Windows 10 22H2 · 1.0

This policy setting allows you to control whether or not Search can perform queries on the web, [removed: and ]if [removed: the ]web results are displayed in [removed: Search. ][added: Search, and if search highlights are shown in the search box and in search home. ]If you enable this policy setting, queries won't be performed on the web[removed: and][added: ,] web results won't be displayed when a user performs a query in [removed: Search.][added: Search, and search highlights will not be shown in the search box and in search home.] If you disable this policy setting, queries will be performed on the web[removed: and][added: ,] web results will be displayed when a user performs a query in [removed: Search.][added: Search, and search highlights will be shown in the search box and in search home.] If you don't configure this policy setting, a user can choose whether or not Search can perform queries on the web, and if the web results are displayed in [removed: Search.][added: Search, and if search highlights are shown in the search box and in search home.]

This policy setting determines whether users can [removed: access the Insider build controls in the Advanced Options for Windows Update. These ][added: get preview builds of Windows, by configuring ]controls [removed: are located under "Get Insider builds," ][added: in Settings > Update ]and [removed: enable users to make their devices available for downloading and installing ][added: security > ]Windows [removed: preview software.][added: Insider Program.] If you enable or do not configure this policy setting, users can download and install [added: preview builds of ]Windows [removed: preview software on their devices.][added: by configuring Windows Insider Program settings.] If you disable this policy setting, [removed: the item "Get Insider builds" ][added: Windows Insider Program settings ]will be [removed: unavailable. Note: ][added: unavailable to users through the Settings app. ]This policy [removed: setting applies only][added: is only supported up] to [removed: devices running the Pro, Enterprise, Education or Server editions of][added: Windows 10, Version 1703. Please use 'Manage preview builds' under 'Windows Update for Business' for newer] Windows [removed: 10. ][added: 10 versions.]

This policy setting specifies whether Windows apps can [removed: sync][added: communicate] with [added: unpaired wireless ]devices. You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can [removed: sync][added: communicate] with [added: unpaired wireless ]devices by using Settings > Privacy on the device. If you choose the "Force Allow" option, Windows apps are allowed to [removed: sync][added: communicate] with [added: unpaired wireless ]devices and employees in your organization cannot change it. If you choose the "Force Deny" option, Windows apps are not allowed to [removed: sync][added: communicate] with [added: unpaired wireless ]devices and employees in your organization cannot change it. If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can [removed: sync][added: communicate] with[added: unpaired wireless] devices by using Settings > Privacy on the device. If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.

This policy setting controls whether [added: Universal ]Windows [removed: Store ]apps with Windows Runtime API access directly from web content can be launched. If you enable this policy setting, [added: Universal ]Windows [removed: Store apps with][added: apps which declare] Windows Runtime API access [removed: directly from web content][added: in ApplicationContentUriRules section of the manifest] cannot be launched; [added: Universal ]Windows [removed: Store apps without][added: apps which have not declared] Windows Runtime API access [removed: from web content][added: in the manifest] are not affected. If you disable or do not configure this policy setting, all [added: Universal ]Windows [removed: Store ]apps can be launched.[added: This policy should not be enabled unless recommended by Microsoft as a security response because it can cause severe app compatibility issues.]

This policy setting determines whether enhanced anti-spoofing is [removed: configured][added: required] for [removed: devices which support it.][added: Windows Hello face authentication.] If you [removed: do not configure ][added: enable ]this [removed: policy ]setting, [removed: users will be able to choose whether or not ][added: Windows requires all users on managed devices ]to use enhanced anti-spoofing [removed: on supported devices. If you enable this policy setting, ][added: for Windows Hello face authentication. This disables ]Windows [removed: will require all users ][added: Hello face authentication ]on [removed: the device to use anti-spoofing for facial features, on devices which support it. If you disable this policy setting, ][added: devices that do not support enhanced anti-spoofing. If you disable or don't configure this setting, Windows doesn't require ]enhanced anti-spoofing [removed: is turned off for all users on the device and they will be unable to turn it on.][added: for Windows Hello face authentication. Note that enhanced anti-spoofing for Windows Hello face authentication is not required on unmanaged devices.]

This policy setting allows you to require a pin for pairing. If you [removed: turn][added: set this to 'Never', a pin isn't required for pairing. If you set] this [removed: on,][added: to 'First Time',] the pairing ceremony for new devices will always require a [removed: pin. ][added: PIN. ]If you [removed: turn it off or don't configure it, a pin isn't required for pairing.][added: set this to 'Always', all pairings will require PIN.]

This policy setting allows you to control whether a domain user can sign in using a convenience PIN.[removed: In Windows 10, convenience PIN was replaced with Windows Hello PIN, which has stronger security properties. To configure Windows Hello for Business, use the policies under Computer configuration\Administrative Templates\Windows Components\Windows Hello for Business.] If you enable this policy setting, a domain user can set up and sign in with a convenience PIN.[removed: ][added: ]If you disable or don't configure this policy setting, a domain user can't set up and use a convenience PIN. Note[removed: that t][added: : T]he user's domain password will be cached in the system vault when using this feature.[added: To configure Windows Hello for Business, use the Administrative Template policies under Windows Hello for Business.]

When running in Restricted [removed: Administration mode ][added: Admin ]or [removed: if the device is using ]Remote Credential Guard[added: mode], participating apps do not expose [removed: credentials to remote devices (regardless of the delegation method).][added: signed in or supplied credentials to a remote host.] Restricted [removed: Administration mode may limit ][added: Admin limits ]access to resources located on other servers or networks [removed: beyond][added: from] the [removed: target computer][added: remote host] because credentials are not delegated. Remote Credential Guard does not limit access to resources [removed: by redirecting][added: because it redirects] all requests back to the client device. Participating apps: Remote Desktop Client If you enable this policy setting, [added: the following options are supported:   Restrict credential delegation: Participating applications must use ]Restricted [removed: Administration mode or][added: Admin or Remote Credential Guard to connect to remote hosts.   Require Remote Credential Guard: Participating applications must use] Remote Credential Guard [removed: is enforced and participating apps will not delegate credentials][added: to connect to remote hosts.   Require Restricted Admin: Participating applications must use Restricted Admin to connect] to remote [removed: devices.][added: hosts.] If you disable or do not configure this policy setting, Restricted [removed: Administration mode ][added: Admin ]and Remote Credential Guard[added: mode] are not enforced and participating apps can delegate credentials to remote devices. Note: To disable most credential delegation, it may be sufficient to deny delegation in Credential Security Support Provider (CredSSP) by modifying Administrative template settings (located at Computer Configuration\Administrative Templates\System\Credentials Delegation). Note: On Windows 8.1 and Windows Server 2012 R2, enabling this policy will enforce Restricted Administration mode, regardless of the mode chosen. These versions do not support Remote Credential Guard.

[removed: This policy][added: By configuring this] setting [removed: determines the amount of diagnostic and usage data reported][added: in Windows 10, end users will not be able] to [removed: Microsoft. A value][added: opt into a higher level] of [removed: 0 will send minimal data to Microsoft. This data includes Malicious Software Removal Tool (MSRT) &][added: telemetry collection than the level you have set for your organization. This limitation applies only to the] Windows [removed: Defender data, if enabled, and telemetry client settings. Setting a value of 0 applies to enterprise, EDU, IoT and server devices only. Setting a value of][added: operating system and apps included with Windows, and does not apply to third-party apps running on Windows 10. Diagnostic data is categorized into four levels, as follows: -] 0 [removed: for other devices is equivalent ][added: (Security). Information that's required ]to [removed: choosing a value of 1. A value of 1 sends only a basic amount of diagnostic][added: help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences] and [removed: usage data. Note that setting values of 0 or][added: Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender. -] 1 [removed: will degrade certain experiences on][added: (Required). Basic device info, including: quality-related data, app compatibility, and data from] the [removed: device. A value of 2 sends enhanced diagnostic][added: Security level. - 2 (Enhanced). Additional insights, including: how Windows, Windows Server, System Center,] and [removed: usage data. A value of 3 sends the same][added: apps are used, how they perform, advanced reliability data, and] data [removed: as a value of 2, plus additional diagnostics data, including the files][added: from both the Required and the Security levels. - 3 (Optional). All data necessary to identify] and [removed: content that may have caused][added: help to fix problems, plus data from] the [removed: problem. Windows 10 telemetry settings applies][added: Security, Required, and Enhanced levels. Options available] to [added: users in ]the [removed: Windows operating system][added: Settings app are changed by configuring this setting,] and [removed: some first party apps. This setting does not apply to third party apps running on Windows 10. If you disable or do not configure this policy setting,][added: even if not set, may be impacted by other group policy settings. Note that if this policy is configured to allow a telemetry setting of Security or Basic, end] users [removed: can configure the Telemetry level in Settings. ][added: will be unable to select a higher level. ]

This policy setting defines the identifier used to uniquely associate this device’s telemetry data as belonging to a given organization. If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program. If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its telemetry data with your organization.[removed: ][added: ]

With this policy setting, you can forward Connected User Experience and Telemetry requests to a proxy server. If you enable this policy setting, you can specify the FQDN or IP address of the destination device within your organization[removed: ’][added: ']s network (and optionally a port number, if desired). The connection will be made over a Secure Sockets Layer (SSL) connection. If the named proxy fails, or if you disable or do not configure this policy setting, Connected User Experience and Telemetry data will be sent to Microsoft using the default proxy configuration. The format for this setting is <server>:<port>[removed: ][added: ]

Specifies the maximum size in GB of Delivery Optimization cache.[removed: ][added: ]This policy overrides the DOMaxCacheSize policy.[removed: ][added: ]The value 0 (zero) means [removed: “unlimited”][added: "unlimited"] cache; Delivery Optimization will clear the cache when the device runs low on disk space.

Specifies the download method that Delivery Optimization can use in downloads of Windows Updates, Apps and App updates.[removed: ][added: ]The following list shows the supported values:[removed: 0=HTTP][added: 0 = HTTP] only, no peering.[removed: 1=HTTP][added: 1 = HTTP] blended with peering behind the same NAT.[removed: 2=HTTP][added: 2 = HTTP] blended with peering across a private group. Peering occurs on devices in the same Active Directory Site (if exist) or the same domain by default. When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2.[removed: 3=HTTP][added: 3 = HTTP] blended with Internet Peering.[removed: 99=Simple][added: 99 = Simple] download mode with no peering. Delivery Optimization downloads using HTTP only and does not attempt to contact the Delivery Optimization cloud services.[removed: 100=Bypass][added: 100 = Bypass] mode. Do not use Delivery Optimization and use BITS instead.

Group ID must be set as a GUID. This Policy specifies an arbitrary group ID that the device belongs to.[removed: ][added: ]Use this if you need to create a single group for Local Network Peering for branches that are on different domains or are not on the same LAN.[removed: ][added: ]Note: this is a best effort optimization and should not be relied on for an authentication of identity.

Specifies the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully.[removed: ][added: ]The value 0 (zero) means [removed: “unlimited”;][added: "unlimited";] Delivery Optimization will hold the files in the cache longer and make the files available for uploads to other devices, as long as the cache size has not exceeded.

Specifies the minimum download QoS (Quality of Service or speed) for background downloads in KiloBytes/second.[removed: ][added: ]This policy affects the blending of peer and HTTP sources. Delivery Optimization complements the download from HTTP source to achieve the specified minimum QoS value.

Specifies the drive Delivery Optimization shall use for its cache.[removed: ][added: ]By default, %SystemDrive% is used to store the cache. The drive location can be specified using environment variables, drive letter or using a full path.

Specifies the maximum total bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month.[removed: ][added: ]The value 0 (zero) means [removed: “unlimited”;][added: "unlimited";] No monthly upload limit is applied if 0 is set.

This policy setting allows you to configure the number of seconds Windows waits for a device installation task to complete. If you enable this policy setting, Windows waits for the number of seconds you specify before terminating the installation. If you disable or do not configure this policy setting, Windows waits [removed: 300][added: 240] seconds for a device installation task to complete before terminating the installation.

This policy setting specifies a list of device setup class GUIDs describing [removed: device drivers][added: driver packages] that non-administrator members of the built-in Users group may install on the system. If you enable this policy setting, members of the Users group may install new drivers for the specified device setup classes. The drivers must be signed according to Windows Driver Signing Policy, or be signed by publishers already in the TrustedPublisher store. If you disable or do not configure this policy setting, only members of the Administrators group are allowed to install new [removed: device drivers][added: driver packages] on the system.

Determines how the system responds when a user tries to install [removed: device driver][added: driver package] files that are not digitally signed. This setting establishes the least secure response permitted on the systems of users in the group. Users can use System in Control Panel to select a more secure setting, but when this setting is enabled, the system does not implement any setting less secure than the one the setting established. When you enable this setting, use the drop-down box to specify the desired response. -- "Ignore" directs the system to proceed with the installation even if it includes unsigned files. -- "Warn" notifies the user that files are not digitally signed and lets the user decide whether to stop or to proceed with the installation and whether to permit unsigned files to be installed. "Warn" is the default. -- "Block" directs the system to refuse to install unsigned files. As a result, the installation stops, and none of the files in the driver package are installed. To change driver file security without specifying a setting, use System in Control Panel. Right-click My Computer, click Properties, click the Hardware tab, and then click the Driver Signing button.