Policies (Windows Configuration Designer reference)

This section describes the Policies settings that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer. Each setting below links to its supported values, as documented in the Policy configuration service provider (CSP).

AboveLock

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowActionCenterNotifications Allow Action Center notifications above the device lock screen.
AllowToasts Allow toast notifications above the device lock screen.

Accounts

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowAddingNonMicrosoftAccountManually Whether users can add non-Microsoft email accounts
AllowMicrosoftAccountConnection Whether users can use a Microsoft account for non-email-related connection authentication and services
AllowMicrosoftAccountSigninAssistant Disable the Microsoft Account Sign-In Assistant (wlidsvc) NT service
DomainNamesForEmailSync List of domains that are allowed to sync email on the devices

ApplicationDefaults

Setting Description Windows client Surface Hub HoloLens IoT Core
DefaultAssociationsConfiguration Set default file type and protocol associations

ApplicationManagement

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowAllTrustedApps Whether non-Microsoft Store apps are allowed
AllowAppStoreAutoUpdate Whether automatic update of apps from Microsoft Store is allowed
AllowDeveloperUnlock Whether developer unlock of device is allowed
AllowGameDVR Whether DVR and broadcasting are allowed
AllowSharedUserAppData Whether multiple users of the same app can share data
AllowStore Whether app store is allowed at device
ApplicationRestrictions An XML blob that specifies app restrictions, such as an allowlist, disallow list, etc.
LaunchAppAfterLogOn Whether to launch an app or apps when the user signs in.
RestrictAppDataToSystemVolume Whether app data is restricted to the system drive
RestrictAppToSystemVolume Whether the installation of apps is restricted to the system drive

Authentication

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowFastReconnect Allows EAP Fast Reconnect from being attempted for EAP Method TLS.
EnableFastFirstSignin Enables a quick first sign-in experience for a user by automatically connecting new non-admin Azure AD accounts to the pre-configured candidate local accounts.
EnableWebSignin Enables Windows sign-in support for non-ADFS federated providers (for example, SAML).
PreferredAadTenantDomainName Specifies the preferred domain among available domains in the Azure AD tenant.

BitLocker

Setting Description Windows client Surface Hub HoloLens IoT Core
EncryptionMethod Specify BitLocker drive encryption method and cipher strength

Bluetooth

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowAdvertising Whether the device can send out Bluetooth advertisements
AllowDiscoverableMode Whether other Bluetooth-enabled devices can discover the device
AllowPrepairing Whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device
AllowPromptedProximalConnections Whether Windows will prompt users when Bluetooth devices that are connectable are in range of the user's device
LocalDeviceName Set the local Bluetooth device name
ServicesAllowedList Set a list of allowable services and profiles

Browser

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowAddressBarDropdown Specify whether to allow the address bar drop-down functionality in Microsoft Edge. If you want to minimize network connections from Microsoft Edge to Microsoft services, we recommend disabling this functionality.
AllowAutofill Specify whether autofill on websites is allowed.
AllowBrowser Specify whether the browser is allowed on the device (for Windows 10, version 1803 and earlier only).
AllowConfigurationUpdateForBooksLibrary Specify whether Microsoft Edge can automatically update the configuration data for the Books Library.
AllowCookies Specify whether cookies are allowed.
AllowDeveloperTools Specify whether employees can use F12 Developer Tools on Microsoft Edge.
AllowDoNotTrack Specify whether Do not Track headers are allowed.
AllowExtensions Specify whether Microsoft Edge extensions are allowed.
AllowFlash Specify whether Adobe Flash can run in Microsoft Edge.
AllowFlashClickToRun Specify whether users must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash.
AllowFullScreenMode Specify whether full-screen mode is allowed.
AllowInPrivate Specify whether InPrivate browsing is allowed on corporate networks.
AllowMicrosoftCompatibilityList Specify whether to use the Microsoft compatibility list in Microsoft Edge.
AllowPasswordManager Specify whether saving and managing passwords locally on the device is allowed.
AllowPopups Specify whether pop-up blocker is allowed or enabled.
AllowPrelaunch Specify whether Microsoft Edge can pre-launch as a background process during Windows startup when the system is idle waiting to be launched by the user.
AllowPrinting Specify whether users can print web content in Microsoft Edge.
AllowSavingHistory Specify whether Microsoft Edge saves the browsing history.
AllowSearchEngineCustomization Allow search engine customization for MDM-enrolled devices.
AllowSearchSuggestionsinAddressBar Specify whether search suggestions are allowed in the address bar.
AllowSideloadingOfExtensions Specify whether extensions can be sideloaded in Microsoft Edge.
AllowSmartScreen Specify whether Windows Defender SmartScreen is allowed.
AllowTabPreloading Specify whether preloading the Start and New tab pages during Windows sign-in is allowed.
AllowWebContentOnNewTabPage Specify whether a New tab page opens with the default content or a blank page.
AlwaysEnableBooksLibrary Always show the Books Library in Microsoft Edge.
ClearBrowsingDataOnExit Specify whether to clear browsing data when exiting Microsoft Edge.
ConfigureAdditionalSearchEngines Allows you to add up to five more search engines for MDM-enrolled devices.
ConfigureFavoritesBar Specify whether the Favorites bar is shown or hidden on all pages.
ConfigureHomeButton Configure whether the Home button will be shown, and what should happen when it's selected. You should also configure the SetHomeButtonURL setting. To configure this setting and also allow users to make changes to the Home button, see the UnlockHomeButton setting.
ConfigureKioskMode Configure how Microsoft Edge operates when it's running in kiosk mode, either as a single-app kiosk or as one of multiple apps running on the kiosk device.
ConfigureKioskResetAfterIdleTimeout Specify the time, in minutes, after which Microsoft Edge running in kiosk mode resets to the default kiosk configuration.
ConfigureOpenMicrosoftEdgeWith Specify which pages should load when Microsoft Edge opens. You should also configure the ConfigureStartPages setting and DisableLockdownOfStartPages setting.
ConfigureTelemetryForMicrosoft365Analytics Specify whether to send Microsoft Edge browsing history data to Microsoft 365 Analytics.
DisableLockdownOfStartPages Specify whether the lockdown on the Start pages is disabled.
EnableExtendedBooksTelemetry Enable this setting to send more diagnostic data, on top of the basic diagnostic data, from the Books tab.
EnterpriseModeSiteList Allow the user to specify a URL of an enterprise site list.
EnterpriseSiteListServiceUrl This policy (introduced in Windows 10, version 1507) was deprecated in Windows 10, version 1511 by Browser/EnterpriseModeSiteList.
FirstRunURL Specify the URL that Microsoft Edge will use when it's opened for the first time.
HomePages Specify your Start pages for MDM-enrolled devices.
LockdownFavorites Configure whether employees can add, import, sort, or edit the Favorites list in Microsoft Edge.
PreventAccessToAboutFlagsInMicrosoftEdge Specify whether users can access the about:flags page, which is used to change developer settings and to enable experimental features.
PreventCertErrorOverrides Specify whether to override security warnings about sites that have SSL errors.
PreventFirstRunPage Specify whether to enable or disable the First Run webpage.
PreventLiveTileDataCollection Specify whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge.
PreventSmartScreenPromptOverride Specify whether users can override the Windows Defender SmartScreen warnings about potentially malicious websites.
PreventSmartScreenPromptOverrideForFiles Specify whether users can override the Windows Defender SmartScreen warnings about downloading unverified files.
PreventTabPreloading Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. Applies to Windows 10, version 1803 and earlier only.
PreventTurningOffRequiredExtensions Enter a list of extensions in Microsoft Edge that users can't turn off, using a semi-colon delimited list of extension package family names.
PreventUsingLocalHostIPAddressForWebRTC Specify whether a user's localhost IP address is displayed while making phone calls using the WebRTC protocol.
ProvisionFavorites Configure a default set of favorites that will appear for employees.
SendIntranetTraffictoInternetExplorer Specify whether to send intranet traffic to Internet Explorer.
SetDefaultSearchEngine Configure the default search engine for your employees.
SetHomeButtonURL Specify a custom URL for the Home button. You should also enable the ConfigureHomeButton setting and select the Show the home button; clicking the home button loads a specific URL option.
SetNewTabPageURL Specify a custom URL for a New tab page.
ShowMessageWhenOpeningSitesInInternetExplorer Specify whether users should see a full interstitial page in Microsoft Edge when opening sites that are configured to open in Internet Explorer using the Enterprise Site list.
SyncFavoritesBetweenIEAndMicrosoftEdge Specify whether favorites are kept in sync between Internet Explorer and Microsoft Edge.
UnlockHomeButton Specify whether users can make changes to the Home button.
UseSharedFolderForBooks Specify whether organizations should use a folder shared across users to store books from the Books Library.

Camera

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowCamera Disable or enable the camera.

Connectivity

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowBluetooth Allow the user to enable Bluetooth or restrict access.
AllowCellularData Allow the cellular data channel on the device.
AllowCellularDataRoaming Allow or disallow cellular data roaming on the device.
AllowConnectedDevices Allows IT admins the ability to disable the Connected Devices Platform component.
AllowNFC Allow or disallow near field communication (NFC) on the device.
AllowUSBConnection Enable USB connection between the device and a computer to sync files with the device or to use developer tools or to deploy or debug applications.
AllowVPNOverCellular Specify what type of underlying connections VPN is allowed to use.
AllowVPNRoamingOverCellular Prevent the device from connecting to VPN when the device roams over cellular networks.
HideCellularConnectionMode Hide the checkbox that lets the user change the connection mode.
HideCellularRoamingOption Hide the dropdown menu that lets the user change the roaming preferences.

CredentialProviders

Setting Description Windows client Surface Hub HoloLens IoT Core
DisableAutomaticReDeploymentCredentials This setting disables the visibility of the credential provider that triggers the PC refresh on a device. This policy doesn't actually trigger the refresh. The admin user is required to authenticate to trigger the refresh on the target device. The Windows 10 Autopilot Reset feature allows admin to reset devices to a known good managed state while preserving the management enrollment. After the automatic redeployment is triggered, the devices are for ready for use by information workers or students.

Cryptography

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowFipsAlgorithmPolicy Allow or disallow the Federal Information Processing Standard (FIPS) policy.
TLSCiperSuites List the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win.

Defender

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowArchiveScanning Allow or disallow scanning of archives.
AllowBehaviorMonitoring Allow or disallow Windows Defender Behavior Monitoring functionality.
AllowCloudProtection To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions.
AllowEmailScanning Allow or disallow scanning of email.
AllowFullScanOnMappedNetworkDrives Allow or disallow a full scan of mapped network drives.
AllowFullScanRemovableDriveScanning Allow or disallow a full scan of removable drives.
AllowIntrusionPreventionSystem Allow or disallow Windows Defender Intrusion Prevention functionality.
AllowIOAVProtection Allow or disallow Windows Defender IOAVP Protection functionality.
AllowOnAccessProtection Allow or disallow Windows Defender On Access Protection functionality.
AllowRealtimeMonitoring Allow or disallow Windows Defender Realtime Monitoring functionality.
AllowScanningNetworkFiles Allow or disallow scanning of network files.
AllowScriptScanning Allow or disallow Windows Defender Script Scanning functionality.
AllowUserUIAccess Allow or disallow user access to the Windows Defender UI.
AvgCPULoadFactor Represents the average CPU load factor for the Windows Defender scan (in percent).
DaysToRetainCleanedMalware Specify time period (in days) that quarantine items will be stored on the system.
ExcludedExtensions Specify a list of file type extensions to ignore during a scan. Separate each file type in the list by using |.
ExcludedPaths Specify a list of directory paths to ignore during a scan. Separate each path in the list by using |.
ExcludedProcesses Specify a list of files opened by processes to ignore during a scan. Separate each file type in the list by using |. The process itself isn't excluded from the scan, but can be excluded by using the Defender/ExcludedPaths policy to exclude its path.
RealTimeScanDirection Control which sets of files should be monitored.
ScanParameter Select whether to perform a quick scan or full scan.
ScheduleQuickScanTime Specify the time of day that Windows Defender quick scan should run.
ScheduleScanDay Select the day that Windows Defender scan should run.
ScheduleScanTime Select the time of day that the Windows Defender scan should run.
SignatureUpdateInterval Specify the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval.
SubmitSamplesConsent Checks for the user consent level in Windows Defender to send data.
ThreatSeverityDefaultAction Specify any valid threat severity levels and the corresponding default action ID to take.

DeliveryOptimization

Setting Description Windows client Surface Hub HoloLens IoT Core
DOAbsoluteMaxCacheSize Specify the maximum size in GB of Delivery Optimization cache.
DOAllowVPNPeerCaching Specify whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network.
DODelayBackgroundDownloadFromHttp Allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer.
DODelayForegroundDownloadFromHttp Allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer.
DODownloadMode Specify the download method that Delivery Optimization can use in downloads of Windows Updates, apps, and app updates.
DOGroupId Specify an arbitrary group ID that the device belongs to.
DOGroupIdSource Set this policy to restrict peer selection to a specific source
DOMaxCacheAge Specify the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully.
DOMaxCacheSize Specify the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100).
DOMaxDownloadBandwidth Specify the maximum download bandwidth in kilobytes/second that the device can use across all concurrent download activities using Delivery Optimization.
DOMaxUploadBandwidth Specify the maximum upload bandwidth in kilobytes/second that a device will use across all concurrent upload activity using Delivery Optimization.
DOMinBackgroundQos Specify the minimum download QoS (Quality of Service or speed) i kilobytes/second for background downloads.
DOMinBatteryPercentageAllowedToUpload Specify any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and group peers while on battery power.
DOMinDiskSizeAllowedToPeer Specify the required minimum disk size (capacity in GB) for the device to use Peer Caching.
DOMinFileSizeToCache Specify the minimum content file size in MB enabled to use Peer Caching.
DOMinRAMAllowedToPeer Specify the minimum RAM size in GB required to use Peer Caching.
DOModifyCacheDrive Specify the drive that Delivery Optimization should use for its cache.
DOMonthlyUploadDataCap Specify the maximum total bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month.
DOPercentageMaxBackDownloadBandwidth Specify the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth.
DOPercentageMaxDownloadBandwidth Specify the maximum download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth.
DOPercentageMaxForeDownloadBandwidth Specify the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth.
DORestrictPeerSelectionBy Set this policy to restrict peer selection by the selected option.
DOSetHoursToLimitBackgroundDownloadBandwidth Specify the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.
DOSetHoursToLimitForegroundDownloadBandwidth Specify the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.

DeviceGuard

Setting Description Windows client Surface Hub HoloLens IoT Core
EnableVirtualizationBasedSecurity Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services.

DeviceLock

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowIdleReturnWithoutPassword Specify whether the user must input a PIN or password when the device resumes from an idle state.
AllowScreenTimeoutWhileLockedUserConfig Specify whether to show a user-configurable setting to control the screen timeout while on the lock screen.
AllowSimpleDevicePassword Specify whether PINs or passwords such as "1111" or "1234" are allowed. For the desktop, it also controls the use of picture passwords.
AlphanumericDevicePasswordRequired Select the type of PIN or password required.
DevicePasswordEnabled Specify whether device password is enabled.
DevicePasswordExpiration Specify when the password expires (in days).
DevicePasswordHistory Specify how many passwords can be stored in the history that can't be reused.
MaxDevicePasswordFailedAttempts Specify the number of authentication failures allowed before the device will be wiped.
MaxInactivityTimeDeviceLock Specify the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked.
MinDevicePasswordComplexCharacters Specify the number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password.
MinDevicePasswordLength Specify the minimum number or characters required in the PIN or password.
ScreenTimeoutWhileLocked Specify the duration in seconds for the screen timeout while on the lock screen.

DeviceManagement

Setting Description Windows client Surface Hub HoloLens IoT Core
DisableMDMEnrollment Use this setting to prevent the device from enrolling in MDM.

Experience

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowCopyPaste Specify whether copy and paste are allowed.
AllowCortana Specify whether Cortana is allowed on the device.
AllowDeviceDiscovery Allow users to turn device discovery on or off in the UI.
AllowFindMyDevice Turn on Find my device feature.
AllowManualMDMUnenrollment Specify whether the user is allowed to delete the workplace account.
AllowScreenCapture Specify whether screen capture is allowed.
AllowSIMErrorDialogPromptWhenNoSIM Specify whether to display a dialog prompt when no SIM card is detected.
AllowSyncMySettings Allow or disallow all Windows sync settings on the device.
AllowTailoredExperiencesWithDiagnosticData Prevent Windows from using diagnostic data to provide customized experiences to the user.
AllowTaskSwitcher Allow or disallow task switching on the device.
AllowThirdPartySuggestionsInWindowsSpotlight Specify whether to allow app and content suggestions from third-party software publishers in Windows Spotlight.
AllowVoiceRecording Specify whether voice recording is allowed for apps.
AllowWindowsConsumerFeatures Turn on experiences that are typically for consumers only, such as Start suggestions, membership notifications, post-OOBE app install, and redirect tiles.
AllowWindowsSpotlight Specify whether to turn off all Windows Spotlight features at once.
AllowWindowsSpotlightOnActionCenter Prevent Windows Spotlight notifications from being displayed in the Action Center.
AllowWindowsSpotlightWindowsWelcomeExperience Turn off the Windows Spotlight Windows welcome experience feature.
AllowWindowsTips Enable or disable Windows Tips.
ConfigureWindowsSpotlightOnLockScreen Specify whether Spotlight should be used on the user's lock screen.

ExploitGuard

Setting Description Windows client Surface Hub HoloLens IoT Core
ExploitProtectionSettings See the explanation of ExploitProtectionSettings in the Policy CSP for instructions. In the ExploitProtectionSettings field, you can enter a path (local, UNC, or URI) to the mitigation options config, or you can enter the XML for the config.

Games

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowAdvancedGamingServices Currently not supported.

KioskBrowser

These settings apply to the Kiosk Browser app available in Microsoft Store.

Setting Description Windows client Surface Hub HoloLens IoT Core
BlockedUrlExceptions List of exceptions to the blocked website URLs (with wildcard support). This setting is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs.
BlockedUrls List of blocked website URLs (with wildcard support). This setting is used to configure blocked URLs kiosk browsers can't navigate to.
DefaultURL Configures the default URL kiosk browsers to navigate on launch and restart.
EnableEndSessionButton Enable/disable kiosk browser's end session button.
EnableHomeButton Enable/disable kiosk browser's home button.
EnableNavigationButtons Enable/disable kiosk browser's navigation buttons (forward/back).
RestartOnIdleTime Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. The value is an int 1-1440 that specifies the number of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty, which means there's no idle timeout within the kiosk browser.

To configure multiple URLs for Blocked URL Exceptions or Blocked URLs in Windows Configuration Designer:

  1. Create the provisioning package. When ready to export, close the project in Windows Configuration Designer.
  2. Open the customizations.xml file in the project folder (e.g C:\Users\name\Documents\Windows Imaging and Configuration Designer (WICD)\Project_18).
  3. Insert the null character string in between each URL (e.g https://www.bing.comwww.contoso.com).
  4. Save the XML file.
  5. Open the project again in Windows Configuration Designer.
  6. Export the package. Ensure you don't revisit the created policies under Kiosk Browser or else the null character will be removed.

LocalPoliciesSecurityOptions

Setting Description Windows client Surface Hub HoloLens IoT Core
InteractiveLogon_DoNotDisplayLastSignedIn Specify whether the Windows sign-in screen will show the username of the last person who signed in.
Shutdown_AllowSystemtobeShutDownWithoutHavingToLogOn Specify whether a computer can be shut down without signing in.
UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers Configure how an elevation prompt should behave for standard users.

Location

Setting Description Windows client Surface Hub HoloLens IoT Core
EnableLocation Don't use.

Power

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowStandbyStatesWhenSleepingOnBattery Specify whether Windows can use standby states when putting the computer in a sleep state while on battery.
AllowStandbyWhenSleepingPluggedIn Specify whether Windows can use standby states when putting the computer in a sleep state while plugged in.
DisplayOffTimeoutOnBattery Specify the period of inactivity before Windows turns off the display while on battery.
DisplayOffTimeoutPluggedIn Specify the period of inactivity before Windows turns off the display while plugged in.
EnergySaverBatteryThresholdOnBattery Specify the battery charge level at which Energy Saver is turned on while on battery.
EnergySaverBatteryThresholdPluggedIn Specify the battery charge level at which Energy Saver is turned on while plugged in.
HibernateTimeoutOnBattery Specify the period of inactivity before Windows transitions the system to hibernate while on battery.
HibernateTimeoutPluggedIn Specify the period of inactivity before Windows transitions the system to hibernate while plugged in.
RequirePasswordWhenComputerWakesOnBattery Specify whether the user is prompted for a password when the system resumes from sleep while on battery.
RequirePasswordWhenComputerWakesPluggedIn Specify whether the user is prompted for a password when the system resumes from sleep while plugged in.
SelectLidCloseActionBattery Select the action to be taken when a user closes the lid on a mobile device while on battery.
SelectLidCloseActionPluggedIn Select the action to be taken when a user closes the lid on a mobile device while on plugged in.
SelectPowerButtonActionOnBattery Select the action to be taken when the user presses the power button while on battery.
SelectPowerButtonActionPluggedIn Select the action to be taken when the user presses the power button while on plugged in.
SelectSleepButtonActionOnBattery Select the action to be taken when the user presses the sleep button while on battery.
SelectSleepButtonActionPluggedIn Select the action to be taken when the user presses the sleep button while plugged in.
StandbyTimeoutOnBattery Specify the period of inactivity before Windows transitions the system to sleep while on battery.
StandbyTimeoutPluggedIn Specify the period of inactivity before Windows transitions the system to sleep while plugged in.
TurnOffHybridSleepOnBattery Turn off hybrid sleep while on battery.
TurnOffHybridSleepPluggedIn Turn off hybrid sleep while plugged in.
UnattendedSleepTimeoutOnBattery Specify the period of inactivity before Windows transitions the system to sleep automatically when a user isn't present while on battery.
UnattendedSleepTimeoutPluggedIn Specify the period of inactivity before Windows transitions the system to sleep automatically when a user isn't present while plugged in.

Privacy

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowAutoAcceptPairingAndPrivacyConsentPrompts Allow or disallow the automatic acceptance of the pairing and privacy user consent dialog boxes when launching apps.
AllowInputPersonalization Allow the use of cloud-based speech services for Cortana, dictation, or Store apps.
Setting Description Windows client Surface Hub HoloLens IoT Core
AllowCloudSearch Allow search and Cortana to search cloud sources like OneDrive and SharePoint. T
AllowCortanaInAAD This setting specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow.
AllowIndexingEncryptedStoresOrItems Allow or disallow the indexing of items.
AllowSearchToUseLocation Specify whether search can use location information.
AllowUsingDiacritics Allow the use of diacritics.
AllowWindowsIndexer The indexer provides fast file, email, and web history search for apps and system components including Cortana, Outlook, file explorer, and Edge. To provide these features, it requires access to the file system and app data stores such as Outlook OST files.

- Off setting disables Windows indexer
- EnterpriseSecure setting stops the indexer from indexing encrypted files or stores, and is recommended for enterprises using Windows Information Protection (WIP)
- Enterprise setting reduces potential network loads for enterprises
- Standard setting is appropriate for consumers
AlwaysUseAutoLangDetection Specify whether to always use automatic language detection when indexing content and properties.
DoNotUseWebResults Specify whether to allow Search to perform queries on the web.
DisableBackoff If enabled, the search indexer backoff feature will be disabled.
DisableRemovableDriveIndexing Configure whether locations on removable drives can be added to libraries.
PreventIndexingLowDiskSpaceMB Prevent indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location.
PreventRemoteQueries If enabled, clients will be unable to query this device's index remotely.
SafeSearchPermissions Specify the level of safe search (filtering adult content) required.

Security

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowAddProvisioningPackage Specify whether to allow installation of provisioning packages.
AllowManualRootCertificateInstallation Specify whether the user is allowed to manually install root and intermediate CA certificates.
AllowRemoveProvisioningPackage Specify whether removal of provisioning packages is allowed.
AntiTheftMode Allow or disallow Anti Theft Mode on the device.
RequireDeviceEncryption Specify whether encryption is required.
RequireProvisioningPackageSignature Specify whether provisioning packages must have a certificate signed by a device-trusted authority.
RequireRetrieveHealthCertificateOnBoot Specify whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service when a device boots or reboots.

Settings

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowAutoPlay Allow the user to change AutoPlay settings.
AllowDataSense Allow the user to change Data Sense settings.
AllowVPN Allow the user to change VPN settings.
ConfigureTaskbarCalendar Configure the default setting for showing other calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout.
PageVisiblityList Allows IT admins to prevent specific pages in the System Settings app from being visible or accessible. Pages are identified by a shortened version of their already published URIs, which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:foo", the page identifier used in the policy will be just "foo". Multiple page identifiers are separated by semicolons.

Start

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowPinnedFolderDocuments Control the visibility of the Documents shortcut on the Start menu.
AllowPinnedFolderDownloads Control the visibility of the Downloads shortcut on the Start menu.
AllowPinnedFolderFileExplorer Control the visibility of the File Explorer shortcut on the Start menu.
AllowPinnedFolderHomeGroup Control the visibility of the Home Group shortcut on the Start menu.
AllowPinnedFolderMusic Control the visibility of the Music shortcut on the Start menu.
AllowPinnedFolderNetwork Control the visibility of the Network shortcut on the Start menu.
AllowPinnedFolderPersonalFolder Control the visibility of the Personal Folder shortcut on the Start menu.
AllowPinnedFolderPictures Control the visibility of the Pictures shortcut on the Start menu.
AllowPinnedFolderSettings Control the visibility of the Settings shortcut on the Start menu.
AllowPinnedFolderVideos Control the visibility of the Videos shortcut on the Start menu.
DisableContextMenus Prevent context menus from being invoked in the Start menu.
ForceStartSize Force the size of the Start screen.
HideAppList Collapse or remove the all apps list.
HideChangeAccountSettings Hide Change account settings from appearing in the user tile.
HideFrequentlyUsedApps Hide Most used section of Start.
HideHibernate Prevent Hibernate option from appearing in the Power button.
HideLock Prevent Lock from appearing in the user tile.
HidePeopleBar Remove the people icon from the taskbar, and the corresponding settings toggle. It also prevents users from pinning people to the taskbar.
HidePowerButton Hide the Power button.
HideRecentJumplists Hide jumplists of recently opened items.
HideRecentlyAddedApps Hide Recently added section of Start.
HideRestart Prevent Restart and Update and restart from appearing in the Power button.
HideShutDown Prevent Shut down and Update and shut down from appearing in the Power button.
HideSignOut Prevent Sign out from appearing in the user tile.
HideSleep Prevent Sleep from appearing in the Power button.
HideSwitchAccount Prevent Switch account from appearing in the user tile.
HideUserTile Hide the user tile.
ImportEdgeAssets Import Edge assets for secondary tiles. For more information, see Add image for secondary Microsoft Edge tiles.
NoPinningToTaskbar Prevent users from pinning and unpinning apps on the taskbar.
StartLayout Apply a custom Start layout. For more information, see Customize Windows 10 Start and taskbar with provisioning packages

System

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowBuildPreview Specify whether users can access the Insider build controls in the Advanced Options for Windows Update.
AllowEmbeddedMode Specify whether to set general purpose device to be in embedded mode.
AllowExperimentation Determine the level that Microsoft can experiment with the product to study user preferences or device behavior.
AllowLocation Specify whether to allow app access to the Location service.
AllowStorageCard Specify whether the user is allowed to use the storage card for device storage.
AllowTelemetry Allow the device to send diagnostic and usage data.
AllowUserToResetPhone Allow the user to factory reset the phone.
ConfigureTelemetryOptInChangeNotification This policy setting determines whether a device shows notifications about telemetry levels to people on first sign-in or when changes occur in Settings.
ConfigureTelemetryOptInSettingsUx This policy setting determines whether people can change their own telemetry levels in Settings
DisableDeviceDelete Specify whether the delete diagnostic data is enabled in the Diagnostic & Feedback Settings page.
DisableDataDiagnosticViewer Configure whether users can enable and launch the Diagnostic Data Viewer from the Diagnostic & Feedback Settings page.
DisableOneDriveFileSync Prevent apps and features from working with files on OneDrive.
LimitEnhancedDiagnosticDataWindowsAnalytics This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must enable this policy setting, and set Allow Telemetry to level 2 (Enhanced). When you configure these policy settings, a basic level of diagnostic data plus other events that are required for Windows Analytics are sent to Microsoft. Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus other enhanced level diagnostic data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. If you disable or don't configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy.

TextInput

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowIMELogging Allow the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input.
AllowIMENetworkAccess Allow the user to turn on Open Extended Dictionary, Internet search integration, or cloud candidate features to provide input suggestions that don't exist in the device's local dictionary.
AllowInputPanel Disable the touch/handwriting keyboard.
AllowJapaneseIMESurrogatePairCharacters Allow the Japanese IME surrogate pair characters.
AllowJapaneseIVSCharacters Allow Japanese Ideographic Variation Sequence (IVS) characters.
AllJapaneseNonPublishingStandardGlyph All the Japanese non-publishing standard glyph.
AllowJapaneseUserDictionary Allow the Japanese user dictionary.
AllowKeyboardTextSuggestions Specify whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool.
AllowLanguageFeaturesUninstall All language features to be uninstalled.
AllowUserInputsFromMiracastRecevier Don't use. Instead, use WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver
ExcludeJapaneseIMEExceptISO208 Allow users to restrict character code range of conversion by setting the character filter.
ExcludeJapaneseIMEExceptISO208andEUDC Allow users to restrict character code range of conversion by setting the character filter.
ExcludeJapaneseIMEExceptShiftJIS Allow users to restrict character code range of conversion by setting the character filter.

TimeLanguageSettings

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowSet24HourClock Configure the default clock setting to be the 24 hour format.

Update

Setting Description Windows client Surface Hub HoloLens IoT Core
ActiveHoursEnd Use with Update/ActiveHoursStart to manage the range of active hours where update reboots aren't scheduled.
ActiveHoursMaxRange Specify the maximum active hours range.
ActiveHoursStart Use with Update/ActiveHoursEnd to manage the range of active hours where update reboots aren't scheduled.
AllowAutoUpdate Configure automatic update behavior to scan, download, and install updates.
AllowAutoWindowsUpdateDownloadOverMeteredNetwork Option to download updates automatically over metered connections (off by default). Enter 0 for not allowed, or 1 for allowed.
AllowMUUpdateService Manage whether to scan for app updates from Microsoft Update.
AllowNonMicrosoftSignedUpdate Manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location.
AllowUpdateService Specify whether the device can use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store.
AutoRestartDeadlinePeriodInDays Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending.
AutoRestartDeadlinePeriodInDaysForFeatureUpdates Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending.
AutoRestartNotificationSchedule Specify the period for auto-restart reminder notifications.
AutoRestartRequiredNotificationDismissal Specify the method by which the auto-restart required notification is dismissed.
BranchReadinessLevel Select which branch a device receives their updates from.
DeferFeatureUpdatesPeriodInDays Defer Feature Updates for the specified number of days.
DeferQualityUpdatesPeriodInDays Defer Quality Updates for the specified number of days.
DeferUpdatePeriod Specify update delays for up to 4 weeks.
DeferUpgradePeriod Specify upgrade delays for up to 8 months.
DetectionFrequency Specify the frequency to scan for updates, from every 1-22 hours.
DisableDualScan Don't allow update deferral policies to cause scans against Windows Update.
EngagedRestartDeadline Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours.
EngagedRestartDeadlineForFeatureUpdates Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours.
EngagedRestartSnoozeSchedule Specify the number of days a user can snooze Engaged restart reminder notifications.
EngagedRestartSnoozeScheduleForFeatureUpdates Specify the number of days a user can snooze Engaged restart reminder notifications.
EngagedRestartTransitionSchedule Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule.
EngagedRestartTransitionScheduleForFeatureUpdates Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule.
ExcludeWUDriversInQualityUpdate Exclude Windows Update (WU) drivers during quality updates.
FillEmptyContentUrls Allow Windows Update Agent to determine the download URL when it's missing from the metadata.
ManagePreviewBuilds Use to enable or disable preview builds.
PhoneUpdateRestrictions Deprecated
RequireDeferUpgrade Configure device to receive updates from Current Branch for Business (CBB).
ScheduledInstallDay Schedule the day for update installation.
ScheduledInstallEveryWeek To schedule update installation every week, set the value as 1.
ScheduledInstallFirstWeek To schedule update installation the first week of the month, see the value as 1.
ScheduledInstallFourthWeek To schedule update installation the fourth week of the month, see the value as 1.
ScheduledInstallSecondWeek To schedule update installation the second week of the month, see the value as 1.
ScheduledInstallThirdWeek To schedule update installation the third week of the month, see the value as 1.
ScheduledInstallTime Schedule the time for update installation.
ScheduleImminentRestartWarning Specify the period for auto-restart imminent warning notifications.
ScheduleRestartWarning Specify the period for auto-restart warning reminder notifications.
SetAutoRestartNotificationDisable Disable auto-restart notifications for update installations.
SetDisablePauseUXAccess Disable access to scan Windows Update.
SetDisableUXWUAccess Disable the Pause updates feature.
SetEDURestart Skip the check for battery level to ensure that the reboot will happen at ScheduledInstallTime.
UpdateNotificationLevel Specify whether to enable or disable Windows Update notifications, including restart warnings.
UpdateServiceUrl Configure the device to check for updates from a WSUS server instead of Microsoft Update.
UpdateServiceUrlAlternate Specify an alternate intranet server to host updates from Microsoft Update.

WiFi

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowAutoConnectToWiFiSenseHotspots Allow the device to connect automatically to Wi-Fi hotspots.
AllowInternetSharing Allow Internet sharing.
AllowManualWiFiConfiguration Allow connecting to Wi-Fi outside of MDM server-installed networks.
AllowWiFi Allow Wi-Fi connections.
WLANScanMode Configure the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected.

WindowsInkWorkspace

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowSuggestedAppsInWindowsInkWorkspace Show recommended app suggestions in the ink workspace.
AllowWindowsInkWorkspace Specify whether to allow the user to access the ink workspace.

WindowsLogon

Setting Description Windows client Surface Hub HoloLens IoT Core
HideFastUserSwitching Hide the Switch account button on the sign-in screen, Start, and the Task Manager.

WirelessDisplay

Setting Description Windows client Surface Hub HoloLens IoT Core
AllowUserInputFromWirelessDisplayReceiver This policy controls whether or not the wireless display can send input (keyboard, mouse, pen, and touch, dependent upon display support) back to the source device. For example, a Surface Laptop is projecting wirelessly to a Surface Hub. If input from the wireless display receiver is allowed, users can draw with a pen on the Surface Hub.