such as a floppy disk.NoCopyPrompt: Do not prompt when overwriting an existing file.

Default: This policy is not defined and the recover console SET command is not available.

Shutdown: Allow system to be shut down without having to log on

This security setting determines whether a computer can be shut down without having to log on to Windows.

When this policy is enabled, the Shut Down command is available on the Windows logon screen.

When this policy is disabled, the option to shut down the computer does not appear on the Windows logon screen. In this case, users must be able to log on to the computer successfully and have the Shut down the system user right before they can perform a system shutdown.

Default on workstations: Enabled.Default on servers: Disabled.

Shutdown: Clear virtual memory pagefile

This security setting determines whether the virtual memory pagefile is cleared when the system is shut down.

Virtual memory support uses a system pagefile to swap pages of memory to disk when they are not used. On a running system, this pagefile is opened exclusively by the operating system, and it is well protected. However, systems that are configured to allow booting to other operating systems might have to make sure that the system pagefile is wiped clean when this system shuts down. This ensures that sensitive information from process memory that might go into the pagefile is not available to an unauthorized user who manages to directly access the pagefile.

When this policy is enabled, it causes the system pagefile to be cleared upon clean shutdown. If you enable this security option, the hibernation file (hiberfil.sys) is also zeroed out when hibernation is disabled on a portable computer system.

Default: Disabled.

System cryptography: Use FIPS compliant algorithms for encryption, hashing and signing

This security setting determines if the Transport Layer Security/Secure Sockets Layer (TL/SS) Security Provider supports only the Transport Layer Security (TLS) protocol as a client and as a server (if applicable). If this setting is enabled, it uses only the Triple DES encryption algorithm for the TLS traffic encryption, only the Rivest, Shamir, and Adleman (RSA) public key algorithm for the TLS key exchange and authentication, and only the Secure Hashing Algorithm 1 (SHA-1) for the TLS hashing requirements.

For Encrypting File System Service (EFS), it supports only the Triple Data Encryption Standard (DES) encryption algorithm for encrypting file data supported by the NTFS file system. By default, EFS uses the Advanced Encryption Standard (AES) algorithm with a 256-bit key in the Windows Server 2003 family and DESX algorithm in Windows XP for encrypting file data. For information about EFS, see Encrypting File System.

For Terminal Services, it supports only the Triple DES encryption algorithm for encrypting terminal services network communication. For information about Terminal Services, see Terminal Services.

Default: Disabled.

Note: The Federal Information Processing Standard (FIPS) 140-1 is a security implementation designed for certifying cryptographic software. FIPS 140-1 validated software is required by the U.S. Government and requested by other prominent institutions.

System Cryptography: Force strong key protection for user keys stored on the computer

This security setting determines if users' private keys require a password to be used.

The options are:

User input is not required when new keys are stored and usedUser is prompted when the key is first usedUser must enter a password each time they use a keyFor more information, see Public key infrastructure.

Default: This policy is not defined.

System objects: Default owner for objects created by members of the Administrators groupDescriptionThis security setting determines which users and groups have the authority to run volume maintenance tasks, such as Disk Cleanup and Disk Defragmenter.

Default: Administrators group (on servers).

System objects: Require case insensitivity for non-Windows subsystems

This security setting determines whether case insensitivity is enforced for all subsystems. The Win32 subsystem is case insensitive. However, the kernel supports case sensitivity for other subsystems, such as POSIX.

If this setting is enabled, case insensitivity is enforced for all directory objects, symbolic links, and IO objects, including file objects. Disabling this setting does not allow the Win32 subsystem to become case sensitive.

Default: Enabled.

System objects: Strengthen default permissions of internal system objects (e.g., Symbolic Links)

This security setting determines the strength of the default discretionary access control list (DACL) for objects.

Active Directory maintains a global list of shared system resources, such as DOS device names, mutexes, and semaphores. In this way, objects can be located and shared among processes. Each type of object is created with a default DACL that specifies who can access the objects and what permissions are granted.

If this policy is enabled, the default DACL is stronger, allowing users who are not administrators to read shared objects but not allowing these users to modify shared objects that they did not create.

Default: Enabled.

System settings: Optional subsystems

This security setting determines which subsystems are used to support your applications. With this security setting, you can specify as many subsytems to support as your environment demands.

Default: POSIX.

System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies

This security setting determines if digital certificates are processed when a user or process attempts to run software with an .exe file name extension. This security settings is used to enable or disable certificate rules, a type of software restriction policies rule. With software restriction policies, you can create a certificate rule that will allow or disallow software that is signed by Authenticode to run, based on the digital certificate that is associated with the software. In order for certificate rules to take effect, you must enable this security setting.

When certificate rules are enabled, software restriction policies will check a certificate revocation list (CRL) to make sure the software's certificate and signature are valid. This may decrease performance when start signed programs. You can disable this feature. On Trusted Publishers Properties, clear the Publisher and Timestamp check boxes. For more information, see Set trusted publisher options.

Default: Disabled.

User Account Control: Admin Approval Mode for the Built-in Administrator account

This security setting determines the behavior of Admin Approval mode for the Built-in Administrator account.

The options are:

ò Enabled: The Built-in Administrator will logon in Admin Approval Mode. By default any operation that requires elevation of privilege will prompt the Consent Admin to choose either Permit or Deny.

ò Disabled: The Built-in Administrator will logon in XP compatible mode and run all applications by default with full administrative privilege.

Default: Disabled

User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

This security setting determines the behavior of the elevation prompt for administrators

The options are:

ò Prompt for consent: An operation that requires elevation of privilege will prompt the Consent Admin to select either Permit or Deny. If the Consent Admin selects Permit the operation will continue with their highest available privilege. This option allows users to enter their name and password to perform a privileged task.

ò Prompt for credentials: An operation that requires elevation of privilege will prompt the Consent Admin to enter their user name and password. If the user enters valid credentials the operation will continue with the applicable privilege.

ò Elevate without prompting: This option allows the Consent Admin to perform an operation that requires elevation without consent or credentials. Note: this scenario should only be used in the most constrained environments.

Default: Prompt for consent

User Account Control: Behavior of the elevation prompt for standard usersThis security setting determines the behavior of the elevation prompt for standard users

The options are:

ò Prompt for credentials: An operation that requires elevation of privilege will prompt the user to enter an administrative user name and password. If the user enters valid credentials the operation will continue with the applicable privilege.

ò Automatically deny elevation requests: This option results in an access denied error message being returned to the standard user when they try to perform an operation that requires elevation of privilege. Most enterprises running desktops as standard user will configure this policy to reduce help desk calls.

Default: Prompt for credentials (home) / Automatically deny elevation requests (enterprise)

User Account Control: Detect application installations and prompt for elevation

This security setting determines the behavior of application installation detection for the entire system.

The options are:

ò Enabled: Application installation packages that require an elevation of privilege to install will be heuristically detected and trigger the configured elevation prompt UX.

ò Disabled: Enterprises running standard users desktops that leverage delegated installation technologies like Group Policy Software Install (GPSI) or SMS will disable this feature. In this case, installer detection is unnecessary and thus not required.

Default: Enabled (home) / Disabled (enterprise)

User Account Control: Only elevate executables that are signed and validated

This security setting will enforce PKI signature checks on any interactive application that requests elevation of privilege. Enterprise administrators can control the admin application allowed list thru the population of certificates in the local computers Trusted Publisher Store.

The options are:

ò Enabled: Enforces the PKI certificate chain validation of a given executable before it is permitted to run.

ò Disabled: Does not enforce PKI certificate chain validation before a given executable is permitted to run.

Default: Disabled

User Account Control: Only elevate UIAccess applications that are installed in secure locations

This security setting will enforce the requirement that applications that request execution with a UIAccess integrity level (via a marking of UIAccess=true in their application manifest), must reside in a secure location on the file system. Secure locations are limited to the following directories:

- à\Program Files\, including subdirectories- à\Windows\system32\- à\Program Files (x86)\, including subdirectories for 64 bit versions of Windows

Note: Windows enforces a PKI signature check on any interactive application that requests execution with UIAccess integrity level regardless of the state of this security setting.

The options are:

ò Enabled: An application will only launch with UIAccess integrity if it resides in a secure location in the file system.

ò Disabled: An application will launch with UIAccess integrity even if it does not reside in a secure location in the file system.

Default: Enabled

User Account Control: Run all users, including administrators, as standard users.

This security setting determines the behavior of all UAC policies for the entire system.

The options are:

ò Enabled: Admin Approval Mode and all other UAC policies are dependent on this option being enabled. Changing this setting requires a system reboot.

ò Disabled: Admin Approval Mode user type and all related UAC policies will be disabled. Note: the Security Center will notify that the overall security of the operating system has been reduced.

Default: Enabled

User Account Control: Switch to the secure desktop when prompting for elevation

This security setting determines whether the elevation request will prompt on the interactive users desktop or the Secure Desktop.

The options are:

ò Enabled: All elevation requests by default will go to the secure desktop

ò Disabled: All elevation requests will go to the interactive users desktop

Default: Enabled

User Account Control: Virtualizes file and registry write failures to per-user locations

User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop.

Maximum application log size

This security setting specifies the maximum size of the application event log, which has a maximum of 4 GB.

Notes

Log file sizes must be a multiple of 64 KB. If you enter a value that is not a multiple of 64 KB, Event Viewer will set the log file size to a multiple of 64 KB.This setting does not appear in the Local Computer Policy object.Event Log size and log wrapping should be defined to match the business and security requirements you determined when designing your enterprise security plan. Consider implementing these Event Log settings at the site, domain, or organizational unit level, to take advantage of Group Policy settings.Default: For the Windows Server 2003 family, 16 MB; for Windows XP Professional Service Pack 1, 8 MB; for Windows XP Professional, 512 KB.

Maximum security log size

This security setting specifies the maximum size of the security event log, which has a maximum size of 4 GB.

Notes

Log file sizes must be a multiple of 64 KB. If you enter a value that is not a multiple of 64 KB, Event Viewer will set the log file size to a multiple of 64 KB.This setting does not appear in the Local Computer Policy object.Event Log size and log wrapping should be defined to match the business and security requirements you determined when designing your enterprise security plan. Consider implementing these Event Log settings at the site, domain, or organizational unit level, to take advantage of Group Policy settings.Default: For the Windows Server 2003 family, 16 MB; for Windows XP Professional Service Pack 1, 8 MB; for Windows XP Professional, 512 KB.

Maximum system log size

This security setting specifies the maximum size of the system event log, which has a maximum size of 4 GB.

Notes

Log file sizes must be a multiple of 64 KB. If you enter a value that is not a multiple of 64 KB, Event Viewer will set the log file size to a multiple of 64 KB.This setting does not appear in the Local Computer Policy object.Event Log size and log wrapping should be defined to match the business and security requirements you determined when designing your Enterprise Security Plan. Consider implementing these Event Log settings at the site, domain, or organizational unit level, to take advantage of Group Policy settings.Default: For the Windows Server 2003 family, 16 MB; for Windows XP Professional Service Pack 1, 8 MB; for Windows XP Professional, 512 KB.

Prevent local guests group from accessing application log

This security setting determines if guests are prevented from accessing the application event log.

Notes

This setting does not appear in the Local Computer Policy object.This security setting affects only computers running Windows 2000 and Windows XP.Default: Enabled.

Prevent local guests group from accessing security log

This security setting determines if guests are prevented from accessing the security event log.

Notes

This setting does not appear in the Local Computer Policy object.This security setting affects only computers running Windows 2000 and Windows XP.A user must possess the Manage auditing and security log user right to access the security log.Default: Enabled.

Prevent local guests group from accessing system log

This security setting determines if guests are prevented from accessing the system event log.

Notes

This setting does not appear in the Local Computer Policy object.This security setting affects only computers running Windows 2000 and Windows XP.Default: Enabled.

Retain application log

This security setting determines the number of days' worth of events to be retained for the application log if the retention method for the application log is By Days.

Set this value only if you archive the log at scheduled intervals and you make sure that the Maximum application log size is large enough to accommodate the interval.

Notes

This setting does not appear in the Local Computer Policy object.A user must possess the Manage auditing and security log user right to access the security log.Default: None.

Retain security log

This security setting determines the number of days' worth of events to be retained for the security log if the retention method for the security log is By Days.

Set this value only if you archive the log at scheduled intervals and you make sure that the Maximum security log size is large enough to accommodate the interval.

Note: This setting does not appear in the Local Computer Policy object.Default: None.

Retain system log

This security setting determines the number of days' worth of events to be retained for the system log if the retention method for the system log is By Days.

Set this value only if you archive the log at scheduled intervals and you make sure that the Maximum system log size is large enough to accommodate the interval.

Note: This setting does not appear in the Local Computer Policy object.Default: None.

Retention method for application log

This security setting determines the "wrapping" method for the application log.

If you do not archive the application log, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Overwrite events as needed.

If you archive the log at scheduled intervals, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Overwrite events by days and specify the appropriate number of days in the Retain application log setting. Make sure that the Maximum application log size is large enough to accommodate the interval.

If you must retain all the events in the log, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Do not overwrite events (clear log manually). This option requires that the log be cleared manually. In this case, when the maximum log size is reached, new events are discarded.

Note: This setting does not appear in the Local Computer Policy object.

Default: None.

Retention method for security log

This security setting determines the "wrapping" method for the security log.

If you do not archive the security log, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Overwrite events as needed.

If you archive the log at scheduled intervals, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Overwrite events by days and specify the appropriate number of days in the retain security log setting. Make sure that the Maximum security log size is large enough to accommodate the interval.



Default: None.

Retention method for system log

This security setting determines the "wrapping" method for the system log.

If you do not archive the system log, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Overwrite events as needed.

If you archive the log at scheduled intervals, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Overwrite events by days and specify the appropriate number of days in the Retain system log setting. Make sure that the Maximum system log size is large enough to accommodate the interval.



Default: None.

Restricted Groups

This security setting allows an administrator to define two properties for security-sensitive groups ("restricted" groups).

The two properties are Members and Member Of. The Members list defines who belongs and who does not belong to the restricted group. The Member Of list specifies which other groups the restricted group belongs to.

When a Restricted Groups Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list who is not currently a member of the restricted group is added.

You can use Restricted Groups policy to control group membership. Using the policy, you can specify what members are part of a group. Any members that are not specified in the policy are removed during configuration or refresh. In addition, the reverse membership configuration option ensures that each Restricted Group is a member of only those groups that are specified in the Member Of column.

For example, you can create a Restricted Groups policy to only allow specified users (for example, Alice and John) to be members of the Administrators group. When policy is refreshed, only Alice and John will remain as members of the Administrators group.

There are two ways to apply Restricted Groups policy:

Define the policy in a security template, which will be applied during configuration on your local computer.Define the setting on a Group Policy object (GPO) directly, which means that the policy goes into effect with every refresh of policy. The security settings are refreshed every 90 minutes on a workstation or server and every 5 minutes on a domain controller. The settings are also refreshed every 16 hours, whether or not there are any changes.Default: None specified.

Caution

If a Restricted Groups policy is defined and Group Policy is refreshed, any current member not on the Restricted Groups policy members list is removed. This can include default members, such as administrators.

Notes

Restricted Groups should be used primarily to configure membership of local groups on workstation or member servers.An empty Members list means that the restricted group has no members; an empty Member Of list means that the groups to which the restricted group belongs are not specified.

System Services security settings

Allows an administrator to define the startup mode (manual, automatic, or disabled) as well as the access permissions (Start, Stop, or Pause) for all system services.

Default: Undefined.

Notes

This setting does not appear in the Local Computer Policy object.If you choose to set system service startup to Automatic, perform adequate testing to verify that the services can start without user intervention.For performance optimization, set unnecessary or unused services to Manual.

Registry security settings

Allows an administrator to define access permissions (on discretionary access control lists (DACLs)) and audit settings (on system access control lists (SACLs)) for registry keys using Security Configuration Manager.

Default: Undefined.


File System security settings

Allows an administrator to define access permissions (on discretionary access control lists (DACLs)) and audit settings (on system access control lists (SACLs)) for file system objects using Security Configuration Manager.

Default: Undefined.


Reboot Required

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

Yes

Yes

No

No

Yes

No

No

No

No

No

No

No

No

No

Yes

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

Yes

Yes

Yes

Yes

Yes

No

No

No

No

No

No

No

Yes

No

No

No

Yes

Yes

No

No

No

No

Yes

No

No

No

No

No

Yes

No

Yes

No

Yes

Yes

Yes

No

No

No

No

No

No

No

Yes

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No

No