Windows 10 22H2 · 1.0

[removed: This policy setting allows you to][added: If you enable this setting, the Start Menu will either collapse or] remove the [removed: All Programs][added: all apps] list from the Start menu. [removed: If you enable this policy setting,][added: Selecting "Collapse" will not display the app list next to] the [added: pinned tiles in Start. An ]"All [removed: Programs" item][added: apps" button will be displayed on Start to open the all apps list. This] is [removed: removed from][added: equivalent to setting] the [removed: simple Start menu. The Start Screen][added: "Show app list in Start" in Settings to Off. Selecting "Collapse and disable setting"] will [removed: show][added: do the same as the collapse option and disable] the [removed: All Apps view, but][added: "Show app list in Start menu" in Settings, so users cannot turn] it [added: to On. Selecting "Remove and disable setting" ]will [removed: only contain items that are pinned][added: remove the all apps list from Start and disable the "Show app list in Start menu" in Settings, so users cannot turn it] to [removed: start.][added: On. Select this option for compatibility with earlier versions of Windows.] If you disable or do not configure this [removed: policy ]setting, the [removed: "All Programs" item remains on][added: all apps list will be visible by default, and] the [removed: simple Start menu.][added: user can change "Show app list in Start" in Settings.]

This policy setting enables system administrators to change the graphics rendering for all Remote Desktop Services sessions. If you enable this policy setting, all Remote Desktop Services sessions use the hardware graphics renderer instead of the Microsoft Basic Render Driver as the default adapter. If you disable this policy setting, all Remote Desktop Services sessions use the Microsoft Basic Render Driver as the default adapter. If you do not configure this policy setting, Remote Desktop Services sessions on the RD Session Host server use the Microsoft Basic Render Driver as the default adapter. In all other cases, Remote Desktop Services sessions use the hardware graphics renderer by default. NOTE: The policy setting [removed: affects only the default ][added: enables load-balancing of ]graphics processing unit[added: s] (GPU) on a computer with more than one GPU installed.[removed: All additional GPUs are considered secondary adapters and used as hardware renderers.] The GPU configuration of the local session is not affected by this policy setting.

Specifies the authentication method that clients must use when attempting to connect to an RD Session Host server through an RD Gateway server. You can enforce this policy setting or you can allow users to overwrite this policy setting. By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these RD Gateway server settings" option on the client. To allow users to overwrite this policy setting, select the "Allow users to change this setting" check box. When you do this, users can specify an alternate authentication method by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify an alternate authentication method, the authentication method that you specify in this policy setting is used by default. If you disable or do not configure this policy setting, the authentication method that is specified by the user is used, if one is specified. If an authentication method is not specified, the [removed: NTLM][added: Negotiate] protocol that is enabled on the client or a smart card can be used for authentication.

[added: ]This policy setting allows you to specify the type of Remote Desktop Services client access license (RDS CAL) that is required to connect to this RD Session Host server.[removed: ][added: ]You can use this policy setting to select one of [removed: two][added: three] licensing modes: Per User [removed: or][added: , Per Device and AAD] Per [removed: Device. ][added: User . ]Per User licensing mode requires that each user account connecting to this RD Session Host server have an RDS Per User [removed: CAL. ][added: CAL issued from an RD Licensing server. ]Per Device licensing mode requires that each device connecting to this RD Session Host server have an RDS Per Device [removed: CAL. ][added: CAL issued from an RD Licensing server. AAD Per User licensing mode requires that each user account connecting to this RD Session Host server have a service plan that supports RDS licenses assigned in AAD. ]If you enable this policy setting, the Remote Desktop licensing mode that you specify is honored by the Remote Desktop license [removed: server. ][added: server and RD Session Host. ]If you disable or do not configure this policy setting, the licensing mode is not specified at the Group Policy level.[removed: ][added: ]

This policy setting lets you enable H.264/AVC hardware encoding support for Remote Desktop Connections. When you enable hardware encoding, if an error occurs, we will attempt to use software encoding. If you disable or do not configure this policy, we will always use software encoding.[removed: If you set the encoding option to “Always Attempt”, Remote Desktop will always try to use H.264/AVC hardware encoding when available, be aware that, for Windows Server running Hyper-V with RemoteFX vGPU enabled, the policy has to be set on the Hyper-V host machine. If you set the encoding option to “Attempt only for RemoteFX vGPU virtual machines” be aware that, for Windows Server running Hyper-V with RemoteFX vGPU enabled, the policy has to be set on the Hyper-V host machine. If you set the encoding option to “Attempt only for non-RemoteFX vGPU scenarios”, Remote Desktop attempts to use hardware encoding for all scenarios except RemoteFX vGPU. ]

This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for Trusted Platform Module (TPM) commands requiring authorization.[removed: ][added: ]If the number of TPM commands with an authorization failure within the duration equals a threshold, a standard user is prevented from sending commands requiring authorization to the TPM.[removed: ][added: ]This setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM.[removed: ][added: ]An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred.[removed: ][added: ]Authorization failures older than this duration are ignored. For each standard user two thresholds apply.[removed: ][added: ]Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization.[removed: ][added: ]The Standard User Lockout Threshold Individual value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM.[removed: ][added: ]The Standard User Lockout Total Threshold value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM.[removed: ][added: ]The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value.[removed: ][added: ]When the TPM enters a lockout mode it is global for all users including administrators and Windows features like BitLocker Drive Encryption.[removed: ][added: ]The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer.[removed: ][added: ]Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures.[removed: ][added: ]Some TPMs may require a system restart to exit the lockout mode.[removed: ][added: ]Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode. An administrator with the TPM owner password may fully reset the TPM's hardware lockout logic using the TPM Management Console (tpm.msc).[removed: ][added: ]Each time an administrator resets the TPM's hardware lockout logic all prior standard user TPM authorization failures are ignored; allowing standard users to use the TPM normally again immediately. If this value is not configured, a default value of 480 minutes (8 hours) is used.[removed: ]

This policy setting allows you to enable or disable User Experience Virtualization (UE-V) feature. Reboot is needed for enable to take effect.[added: With Auto-register inbox templates enabled, the UE-V inbox templates such as Office 2016 will be automatically registered when the UE-V Service is enabled. If this option is changed, it will only take effect when UE-V service is re-enabled.]

[added: ]This policy setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits.[removed: ][added: ]If you enable this policy setting, you can require a minimum number of digits to be used when setting the startup PIN.[removed: ][added: ]If you disable or do not configure this policy setting, users can configure a startup PIN of any length between [removed: 4][added: 6] and 20 digits.[added: NOTE: If minimum PIN length is set below 6 digits, Windows will attempt to update the TPM 2.0 lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset.]

[added: ]This policy setting [removed: prevents computers from establishing][added: determines if a computer can have] multiple [removed: simultaneous ]connections to [removed: either ]the [removed: I][added: i]nternet or to a Windows domain. [removed: By default, when this policy setting value is Not Configured, it is enabled. ][added: If multiple connections are allowed, it then determines how network traffic will be routed. ]If this policy setting is [removed: enabled, when the][added: set to 0, a] computer [removed: has at least one active connection ][added: can have simultaneous connections ]to the [removed: Internet,][added: internet, to] a [removed: new automatic connection attempt ][added: Windows domain, or ]to [removed: the][added: both.] Internet [removed: is blocked. When the computer has at least one active][added: traffic can be routed over any connection - including a cellular] connection [removed: to a Windows domain, a new automatic connection to the same Windows domain is also blocked. Additional manual connection attempts by users to the Internet or][added: and any metered network. This was previously the Disabled state for this policy setting. This option was first available in Windows 8. If this policy setting is set] to [removed: a Windows domain are not][added: 1, any new automatic internet connection is] blocked [removed: by this policy setting. In circumstances where there are multiple simultaneous connections ][added: when the computer has at least one active internet connection ]to [removed: either the Internet or to a Windows domain, Windows disconnects the less][added: a preferred type of network. Here's the order of preference (from most] preferred [removed: connection when the amount of network traffic over the less][added: to least preferred): Ethernet, WLAN, then cellular. Ethernet is always] preferred [removed: connection drops below a certain threshold. For example, when a computer is connected to Internet using a WLAN connection and the user plugs][added: when connected. Users can still manually connect to any network. This was previously the Enabled state for this policy setting. This option was first available] in [removed: to an Ethernet network, network traffic is routed through][added: Windows 8. If this policy setting is set to 2,] the [removed: faster Ethernet connection, and the WLAN traffic diminishes. Windows detects this circumstance and responds by disconnecting the WLAN connection. If this policy setting is disabled, multiple simultaneous connections to the Internet,][added: behavior is similar to 1. However, if a cellular data connection is available, it will always stay connected for services that require a cellular connection. When the user is connected] to a [removed: Windows domain, ][added: WLAN ]or [removed: to both are allowed. If this policy setting value is Not Configured, the default policy setting is enabled. This is different than enabling the][added: Ethernet connection, no internet traffic will be routed over the cellular connection. This option was first available in Windows 10 (Version 1703). If this] policy setting [removed: with Group Policy, however - when the policy setting is Not Configured, the policy setting is configurable on the local computer. When the policy setting is applied with Group Policy, it is not configurable locally. With the][added: is set to 3, the behavior is similar to 2. However, if there's an Ethernet connection, Windows won't allow users to connect to a WLAN manually. A WLAN can only be connected (automatically or manually) when there's no Ethernet connection. This] policy setting [removed: value of Not Configured, new automatic connection attempts are not made, and less preferred connections are disconnected.][added: is related to the "Enable Windows to soft-disconnect a computer from a network" policy setting.]

This policy setting allows you to manage whether a check for new virus and spyware [removed: definitions][added: security intelligence] will occur before running a scan. This setting applies to scheduled scans as well as the command line "mpcmdrun -SigUpdate", but it has no effect on scans initiated manually from the user interface. If you enable this setting, a check for new [removed: definitions][added: security intelligence] will occur before running a scan. If you disable this setting or do not configure this setting, the scan will start using the existing [removed: definitions.][added: security intelligence.]