Windows 10 22H2 · 1.0

A Trusted Platform Module (TPM) provides additional security benefits over software because data [removed: stored within][added: protected by] it cannot be used on other devices. If you enable this policy setting, [added: Windows Hello for Business provisioning ]only [added: occurs on ]devices with [removed: a usable TPM may provision][added: usable 1.2 or 2.0 TPMs. You can optionally exclude security devices, which prevents] Windows Hello for [removed: Business.][added: Business provisioning from using those devices.] If you disable or do not configure this policy setting, the TPM is still preferred, but all devices may provision Windows Hello for Business using software if the TPM is non-functional or unavailable.

Use this policy setting to configure the use of special characters in the PIN. Allowable special characters are: ! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~ . If you enable this policy setting, Windows [removed: Hello for Business requires users ][added: requires the user ]to include at least one special character in their PIN. If you disable [removed: or][added: this policy setting, Windows does not allow the user to include special characters in their PIN. If you] do not configure this policy setting, Windows [removed: Hello for Business ][added: allows, but ]does not [removed: allow users to use ][added: require, ]special characters in the[removed: ir] PIN.

Use this policy setting to configure the use of uppercase letters in the PIN. If you enable this policy setting, Windows [removed: Hello for Business requires users ][added: requires the user ]to include at least one uppercase letter in their PIN. If you disable [removed: or][added: this policy setting, Windows does not allow the user to include uppercase letters in their PIN. If you] do not configure this policy setting, Windows [removed: Hello for Business ][added: allows, but ]does not [removed: allow users to use ][added: require, ]uppercase letters in the[removed: ir] PIN.

Windows Hello for Business is an alternative method for signing into Windows using your Active Directory or Azure Active Directory account that can replace passwords, Smart Cards, and Virtual Smart Cards. If you enable this policy, the device provisions Windows Hello for Business using keys or certificates for all users. If you disable this policy setting, the device does not provision Windows Hello for Business for any user. If you do not configure this policy setting, users can provision Windows Hello for Business as a convenience credential that encrypts their domain password.[removed: ][added: Select "Do not start Windows Hello provisioning after sign-in" when you use a third-party solution to provision Windows Hello for Business. If you select "Do not start Windows Hello provisioning after sign-in", Windows Hello for Business does not automatically start provisioning after the user has signed in. If you do not select "Do not start Windows Hello provisioning after sign-in", Windows Hello for Business automatically starts provisioning after the user has signed in. ]

[added: ]This setting does not apply to desktop apps. Turns off Windows Network Isolation's automatic proxy discovery in the domain corporate environment. If you enable this policy setting, it turns off Windows Network Isolation's automatic proxy discovery in the domain corporate environment. Only proxies configured with Group Policy are authoritative. This applies to both Internet and intranet proxies. If you disable or do not configure this policy setting, Windows Network Isolation attempts to automatically discover your proxy server addresses. For more information see: http://go.microsoft.com/fwlink/p/?LinkId=234043[added: ]

[added: ]This setting does not apply to desktop apps. Turns off Windows Network Isolation's automatic discovery of private network hosts in the domain corporate environment. If you enable this policy setting, it turns off Windows Network Isolation's automatic discovery of private network hosts in the domain corporate environment. Only network hosts within the address ranges configured via Group Policy will be classified as private. If you disable or do not configure this policy setting, Windows Network Isolation attempts to automatically discover your private network hosts in the domain corporate environment. For more information see: http://go.microsoft.com/fwlink/p/?LinkId=234043[added: ]

This setting does not apply to desktop apps. A semicolon-separated list of Internet proxy server IP addresses. These addresses are categorized as Internet by Windows Network Isolation and are accessible to apps that have the Internet Client or Internet Client/Server capabilities. If you enable this policy setting, apps on proxied networks can access the Internet without relying on the Private Network capability. However, in most situations Windows Network Isolation will be able to correctly discover proxies. By default, any proxies configured with this setting are merged with proxies that are auto-discovered. To make this policy configuration the sole list of allowed proxies, enable the "Proxy definitions are authoritative" setting. If you disable or do not configure this policy setting, apps will use the Internet proxies auto-discovered by Windows Network Isolation. Example: [3efe:3022::1000];18.0.0.1;18.0.0.2 For more information see: http://go.microsoft.com/fwlink/p/?LinkId=234043[added: ]

This setting does not apply to desktop apps. A semicolon-separated list of intranet proxy server IP addresses. These addresses are categorized as private by Windows Network Isolation and are accessible to apps that have the Home/Work Networking capability. If you enable this policy setting, it allows an administrator to configure a set of proxies that provide access to intranet resources. If you disable or do not configure this policy setting, Windows Network Isolation attempts to discover proxies and configures them as Internet nodes. This setting should NOT be used to configure Internet proxies. Example: [3efe:3022::1000]; 18.0.0.1; 18.0.0.2 For more information see: http://go.microsoft.com/fwlink/p/?LinkId=234043[added: ]

[added: ]This setting does not apply to desktop apps. A comma-separated list of IP address ranges that are in your corporate network. If you enable this policy setting, it ensures that apps with the Home/Work Networking capability have appropriate access to your corporate network. These addresses are only accessible to apps if and only if the app has declared the Home/Work Networking capability. Windows Network Isolation attempts to automatically discover private network hosts. By default, the addresses configured with this policy setting are merged with the hosts that are declared as private through automatic discovery. To ensure that these addresses are the only addresses ever classified as private, enable the "Subnet definitions are authoritative" policy setting. If you disable or do not configure this policy setting, Windows Network Isolation attempts to automatically discover your private network hosts. Example: 3efe:1092::/96,18.1.1.1/10 For more information see: http://go.microsoft.com/fwlink/p/?LinkId=234043[added: ]