Windows 10 22H2 · 1.0

This policy setting lets you enable H.264/AVC hardware encoding support for Remote Desktop Connections. When you enable hardware encoding, if an error occurs, we will attempt to use software encoding. If you disable or do not configure this policy, we will always use software encoding.[removed: If you set the encoding option to “Always Attempt”, Remote Desktop will always try to use H.264/AVC hardware encoding when available, be aware that, for Windows Server running Hyper-V with RemoteFX vGPU enabled, the policy has to be set on the Hyper-V host machine. If you set the encoding option to “Attempt only for RemoteFX vGPU virtual machines” be aware that, for Windows Server running Hyper-V with RemoteFX vGPU enabled, the policy has to be set on the Hyper-V host machine. If you set the encoding option to “Attempt only for non-RemoteFX vGPU scenarios”, Remote Desktop attempts to use hardware encoding for all scenarios except RemoteFX vGPU. ]

This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for Trusted Platform Module (TPM) commands requiring authorization.[removed: ][added: ]If the number of TPM commands with an authorization failure within the duration equals a threshold, a standard user is prevented from sending commands requiring authorization to the TPM.[removed: ][added: ]This setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM.[removed: ][added: ]An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred.[removed: ][added: ]Authorization failures older than this duration are ignored. For each standard user two thresholds apply.[removed: ][added: ]Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization.[removed: ][added: ]The Standard User Lockout Threshold Individual value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM.[removed: ][added: ]The Standard User Lockout Total Threshold value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM.[removed: ][added: ]The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value.[removed: ][added: ]When the TPM enters a lockout mode it is global for all users including administrators and Windows features like BitLocker Drive Encryption.[removed: ][added: ]The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer.[removed: ][added: ]Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures.[removed: ][added: ]Some TPMs may require a system restart to exit the lockout mode.[removed: ][added: ]Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode. An administrator with the TPM owner password may fully reset the TPM's hardware lockout logic using the TPM Management Console (tpm.msc).[removed: ][added: ]Each time an administrator resets the TPM's hardware lockout logic all prior standard user TPM authorization failures are ignored; allowing standard users to use the TPM normally again immediately. If this value is not configured, a default value of 480 minutes (8 hours) is used.[removed: ]

This policy setting allows you to enable or disable User Experience Virtualization (UE-V) feature. Reboot is needed for enable to take effect.[added: With Auto-register inbox templates enabled, the UE-V inbox templates such as Office 2016 will be automatically registered when the UE-V Service is enabled. If this option is changed, it will only take effect when UE-V service is re-enabled.]

[added: ]This policy setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits.[removed: ][added: ]If you enable this policy setting, you can require a minimum number of digits to be used when setting the startup PIN.[removed: ][added: ]If you disable or do not configure this policy setting, users can configure a startup PIN of any length between [removed: 4][added: 6] and 20 digits.[added: NOTE: If minimum PIN length is set below 6 digits, Windows will attempt to update the TPM 2.0 lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset.]

[added: ]This policy setting [removed: prevents computers from establishing][added: determines if a computer can have] multiple [removed: simultaneous ]connections to [removed: either ]the [removed: I][added: i]nternet or to a Windows domain. [removed: By default, when this policy setting value is Not Configured, it is enabled. ][added: If multiple connections are allowed, it then determines how network traffic will be routed. ]If this policy setting is [removed: enabled, when the][added: set to 0, a] computer [removed: has at least one active connection ][added: can have simultaneous connections ]to the [removed: Internet,][added: internet, to] a [removed: new automatic connection attempt ][added: Windows domain, or ]to [removed: the][added: both.] Internet [removed: is blocked. When the computer has at least one active][added: traffic can be routed over any connection - including a cellular] connection [removed: to a Windows domain, a new automatic connection to the same Windows domain is also blocked. Additional manual connection attempts by users to the Internet or][added: and any metered network. This was previously the Disabled state for this policy setting. This option was first available in Windows 8. If this policy setting is set] to [removed: a Windows domain are not][added: 1, any new automatic internet connection is] blocked [removed: by this policy setting. In circumstances where there are multiple simultaneous connections ][added: when the computer has at least one active internet connection ]to [removed: either the Internet or to a Windows domain, Windows disconnects the less][added: a preferred type of network. Here's the order of preference (from most] preferred [removed: connection when the amount of network traffic over the less][added: to least preferred): Ethernet, WLAN, then cellular. Ethernet is always] preferred [removed: connection drops below a certain threshold. For example, when a computer is connected to Internet using a WLAN connection and the user plugs][added: when connected. Users can still manually connect to any network. This was previously the Enabled state for this policy setting. This option was first available] in [removed: to an Ethernet network, network traffic is routed through][added: Windows 8. If this policy setting is set to 2,] the [removed: faster Ethernet connection, and the WLAN traffic diminishes. Windows detects this circumstance and responds by disconnecting the WLAN connection. If this policy setting is disabled, multiple simultaneous connections to the Internet,][added: behavior is similar to 1. However, if a cellular data connection is available, it will always stay connected for services that require a cellular connection. When the user is connected] to a [removed: Windows domain, ][added: WLAN ]or [removed: to both are allowed. If this policy setting value is Not Configured, the default policy setting is enabled. This is different than enabling the][added: Ethernet connection, no internet traffic will be routed over the cellular connection. This option was first available in Windows 10 (Version 1703). If this] policy setting [removed: with Group Policy, however - when the policy setting is Not Configured, the policy setting is configurable on the local computer. When the policy setting is applied with Group Policy, it is not configurable locally. With the][added: is set to 3, the behavior is similar to 2. However, if there's an Ethernet connection, Windows won't allow users to connect to a WLAN manually. A WLAN can only be connected (automatically or manually) when there's no Ethernet connection. This] policy setting [removed: value of Not Configured, new automatic connection attempts are not made, and less preferred connections are disconnected.][added: is related to the "Enable Windows to soft-disconnect a computer from a network" policy setting.]

This policy setting allows you to manage whether a check for new virus and spyware [removed: definitions][added: security intelligence] will occur before running a scan. This setting applies to scheduled scans as well as the command line "mpcmdrun -SigUpdate", but it has no effect on scans initiated manually from the user interface. If you enable this setting, a check for new [removed: definitions][added: security intelligence] will occur before running a scan. If you disable this setting or do not configure this setting, the scan will start using the existing [removed: definitions.][added: security intelligence.]

This policy setting turns off [removed: Windows Defender. ][added: Microsoft Defender Antivirus. ]If you enable this policy setting, [removed: Windows][added: Microsoft] Defender [added: Antivirus ]does not run, and [removed: computers are not scanned][added: will not scan computers] for malware or other potentially unwanted software. If you disable [removed: or][added: this policy setting, Microsoft Defender Antivirus will run regardless of any other installed antivirus product. If you] do not configure this policy setting, [removed: by default][added: Windows will internally manage Microsoft Defender Antivirus. If you install another antivirus program,] Windows [added: automatically disables Microsoft ]Defender [removed: runs and computers are scanned][added: Antivirus. Otherwise, Microsoft Defender Antivirus will scan your computers] for malware and other potentially unwanted software.[added: Enabling or disabling this policy may lead to unexpected or unsupported behavior. It is recommended that you leave this policy setting unconfigured.]

[added: ]Allows an administrator to specify if Automatic Exclusions feature for Server SKUs should be turned off.[added: Disabled (Default): Microsoft Defender will exclude pre-defined list of paths from the scan to improve performance. Enabled: Microsoft Defender will not exclude pre-defined list of paths from scans. This can impact machine performance in some scenarios. Not configured: Same as Disabled. ]

This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device.[removed: ][added: ]Enabled – The Block at First Sight setting is turned on.[removed: ][added: ]Disabled – The Block at First Sight setting is turned off.[removed: ][added: ]This feature requires these Group Policy settings to be set as follows:[removed: ][added: ]MAPS -> The “Join Microsoft MAPS” must be enabled or the “Block at First Sight” feature will not function.[removed: ][added: ]MAPS -> The “Send file samples when further analysis is required” should be set to 1 (Send safe samples) or 3 (Send all samples). Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the “Block at First Sight” feature will not function.[removed: ][added: ]Real-time Protection -> The “Scan all downloaded files and attachments” policy must be enabled or the “Block at First Sight” feature will not function.[removed: ][added: ]Real-time Protection -> Do not enable the “Turn off real-time protection” policy or the “Block at First Sight” feature will not function.

This policy setting turns off real-time protection prompts for known malware detection. [removed: Windows][added: Microsoft] Defender [added: Antivirus ]alerts you when malware or potentially unwanted software attempts to install itself or to run on your computer. If you enable this policy setting, [removed: Windows][added: Microsoft] Defender [added: Antivirus ]will not prompt users to take actions on malware detections. If you disable or do not configure this policy setting, [removed: Windows][added: Microsoft] Defender[added: Antivirus] will prompt users to take actions on malware detections.

This policy setting allows you to configure whether [removed: Windows][added: Microsoft] Defender [added: Antivirus ]automatically takes action on all detected threats. The action to be taken on a particular threat is determined by the combination of the policy-defined action, user-defined action, and the signature-defined action. If you enable this policy setting, [removed: Windows][added: Microsoft] Defender [added: Antivirus ]does not automatically take action on the detected threats, but prompts users to choose from the actions available for each threat. If you disable or do not configure this policy setting, [removed: Windows][added: Microsoft] Defender[added: Antivirus] automatically takes action on all detected threats after a nonconfigurable delay of approximately five seconds.