Windows 10 22H2 · 1.0

Allows this computer to receive inbound Remote Desktop requests. To do this, Windows [added: Defender ]Firewall opens TCP port 3389. If you enable this policy setting, Windows [added: Defender ]Firewall opens this port so that this computer can receive Remote Desktop requests. You must specify the IP addresses or subnets from which these incoming messages are allowed. In the Windows [added: Defender ]Firewall component of Control Panel, the "Remote Desktop" check box is selected and administrators cannot clear it. If you disable this policy setting, Windows [added: Defender ]Firewall blocks this port, which prevents this computer from receiving Remote Desktop requests. If an administrator attempts to open this port by adding it to a local port exceptions list, Windows [added: Defender ]Firewall does not open the port. In the Windows [added: Defender ]Firewall component of Control Panel, the "Remote Desktop" check box is cleared and administrators cannot select it. If you do not configure this policy setting, Windows [added: Defender ]Firewall does not open this port. Therefore, the computer cannot receive Remote Desktop requests unless an administrator uses other policy settings to open the port. In the Windows[added: Defender] Firewall component of Control Panel, the "Remote Desktop" check box is cleared. Administrators can change this check box."

Allows this computer to receive inbound Remote Desktop requests. To do this, Windows [added: Defender ]Firewall opens TCP port 3389. If you enable this policy setting, Windows [added: Defender ]Firewall opens this port so that this computer can receive Remote Desktop requests. You must specify the IP addresses or subnets from which these incoming messages are allowed. In the Windows [added: Defender ]Firewall component of Control Panel, the "Remote Desktop" check box is selected and administrators cannot clear it. If you disable this policy setting, Windows [added: Defender ]Firewall blocks this port, which prevents this computer from receiving Remote Desktop requests. If an administrator attempts to open this port by adding it to a local port exceptions list, Windows [added: Defender ]Firewall does not open the port. In the Windows [added: Defender ]Firewall component of Control Panel, the "Remote Desktop" check box is cleared and administrators cannot select it. If you do not configure this policy setting, Windows [added: Defender ]Firewall does not open this port. Therefore, the computer cannot receive Remote Desktop requests unless an administrator uses other policy settings to open the port. In the Windows[added: Defender] Firewall component of Control Panel, the "Remote Desktop" check box is cleared. Administrators can change this check box."

Prevents this computer from receiving unicast responses to its outgoing multicast or broadcast messages. If you enable this policy setting, and this computer sends multicast or broadcast messages to other computers, Windows [added: Defender ]Firewall blocks the unicast responses sent by those other computers. If you disable or do not configure this policy setting, and this computer sends a multicast or broadcast message to other computers, Windows [added: Defender ]Firewall waits as long as three seconds for unicast responses from the other computers and then blocks all later responses. Note: This policy setting has no effect if the unicast message is a response to a Dynamic Host Configuration Protocol (DHCP) broadcast message sent by this computer. Windows[added: Defender] Firewall always permits those DHCP unicast responses. However, this policy setting can interfere with the NetBIOS messages that detect name conflicts.

Prevents this computer from receiving unicast responses to its outgoing multicast or broadcast messages. If you enable this policy setting, and this computer sends multicast or broadcast messages to other computers, Windows [added: Defender ]Firewall blocks the unicast responses sent by those other computers. If you disable or do not configure this policy setting, and this computer sends a multicast or broadcast message to other computers, Windows [added: Defender ]Firewall waits as long as three seconds for unicast responses from the other computers and then blocks all later responses. Note: This policy setting has no effect if the unicast message is a response to a Dynamic Host Configuration Protocol (DHCP) broadcast message sent by this computer. Windows[added: Defender] Firewall always permits those DHCP unicast responses. However, this policy setting can interfere with the NetBIOS messages that detect name conflicts.

Allows this computer to receive unsolicited inbound Plug and Play messages sent by network devices, such as routers with built-in firewalls. To do this, Windows [added: Defender ]Firewall opens TCP port 2869 and UDP port 1900. If you enable this policy setting, Windows [added: Defender ]Firewall opens these ports so that this computer can receive Plug and Play messages. You must specify the IP addresses or subnets from which these incoming messages are allowed. In the Windows [added: Defender ]Firewall component of Control Panel, the "UPnP framework" check box is selected and administrators cannot clear it. If you disable this policy setting, Windows [added: Defender ]Firewall blocks these ports, which prevents this computer from receiving Plug and Play messages. If an administrator attempts to open these ports by adding them to a local port exceptions list, Windows [added: Defender ]Firewall does not open the ports. In the Windows [added: Defender ]Firewall component of Control Panel, the "UPnP framework" check box is cleared and administrators cannot select it. If you do not configure this policy setting, Windows [added: Defender ]Firewall does not open these ports. Therefore, the computer cannot receive Plug and Play messages unless an administrator uses other policy settings to open the required ports or enable the required programs. In the Windows[added: Defender] Firewall component of Control Panel, the "UPnP framework" check box is cleared. Administrators can change this check box."

Allows this computer to receive unsolicited inbound Plug and Play messages sent by network devices, such as routers with built-in firewalls. To do this, Windows [added: Defender ]Firewall opens TCP port 2869 and UDP port 1900. If you enable this policy setting, Windows [added: Defender ]Firewall opens these ports so that this computer can receive Plug and Play messages. You must specify the IP addresses or subnets from which these incoming messages are allowed. In the Windows [added: Defender ]Firewall component of Control Panel, the "UPnP framework" check box is selected and administrators cannot clear it. If you disable this policy setting, Windows [added: Defender ]Firewall blocks these ports, which prevents this computer from receiving Plug and Play messages. If an administrator attempts to open these ports by adding them to a local port exceptions list, Windows [added: Defender ]Firewall does not open the ports. In the Windows [added: Defender ]Firewall component of Control Panel, the "UPnP framework" check box is cleared and administrators cannot select it. If you do not configure this policy setting, Windows [added: Defender ]Firewall does not open these ports. Therefore, the computer cannot receive Plug and Play messages unless an administrator uses other policy settings to open the required ports or enable the required programs. In the Windows[added: Defender] Firewall component of Control Panel, the "UPnP framework" check box is cleared. Administrators can change this check box."

This policy setting controls whether a device will automatically [removed: sign-in][added: sign in and lock] the last interactive user after [removed: Windows Update][added: the system] restarts [added: or after a shutdown and cold boot. This only occurs if ]the [removed: system.][added: last interactive user didn’t sign out before the restart or shutdown.​] If [removed: you enable][added: the device is joined to Active Directory] or [removed: do not configure][added: Azure Active Directory,] this policy [removed: setting, the device securely saves the user's credentials (including the user name, domain][added: only applies to Windows Update restarts. Otherwise, this will apply to both Windows Update restarts and user-initiated restarts] and [removed: encrypted password) to][added: shutdowns.​ If you don’t] configure [removed: automatic sign-in after a Windows Update restart. After][added: this policy setting, it is enabled by default. When] the [removed: Windows Update restart,][added: policy is enabled,] the user is automatically signed[removed: -][added: ]in and the session is automatically locked with all [removed: the ]lock screen apps configured for that [removed: user. If][added: user after the device boots.​ After enabling this policy,] you [removed: disable this policy setting,][added: can configure its settings through] the [removed: device does not store][added: ConfigAutomaticRestartSignOn policy, which configures] the [removed: user's credentials for automatic sign-in][added: mode of automatically signing in and locking the last interactive user] after a [removed: Windows Update restart.][added: restart or cold boot​. If you disable this policy setting, the device does not configure automatic sign in.] The user[removed: s'][added: ’s] lock screen apps are not restarted after the system restarts.

Disable turns off the launch of all apps from the [removed: Windows][added: Microsoft] Store that came pre-installed or were downloaded. Apps will not be updated. Your Store will also be disabled. Enable turns all of it back on. This setting applies only to Enterprise and Education editions of Windows.

[was: This policy setting allows you to specify Clock discipline and General values for the Windows Time service (W32time) for domain controllers including RODCs. If you enable this policy setting, you can specify the following Clock discipline, General and RODC parameters for this service. If you disable or do not configure this policy setting, Windows Time service uses the defaults of each of the following parameters. Several of the following values are scalar, which means that they only have meaning in relation to one another and are not defined by specific unit measurements. FrequencyCorrectRate This parameter controls the rate at which the W32time corrects the local clock's frequency. Lower values cause slower corrections; larger values cause more frequent corrections. Values that are too low can lead to overcorrection and instability. Values that are too high can lead to slow synchronization. Default: 4 (scalar). HoldPeriod This parameter indicates how many potentially accurate time samples the client computer must receive in a series before subsequent time samples are evaluated as potential spikes. After a period of not receiving any usable time samples, a time client ceases to evaluate time samples for spikes as soon as the first potentially accurate time sample is received. When a series of time samples (as indicated by HoldPeriod) is received, the time client evaluates subsequent time samples for spikes. A time sample is considered to be a spike when the time difference between a time sample and the client computer's local clock is greater than that of the LargePhaseOffset value. Default: Five time samples. LargePhaseOffset This parameter specifies the time variation from the client computer's local clock (phase offset) that a time sample must have to be considered a spike. Time samples that have time variations larger than the LargePhaseOffset value are considered spikes. Default: 50,000,000 100-nanosecond units (ns), which is five seconds. MaxAllowedPhaseOffset This parameter controls how W32time corrects the clock based on the size of the calculated time variation between the time sample and the client computer's local clock. If a response is received that has a time variation that is larger than this value, W32time sets the client computer's local clock immediately to the time that is accepted as accurate from the Network Time Protocol (NTP) server. If the time variation is less than this value, the client computer's local clock is corrected gradually. Default: 300 seconds. MaxNegPhaseCorrection This parameter controls the maximum allowable clock correction that can be made in a reverse direction. If a time sample is received that indicates a time in the past (as compared to the client computer's local clock) that has a time difference that is greater than the MaxNegPhaseCorrection value, the time sample is discarded. If this happens, the Windows Time source logs an event in the System log of Event Viewer. Default: 172,800 seconds. MaxPosPhaseCorrection This parameter controls the maximum allowable clock correction that can be made in a forward direction. If a time sample is received that indicates a time in the future (as compared to the client computer's local clock) that has a time difference greater than the MaxPosPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds. PhaseCorrectRate This parameter controls how quickly W32time corrects the client computer's local clock difference to match time samples that are accepted as accurate from the NTP server. Lower values cause the clock to correct more slowly; larger values cause the clock to correct more quickly. Default: 7 (scalar). PollAdjustFactor This parameter controls how quickly W32time changes polling intervals. When responses are considered to be accurate, the polling interval lengthens automatically. When responses are considered to be inaccurate, the polling interval shortens automatically. Default: 5 (scalar). SpikeWatchPeriod This parameter specifies the amount of time that suspicious time samples are received from a time source before these time samples are accepted as accurate. Time samples are considered suspicious when the time difference between the time sample and the client computer's local clock is larger than the value of LargePhaseOffset. SpikeWatchPeriod is used in conjunction with HoldPeriod to help eliminate sporadic, inaccurate time samples that are returned from a peer. Default: 900 seconds. UpdateInterval This parameter specifies the amount of time that W32time waits between corrections when the clock is being corrected gradually. When it makes a gradual correction, the service adjusts the clock slightly, waits this amount of time, and then checks to see if another adjustment is needed, until the correction is finished. Default: 100 1/100th second units, which is 1 second. General parameters: AnnounceFlags This parameter is a bitmask value that controls how time service availability is advertised through NetLogon. Default: 0x0a hexadecimal. See the NtpClient\EventLogFlags Subkey documentation on Microsoft's TechNet Library for possible values. EventLogFlags This parameter controls special events that may be logged to the Event Viewer System log. Default: 0x02 hexadecimal bitmask. See the NtpClient\EventLogFlags Subkey documentation on Microsoft's TechNet Library for possible values. LocalClockDispersion This parameter indicates the maximum error in seconds that is reported by the NTP server to clients that are requesting a time sample. (Applies only when the NTP server is using the time of the local CMOS clock.) Default: 10 seconds. MaxPollInterval This parameter controls the maximum polling interval, which defines the maximum amount of time between polls of a peer. Default: 10 in log base-2, which is 1,024 seconds. (Should not be set higher than 15.) MinPollInterval This parameter controls the minimum polling interval that defines the minimum amount of time between polls of a peer. Default: 6 in log base-2, which is 64 seconds. RequireSecureTimeSyncRequests This parameter controls whether or not the the DC will respond to time sync requests that use older authentication protocols. If enabled (set to 1), the DC will not respond to requests using such protocols. Default: 0 Boolean. UtilizeSslTimeData This parameter controls whether W32time will use time data computed from SSL traffic on the machine as an additional input for correcting the local clock. Default: 1 Boolean RODC parameters: ChainEntryTimeout This parameter specifies the maximum amount of time that an entry can remain in the chaining table before the entry is considered to be expired. Expired entries may be removed when the next request or response is processed. Default: 16 seconds. ChainMaxEntries This parameter controls the maximum number of entries that are allowed in the chaining table. If the chaining table is full and no expired entries can be removed, any incoming requests are discarded. Default: 128 entries. ChainMaxHostEntries This parameter controls the maximum number of entries that are allowed in the chaining table for a particular host. Default: 4 entries. ChainDisable This parameter controls whether or not the chaining mechanism is disabled. If chaining is disabled (set to 0), the RODC can synchronize with any domain controller, but hosts that do not have their passwords cached on the RODC will not be able to synchronize with the RODC. Default: 0 Boolean. ChainLoggingRate This parameter controls the frequency at which an event that indicates the number of successful and unsuccessful chaining attempts is logged to the System log in Event Viewer. Default: 30 minutes. ] → [now: This policy setting allows you to specify Clock discipline and General values for the Windows Time service (W32time) for domain controllers including RODCs. If this policy setting is enabled, W32time Service on target machines use the settings provided here. Otherwise, the service on target machines use locally configured settings values. For more details on individual parameters, combinations of parameter values as well as definitions of flags, see https://go.microsoft.com/fwlink/?linkid=847809. FrequencyCorrectRate This parameter controls the rate at which the W32time corrects the local clock's frequency. Lower values cause slower corrections; larger values cause more frequent corrections. Default: 4 (scalar). HoldPeriod This parameter indicates how many consistent time samples the client computer must receive in a series before subsequent time samples are evaluated as potential spikes. Default: 5 LargePhaseOffset If a time sample differs from the client computer's local clock by more than LargePhaseOffset, the local clock is deemed to have drifted considerably, or in other words, spiked. Default: 50,000,000 100-nanosecond units (ns) or 5 seconds. MaxAllowedPhaseOffset If a response is received that has a time variation that is larger than this parameter value, W32time sets the client computer's local clock immediately to the time that is accepted as accurate from the Network Time Protocol (NTP) server. If the time variation is less than this value, the client computer's local clock is corrected gradually. Default: 300 seconds. MaxNegPhaseCorrection If a time sample is received that indicates a time in the past (as compared to the client computer's local clock) that has a time difference that is greater than the MaxNegPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds. MaxPosPhaseCorrection If a time sample is received that indicates a time in the future (as compared to the client computer's local clock) that has a time difference greater than the MaxPosPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds. PhaseCorrectRate This parameter controls how quickly W32time corrects the client computer's local clock difference to match time samples that are accepted as accurate from the NTP server. Lower values cause the clock to correct more slowly; larger values cause the clock to correct more quickly. Default: 7 (scalar). PollAdjustFactor This parameter controls how quickly W32time changes polling intervals. When responses are considered to be accurate, the polling interval lengthens automatically. When responses are considered to be inaccurate, the polling interval shortens automatically. Default: 5 (scalar). SpikeWatchPeriod This parameter specifies the amount of time that samples with time offset larger than LargePhaseOffset are received before these samples are accepted as accurate. SpikeWatchPeriod is used in conjunction with HoldPeriod to help eliminate sporadic, inaccurate time samples that are returned from a peer. Default: 900 seconds. UpdateInterval This parameter specifies the amount of time that W32time waits between corrections when the clock is being corrected gradually. When it makes a gradual correction, the service adjusts the clock slightly, waits this amount of time, and then checks to see if another adjustment is needed, until the correction is finished. Default: 100 1/100th second units, or 1 second. General parameters: AnnounceFlags This parameter is a bitmask value that controls how time service availability is advertised through NetLogon. Default: 0x0a hexadecimal EventLogFlags This parameter controls special events that may be logged to the Event Viewer System log. Default: 0x02 hexadecimal bitmask. LocalClockDispersion This parameter indicates the maximum error in seconds that is reported by the NTP server to clients that are requesting a time sample. (Applies only when the NTP server is using the time of the local CMOS clock.) Default: 10 seconds. MaxPollInterval This parameter controls the maximum polling interval, which defines the maximum amount of time between polls of a peer. Default: 10 in log base-2, or 1024 seconds. (Should not be set higher than 15.) MinPollInterval This parameter controls the minimum polling interval that defines the minimum amount of time between polls of a peer. Default: 6 in log base-2, or 64 seconds. ClockHoldoverPeriod This parameter indicates the maximum number of seconds a system clock can nominally hold its accuracy without synchronizing with a time source. If this period of time passes without W32time obtaining new samples from any of its input providers, W32time initiates a rediscovery of time sources. Default: 7800 seconds. RequireSecureTimeSyncRequests This parameter controls whether or not the DC will respond to time sync requests that use older authentication protocols. If enabled (set to 1), the DC will not respond to requests using such protocols. Default: 0 Boolean. UtilizeSslTimeData This parameter controls whether W32time will use time data computed from SSL traffic on the machine as an additional input for correcting the local clock. Default: 1 (enabled) Boolean ClockAdjustmentAuditLimit This parameter specifies the smallest local clock adjustments that may be logged to the W32time service event log on the target machine. Default: 800 Parts per million (PPM). RODC parameters: ChainEntryTimeout This parameter specifies the maximum amount of time that an entry can remain in the chaining table before the entry is considered to be expired. Expired entries may be removed when the next request or response is processed. Default: 16 seconds. ChainMaxEntries This parameter controls the maximum number of entries that are allowed in the chaining table. If the chaining table is full and no expired entries can be removed, any incoming requests are discarded. Default: 128 entries. ChainMaxHostEntries This parameter controls the maximum number of entries that are allowed in the chaining table for a particular host. Default: 4 entries. ChainDisable This parameter controls whether or not the chaining mechanism is disabled. If chaining is disabled (set to 0), the RODC can synchronize with any domain controller, but hosts that do not have their passwords cached on the RODC will not be able to synchronize with the RODC. Default: 0 Boolean. ChainLoggingRate This parameter controls the frequency at which an event that indicates the number of successful and unsuccessful chaining attempts is logged to the System log in Event Viewer. Default: 30 minutes. ]

This policy setting specifies a set of parameters for controlling the Windows NTP Client. If you enable this policy setting, you can specify the following parameters for the Windows NTP Client. If you disable or do not configure this policy setting, the WIndows NTP Client uses the defaults of each of the following parameters. NtpServer The Domain Name System (DNS) name or IP address of an NTP time source. This value is in the form of ""dnsName,flags"" where ""flags"" is a hexadecimal bitmask of the flags for that host. For more information, see the NTP Client Group Policy Settings Associated with Windows Time section of the Windows Time Service Group Policy Settings. The default value is ""time.windows.com,0x09"". Type This value controls the authentication that W32time uses. The default value is NT5DS. CrossSiteSyncFlags This value, expressed as a bitmask, controls how W32time chooses time sources outside its own site. The possible values are 0, 1, and 2. Setting this value to 0 (None) indicates that the time client should not attempt to synchronize time outside its site. Setting this value to 1 (PdcOnly) indicates that only the computers that function as primary domain controller (PDC) emulator operations masters in other domains can be used as synchronization partners when the client has to synchronize time with a partner outside its own site. Setting a value of 2 (All) indicates that any synchronization partner can be used. This value is ignored if the NT5DS value is not set. The default value is 2 decimal (0x02 hexadecimal). ResolvePeerBackoffMinutes This value, expressed in minutes, controls how long W32time waits before it attempts to resolve a DNS name when a previous attempt failed. The default value is 15 minutes. ResolvePeerBackoffMaxTimes This value controls how many times W32time attempts to resolve a DNS name before the discovery process is restarted. Each time DNS name resolution fails, the amount of time to wait before the next attempt will be twice the previous amount. The default value is seven attempts. SpecialPollInterval This NTP client value, expressed in seconds, controls how often a manually configured time source is polled when the time source is configured to use a special polling interval. If the SpecialInterval flag is enabled on the NTPServer setting, the client uses the value that is set as the SpecialPollInterval, instead of [removed: the][added: a variable interval between] MinPollInterval and MaxPollInterval values, to determine how frequently to poll the time source. [removed: The default][added: SpecialPollInterval must be in the range of [MinPollInterval, MaxPollInterval], else the nearest] value [added: of the range ]is [removed: 3600 seconds (1 hour).][added: picked. Default: 1024 seconds.] EventLogFlags This value is a bitmask that controls events that may be logged to the System log in Event Viewer. Setting this value to 0x1 indicates that W32time will create an event whenever a time jump is detected. Setting this value to 0x2 indicates that W32time will create an event whenever a time source change is made. Because it is a bitmask value, setting 0x3 (the addition of 0x1 and 0x2) indicates that both time jumps and time source changes will be logged.

Specifies whether the Windows Update will use the Windows Power Management features to automatically wake up the system from [removed: hibernation,][added: sleep,] if there are updates scheduled for installation. Windows Update will only automatically wake up the system if Windows Update is configured to install updates automatically. If the system is in [removed: hibernation][added: sleep] when the scheduled install time occurs and there are updates to be applied, then Windows Update will use the Windows Power management features to automatically wake the system up to install the updates. Windows update will also wake the system up and install an update if an install deadline occurs. The system will not wake unless there are updates to be installed.[removed: ][added: ]If the system is on battery power, when Windows Update wakes it up, it will not install updates and the system will automatically return to [removed: hibernation][added: sleep] in 2 minutes.

Specify the deadline [removed: in days ]before [removed: automatically executing a scheduled][added: the PC will automatically] restart [removed: outside of active hours. ][added: to apply updates. ]The deadline can be set [removed: between ]2 [removed: and][added: to] 14 days [removed: from][added: past] the [removed: time the ][added: default ]restart [removed: is scheduled. Note that the PC must ][added: date. The ]restart [removed: for certain updates to take effect.][added: may happen inside active hours.] If you [removed: enable this policy, a restart will automatically occur the specified number of days after the restart was scheduled. If you ]disable or do not configure this policy, the PC will restart according to the default schedule. [removed: If any][added: Enabling either] of the following two policies [removed: are enabled, this policy has no effect:][added: will override the above policy:] 1. No auto-restart with logged on users for scheduled automatic updates installations. 2. Always automatically restart at scheduled time.

Enable this policy to specify [removed: the type of notification used for ][added: when ]auto-restart reminders [removed: and when they ]are displayed. [removed: Specifies the type of notification used when notifying the user about a scheduled restart to install updates. ]You can specify the amount of time prior to a scheduled restart to notify the user. If you disable or do not configure this policy, the default[removed: style and] period will be used.

Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. Note: This policy does not apply to Windows RT. This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: 2 = Notify before downloading and installing any updates. When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. 3 = (Default setting) Download the updates automatically and notify when they are ready to be installed Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. 4 = Automatically download updates and install them on the schedule specified below. [added: When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) ]Specify the schedule using the options in the Group Policy Setting. [added: For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. ]If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) On Windows 8 and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use[removed: ,] and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. [removed: Automatic maintenance can be further configured by using Group Policy settings here: Computer Configuration->Administrative Templates->Windows Components->Maintenance Scheduler ]5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates.[added: (This option has not been carried over to any Win 10 Versions)] With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates.[added: 7 = Notify for install and notify for restart. (Windows Server only) With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually.] If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel.

Specifies an intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of [removed: WSUS Server.][added: the intranet update service.] If the status is set to Enabled, the Automatic Updates client connects to the specified intranet Microsoft update service (or alternate download server), instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don't have to go through a firewall to get updates, and it gives you the opportunity to test updates before deploying them. If the status is set to Disabled or Not Configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. The alternate download server [removed: C][added: c]onfigures the Windows Update Agent to download files from an alternative download server instead of the [removed: WSUS Server.][added: intranet update service. The option to download files with missing Urls allows content to be downloaded from the Alternate Download Server when there are no download Urls for files in the update metadata. This option should only be used when the intranet update service does not provide download Urls in the update metadata for files which are present on the alternate download server.] Note: If the "Configure Automatic Updates" policy is disabled, then this policy has no effect. Note: If the "Alternate Download Server" is not set, it will use the [removed: WSUS server][added: intranet update service] by default to download updates. Note: [added: The option to "Download files with no Url..." is only used if the "Alternate Download Server" is set. Note: ]This policy is not supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs.[added: To ensure the highest level of security, Microsoft recommends securing WSUS with TLS/SSL protocol, thereby using HTTPS based intranet servers to keep systems secure. If a proxy is required, we recommend configuring system proxy. To ensure highest levels of security, additionally leverage WSUS TLS certificate pinning on all devices. In order to keep clients inherently secure, we are no longer allowing intranet servers to leverage user proxy by default for detecting updates. If you need to leverage user proxy for detecting updates while using an intranet server despite the vulnerabilities it presents, you must configure the proxy behavior to "Allow user proxy to be used as a fallback if detection using system proxy fails". Detection for updates against intranet servers will fail when user proxy is needed as a fallback and the alternate proxy behavior is not configured.]

Enable this policy to specify [removed: what type of feature updates ][added: when ]to [removed: receive, and when. The branch readiness level for each new Windows 10 feature update is initially considered a "Current Branch" (CB) release,][added: receive Feature Updates. Defer Updates | This enables devices to defer taking the next Feature Update available to your channel for up] to [removed: be used by organizations for initial deployments. Once Microsoft has verified][added: 14 days for all the pre-release channels and up to 365 days for] the [removed: feature update should be considered for enterprise deployment, it will be declared][added: Semi-Annual Channel. Or, if the device is updating from the Semi-Annual Channel,] a [removed: branch readiness level of "Current Branch for Business" (CBB). You can defer receiving feature updates for up to 180 days. To prevent feature updates from being received on their scheduled time, you can temporarily pause feature updates. The pause][added: version for the device to move to and/or stay on until the policy is updated or the device reaches end of service can be specified. Note: If you set both policies, the version specified will take precedence and the deferrals] will [removed: remain][added: not be] in [removed: effect for 60 days or until you clear the start date field. ][added: effect. Please see the Windows Release Information page for OS version information. Pause Updates | ]To [removed: resume receiving ][added: prevent ]Feature Updates [removed: which are paused, clear the start date field. If ][added: from being received on their scheduled time, ]you [removed: disable or do not configure this policy, Windows Update will not alter its behavior. Note: If][added: can temporarily pause Feature Updates. The pause will remain in effect for 35 days from] the [removed: "Allow Telemetry" policy is set to 0, this policy][added: specified start date or until the field is cleared (Quality Updates] will [removed: have no effect.][added: still be offered).]

Enable this policy to specify when to receive quality updates. You can defer receiving quality updates for up to 30 days. To prevent quality updates from being received on their scheduled time, you can temporarily pause quality updates. The pause will remain in effect for 35 days or until you clear the start date field. To resume receiving Quality Updates which are paused, clear the start date field. If you disable or do not configure this policy, Windows Update will not alter its behavior.[removed: Note: If the "Allow Telemetry" policy is set to 0, this policy will have no effect.]

This policy setting specifies the Work Folders server for affected users, as well as whether or not users are allowed to change settings when setting up Work Folders on a domain-joined computer. If you enable this policy setting, affected users [removed: user ]receive Work Folders settings when they sign in to a domain-joined PC.[removed: ][added: If this policy setting is disabled or not configured, no Work Folders settings are specified for the affected users, though users can manually set up Work Folders by using the Work Folders Control Panel item. ]The "Work Folders URL" can specify either the URL used by the organization for Work Folders discovery, or the specific URL of the file server that stores the affected users' data. The [added: "Work Folders Local Path" specifies the local folder used on the client machine to sync files. This path may contain environment variables. Note: In order for this configuration to take effect, a valid 'Work Folders URL' must also be specified. The “On-demand file access preference” option controls whether to enable on-demand file access. When enabled, the user controls which files in Work Folders are available offline on a given PC. The rest of the files in Work Folders are always visible and don’t take up any space on the PC, but the user must be connected to the Internet to access them. If you enable this policy setting, on-demand file access is enabled. If you disable this policy setting, on-demand file access is disabled, and enough storage space to store all the user’s files is required on each of their PCs. If you specify User choice or do not configure this policy setting, the user decides whether to enable on-demand file access. However, if the Force automatic setup policy setting is enabled, Work Folders is set up automatically with on-demand file access enabled. The ]"Force automatic setup" option specifies that Work Folders should be set up automatically without prompting users. This prevents users from choosing not to use Work Folders on the computer; it also prevents them from manually specifying the local folder in which Work Folders stores files. By default, Work Folders is stored in the "%USERPROFILE%\Work Folders" folder. If this option is not specified, users must use the Work Folders Control Panel item on their computers to set up Work Folders.[removed: If this policy setting is disabled or not configured, no Work Folders settings are specified for the affected users, though users can manually set up Work Folders by using the Work Folders Control Panel item.]

Deploy [removed: Code Integrity Policy][added: Windows Defender Application Control] This policy setting lets you deploy a Code Integrity Policy to a machine to control what is allowed to run on that machine. If you deploy a Code Integrity Policy, Windows will restrict what can run in both kernel mode and on the Windows Desktop based on the policy. To enable this policy the machine must be rebooted. The file path must be either a UNC path (for example, \\ServerName\ShareName\SIPolicy.p7b), or a locally valid path (for example, C:\FolderName\SIPolicy.p7b). The local machine account (LOCAL SYSTEM) must have access permission to the policy file. If using a signed and protected policy then disabling this policy setting doesn't remove the feature from the computer. Instead, you must either: 1) first update the policy to a non-protected policy and then disable the setting, or 2) disable the setting and then remove the policy from each computer, with a physically present user.

Specifies whether Virtualization Based Security is enabled. Virtualization Based Security uses the Windows Hypervisor to provide support for security services. Virtualization Based Security requires Secure Boot, and can optionally be enabled with the use of DMA Protections. DMA protections require hardware support and will only be enabled on correctly configured devices. Virtualization Based Protection of Code Integrity This setting enables virtualization based protection of Kernel Mode Code Integrity. When this is enabled, kernel mode memory protections are enforced and the Code Integrity validation path is protected by the Virtualization Based Security feature. The "Disabled" option turns off Virtualization Based Protection of Code Integrity remotely if it was previously turned on with the "Enabled without lock" option. The "Enabled with UEFI lock" option ensures that Virtualization Based Protection of Code Integrity cannot be disabled remotely. In order to disable the feature, you must set the Group Policy to "Disabled" as well as remove the security functionality from each computer, with a physically present user, in order to clear configuration persisted in UEFI. The "Enabled without lock" option allows Virtualization Based Protection of Code Integrity to be disabled remotely by using Group Policy. [added: The "Not Configured" option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified. The "Require UEFI Memory Attributes Table" option will only enable Virtualization Based Protection of Code Integrity on devices with UEFI firmware support for the Memory Attributes Table. Devices without the UEFI Memory Attributes Table may have firmware that is incompatible with Virtualization Based Protection of Code Integrity which in some cases can lead to crashes or data loss or incompatibility with certain plug-in cards. If not setting this option the targeted devices should be tested to ensure compatibility. ]Warning: All drivers on the system must be compatible with this feature or the system may crash. Ensure that this policy setting is only deployed to computers which are known to be compatible. Credential Guard This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials. The "Disabled" option turns off Credential Guard remotely if it was previously turned on with the "Enabled without lock" option. The "Enabled with UEFI lock" option ensures that Credential Guard cannot be disabled remotely. In order to disable the feature, you must set the Group Policy to "Disabled" as well as remove the security functionality from each computer, with a physically present user, in order to clear configuration persisted in UEFI. The "Enabled without lock" option allows Credential Guard to be disabled remotely by using Group Policy. The devices that use this setting must be running at least Windows 10 (Version 1511).[added: The "Not Configured" option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified. Secure Launch This setting sets the configuration of Secure Launch to secure the boot chain. The "Not Configured" setting is the default, and allows configuration of the feature by Administrative users. The "Enabled" option turns on Secure Launch on supported hardware. The "Disabled" option turns off Secure Launch, regardless of hardware support.]