Windows 10 22H2 · 1.0

This policy setting controls whether [added: Universal ]Windows [removed: Store ]apps with Windows Runtime API access directly from web content can be launched. If you enable this policy setting, [added: Universal ]Windows [removed: Store apps with][added: apps which declare] Windows Runtime API access [removed: directly from web content][added: in ApplicationContentUriRules section of the manifest] cannot be launched; [added: Universal ]Windows [removed: Store apps without][added: apps which have not declared] Windows Runtime API access [removed: from web content][added: in the manifest] are not affected. If you disable or do not configure this policy setting, all [added: Universal ]Windows [removed: Store ]apps can be launched.[added: This policy should not be enabled unless recommended by Microsoft as a security response because it can cause severe app compatibility issues.]

This policy setting determines whether enhanced anti-spoofing is [removed: configured][added: required] for [removed: devices which support it.][added: Windows Hello face authentication.] If you [removed: do not configure ][added: enable ]this [removed: policy ]setting, [removed: users will be able to choose whether or not ][added: Windows requires all users on managed devices ]to use enhanced anti-spoofing [removed: on supported devices. If you enable this policy setting, ][added: for Windows Hello face authentication. This disables ]Windows [removed: will require all users ][added: Hello face authentication ]on [removed: the device to use anti-spoofing for facial features, on devices which support it. If you disable this policy setting, ][added: devices that do not support enhanced anti-spoofing. If you disable or don't configure this setting, Windows doesn't require ]enhanced anti-spoofing [removed: is turned off for all users on the device and they will be unable to turn it on.][added: for Windows Hello face authentication. Note that enhanced anti-spoofing for Windows Hello face authentication is not required on unmanaged devices.]

This policy setting allows you to require a pin for pairing. If you [removed: turn][added: set this to 'Never', a pin isn't required for pairing. If you set] this [removed: on,][added: to 'First Time',] the pairing ceremony for new devices will always require a [removed: pin. ][added: PIN. ]If you [removed: turn it off or don't configure it, a pin isn't required for pairing.][added: set this to 'Always', all pairings will require PIN.]

This policy setting allows you to control whether a domain user can sign in using a convenience PIN.[removed: In Windows 10, convenience PIN was replaced with Windows Hello PIN, which has stronger security properties. To configure Windows Hello for Business, use the policies under Computer configuration\Administrative Templates\Windows Components\Windows Hello for Business.] If you enable this policy setting, a domain user can set up and sign in with a convenience PIN.[removed: ][added: ]If you disable or don't configure this policy setting, a domain user can't set up and use a convenience PIN. Note[removed: that t][added: : T]he user's domain password will be cached in the system vault when using this feature.[added: To configure Windows Hello for Business, use the Administrative Template policies under Windows Hello for Business.]

When running in Restricted [removed: Administration mode ][added: Admin ]or [removed: if the device is using ]Remote Credential Guard[added: mode], participating apps do not expose [removed: credentials to remote devices (regardless of the delegation method).][added: signed in or supplied credentials to a remote host.] Restricted [removed: Administration mode may limit ][added: Admin limits ]access to resources located on other servers or networks [removed: beyond][added: from] the [removed: target computer][added: remote host] because credentials are not delegated. Remote Credential Guard does not limit access to resources [removed: by redirecting][added: because it redirects] all requests back to the client device. Participating apps: Remote Desktop Client If you enable this policy setting, [added: the following options are supported:   Restrict credential delegation: Participating applications must use ]Restricted [removed: Administration mode or][added: Admin or Remote Credential Guard to connect to remote hosts.   Require Remote Credential Guard: Participating applications must use] Remote Credential Guard [removed: is enforced and participating apps will not delegate credentials][added: to connect to remote hosts.   Require Restricted Admin: Participating applications must use Restricted Admin to connect] to remote [removed: devices.][added: hosts.] If you disable or do not configure this policy setting, Restricted [removed: Administration mode ][added: Admin ]and Remote Credential Guard[added: mode] are not enforced and participating apps can delegate credentials to remote devices. Note: To disable most credential delegation, it may be sufficient to deny delegation in Credential Security Support Provider (CredSSP) by modifying Administrative template settings (located at Computer Configuration\Administrative Templates\System\Credentials Delegation). Note: On Windows 8.1 and Windows Server 2012 R2, enabling this policy will enforce Restricted Administration mode, regardless of the mode chosen. These versions do not support Remote Credential Guard.

[removed: This policy][added: By configuring this] setting [removed: determines the amount of diagnostic and usage data reported][added: in Windows 10, end users will not be able] to [removed: Microsoft. A value][added: opt into a higher level] of [removed: 0 will send minimal data to Microsoft. This data includes Malicious Software Removal Tool (MSRT) &][added: telemetry collection than the level you have set for your organization. This limitation applies only to the] Windows [removed: Defender data, if enabled, and telemetry client settings. Setting a value of 0 applies to enterprise, EDU, IoT and server devices only. Setting a value of][added: operating system and apps included with Windows, and does not apply to third-party apps running on Windows 10. Diagnostic data is categorized into four levels, as follows: -] 0 [removed: for other devices is equivalent ][added: (Security). Information that's required ]to [removed: choosing a value of 1. A value of 1 sends only a basic amount of diagnostic][added: help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences] and [removed: usage data. Note that setting values of 0 or][added: Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender. -] 1 [removed: will degrade certain experiences on][added: (Required). Basic device info, including: quality-related data, app compatibility, and data from] the [removed: device. A value of 2 sends enhanced diagnostic][added: Security level. - 2 (Enhanced). Additional insights, including: how Windows, Windows Server, System Center,] and [removed: usage data. A value of 3 sends the same][added: apps are used, how they perform, advanced reliability data, and] data [removed: as a value of 2, plus additional diagnostics data, including the files][added: from both the Required and the Security levels. - 3 (Optional). All data necessary to identify] and [removed: content that may have caused][added: help to fix problems, plus data from] the [removed: problem. Windows 10 telemetry settings applies][added: Security, Required, and Enhanced levels. Options available] to [added: users in ]the [removed: Windows operating system][added: Settings app are changed by configuring this setting,] and [removed: some first party apps. This setting does not apply to third party apps running on Windows 10. If you disable or do not configure this policy setting,][added: even if not set, may be impacted by other group policy settings. Note that if this policy is configured to allow a telemetry setting of Security or Basic, end] users [removed: can configure the Telemetry level in Settings. ][added: will be unable to select a higher level. ]

This policy setting defines the identifier used to uniquely associate this device’s telemetry data as belonging to a given organization. If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program. If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its telemetry data with your organization.[removed: ][added: ]