Disable HTTP fallback for SIP connection

ComputerNeeds changes for IntuneL_PolicyDisableHttpConnect

Supported on SUPPORTED_Windows7 (defined in the Windows templates)

5568.1000

What it does

Prevents from HTTP being used for SIP connection in case TLS or TCP fail.

What it writes

Hive: HKEY_LOCAL_MACHINE
Registry key: software\policies\microsoft\office\16.0\lync
Value name: disablehttpconnect
When enabled: DWORD 1
When disabled: DWORD 0

Why it needs changes for Intune

Policy references a Windows supportedOn definition.
ADMX-INTUNE-WINDOWS-SUPPORTEDON-REFERENCE

Security baselines

Microsoft's Microsoft 365 Apps for Enterprise 2512 sets this to Enabled, in its GPO “MSFT Microsoft 365 Apps v2512 - Computer”.

Policy value disablehttpconnect: Sets disablehttpconnect to 1 (REG_DWORD).

Read from the registry.pol files in the baselines' GPO backups, downloaded from Microsoft's Security Compliance Toolkit. All baselines

Configure and deploy

Choose a state; the output below is generated from the template for exactly that.

Enabled · Computer · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\software\policies\microsoft\office\16.0\lync]
"disablehttpconnect"=dword:00000001

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Disable HTTP fallback for SIP connection
# Name: L_PolicyDisableHttpConnect
# Scope: Machine
# State: Enabled
# Source: lync16.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\software\policies\microsoft\office\16.0\lync' -Name 'disablehttpconnect' -PropertyType 'DWord' -Value 1

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.

ADMX profile candidate (OMA-URI)

./Device/Vendor/MSFT/Policy/Config/ADMX_lync16/L_PolicyDisableHttpConnect

ADMX SyncML candidate

<SyncML xmlns="SYNCML:SYNCML1.2">
  <SyncBody>
    <Replace>
      <CmdID>1</CmdID>
      <Item>
        <Meta>
          <Format>chr</Format>
          <Type>text/plain</Type>
        </Meta>
        <Target>
          <LocURI>./Device/Vendor/MSFT/Policy/Config/ADMX_lync16/L_PolicyDisableHttpConnect</LocURI>
        </Target>
        <Data>&lt;enabled/&gt;</Data>
      </Item>
    </Replace>
    <Final/>
  </SyncBody>
</SyncML>

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Disable HTTP fallback for SIP connection
# Name: L_PolicyDisableHttpConnect
# Scope: Machine
# State: Enabled
# Source: lync16.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\software\policies\microsoft\office\16.0\lync' -Name 'disablehttpconnect' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\software\policies\microsoft\office\16.0\lync\disablehttpconnect') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Disable HTTP fallback for SIP connection
# Name: L_PolicyDisableHttpConnect
# Scope: Machine
# State: Enabled
# Source: lync16.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\software\policies\microsoft\office\16.0\lync' -Name 'disablehttpconnect' -PropertyType 'DWord' -Value 1

History 1 retained release

5568.100010 Aug 2026
- Already present in the first release ChangeIntel keeps.

Template

Internal name: L_PolicyDisableHttpConnect
Namespace: lync16.Office.Microsoft.Policies.Windows
Template file: lync16.admx
Release: Microsoft 365 Apps 5568.1000 · file set 8be05d876aae137d…

Definition, editor controls and support

Definition

<policy Area="Security Baseline" AreaCategory="Auth and Encryption" class="Machine" displayName="$(string.L_PolicyDisableHttpConnect)" explainText="$(string.L_ExplainText_DisableHttpConnect)" key="software\policies\microsoft\office\16.0\lync" name="L_PolicyDisableHttpConnect" presentation="$(presentation.L_PolicyDisableHttpConnect)" valueName="disablehttpconnect" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="lync16.Office.Microsoft.Policies.Windows:L_LyncConfiguration" />
      <supportedOn ref="Microsoft.Policies.Windows:SUPPORTED_Windows7" />
      <enabledValue>
        <decimal value="1" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>

Editor controls

<presentation id="L_PolicyDisableHttpConnect" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />

Supported platforms and category

lync16.Office.Microsoft.Policies.Windows:category:L_Lync
<category displayName="$(string.L_Lync)" name="L_Lync" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
lync16.Office.Microsoft.Policies.Windows:category:L_LyncConfiguration
<category displayName="$(string.L_LyncConfiguration)" name="L_LyncConfiguration" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="lync16.Office.Microsoft.Policies.Windows:L_Lync" />
    </category>
lync16.Office.Microsoft.Policies.Windows:unresolved:Microsoft.Policies.Windows:SUPPORTED_Windows7
<unresolved reference="Microsoft.Policies.Windows:SUPPORTED_Windows7" />
lync16.Office.Microsoft.Policies.Windows:category:L_Lync
<category displayName="$(string.L_Lync)" name="L_Lync" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="lync16.Office.Microsoft.Policies.Windows:L_Lync">Skype for Business 2016</string></strings>
lync16.Office.Microsoft.Policies.Windows:category:L_LyncConfiguration
<category displayName="$(string.L_LyncConfiguration)" name="L_LyncConfiguration" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="lync16.Office.Microsoft.Policies.Windows:L_Lync" />
    </category>
<strings><string id="lync16.Office.Microsoft.Policies.Windows:L_LyncConfiguration">Microsoft Lync Feature Policies</string></strings>