Windows Components › ActiveX Installer Service

Establish ActiveX installation policy for sites in Trusted zones

ComputerNative Intune settingAxISURLZonePolicies

Supported on At least Windows Vista

23H2 · 1.0

What it does

This policy setting controls the installation of ActiveX controls for sites in Trusted zone. If you enable this policy setting, ActiveX controls are installed according to the settings defined by this policy setting. If you disable or do not configure this policy setting, ActiveX controls prompt the user before installation. If the trusted site uses the HTTPS protocol, this policy setting can also control how ActiveX Installer Service responds to certificate errors. By default all HTTPS connections must supply a server certificate that passes all validation criteria. If you are aware that a trusted site has a certificate error but you want to trust it anyway you can select the certificate errors that you want to ignore. Note: This policy setting applies to all sites in Trusted zones.

What it writes

Hive: HKEY_LOCAL_MACHINE
Registry key: SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies

Why it needs changes for Intune

Policy references a Windows supportedOn definition.
ADMX-INTUNE-WINDOWS-SUPPORTEDON-REFERENCE

In Intune

Native Intune setting: Yes — Policy CSP

./Device/Vendor/MSFT/Policy/Config/ADMX_ActiveXInstallService/AxISURLZonePoliciesADMX_ActiveXInstallService on Microsoft LearnADMX-backed: Windows ships this template, so it is set with the template's own values, without an import.Windows builds listed: 10.0.22000, 10.0.19043.1202, 10.0.19042.1202, 10.0.19041.1202.

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.

Options

Option	Type	Registry value	Allowed values
Installation Policy for ActiveX control signed by trusted publisherRequiredDefault: Silently install	Drop-down list	`InstallTrustedOCX`	Don't install`0` Prompt the user`1` Silently install`2`
Installation Policy for signed ActiveX controlRequiredDefault: Prompt the user	Drop-down list	`InstallSignedOCX`	Don't install`0` Prompt the user`1` Silently install`2`
Installation Policy for unsigned ActiveX controlRequiredDefault: Don't install	Drop-down list	`InstallUnSignedOCX`	Don't install`0` Prompt the user`1`
Unknown certifcation authority (CA)Default: unchecked	Checkbox	`IgnoreUnknownCA`	On (1) or off (0)
Invalid certificate name (CN)Default: unchecked	Checkbox	`IgnoreInvalidCN`	On (1) or off (0)
Expired certificate validation dateDefault: unchecked	Checkbox	`IgnoreInvalidCertDate`	On (1) or off (0)
Wrong certificate usageDefault: unchecked	Checkbox	`IgnoreWrongCertUsage`	On (1) or off (0)

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

State Enabled Disabled Not configured

Options used when Enabled

Installation Policy for ActiveX control signed by trusted publisher

Installation Policy for signed ActiveX control

Installation Policy for unsigned ActiveX control

Unknown certifcation authority (CA)

Invalid certificate name (CN)

Expired certificate validation date

Wrong certificate usage

Enabled · Computer · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies]
"IgnoreInvalidCertDate"=dword:00000000
"IgnoreInvalidCN"=dword:00000000
"IgnoreUnknownCA"=dword:00000000
"IgnoreWrongCertUsage"=dword:00000000
"InstallSignedOCX"=dword:00000001
"InstallTrustedOCX"=dword:00000002
"InstallUnSignedOCX"=dword:00000000

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Establish ActiveX installation policy for sites in Trusted zones
# Name: AxISURLZonePolicies
# Scope: Machine
# State: Enabled
# Source: ActiveXInstallService.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'InstallTrustedOCX' -PropertyType 'DWord' -Value 2

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'InstallSignedOCX' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'InstallUnSignedOCX' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'IgnoreUnknownCA' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'IgnoreInvalidCN' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'IgnoreInvalidCertDate' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'IgnoreWrongCertUsage' -PropertyType 'DWord' -Value 0

These deployment candidates come from the ADMX template; they are separate from the native CSP mapping above.

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.

ADMX profile candidate (OMA-URI)

./Device/Vendor/MSFT/Policy/Config/ADMX_ActiveXInstallService/AxISURLZonePolicies

ADMX SyncML candidate

<SyncML xmlns="SYNCML:SYNCML1.2">
  <SyncBody>
    <Replace>
      <CmdID>1</CmdID>
      <Item>
        <Meta>
          <Format>chr</Format>
          <Type>text/plain</Type>
        </Meta>
        <Target>
          <LocURI>./Device/Vendor/MSFT/Policy/Config/ADMX_ActiveXInstallService/AxISURLZonePolicies</LocURI>
        </Target>
        <Data>&lt;enabled/&gt;
&lt;data id="InstallTrustedOCX" value="2"/&gt;
&lt;data id="InstallSignedOCX" value="1"/&gt;
&lt;data id="InstallUnSignedOCX" value="0"/&gt;
&lt;data id="IgnoreUnknownCA" value="false"/&gt;
&lt;data id="IgnoreInvalidCN" value="false"/&gt;
&lt;data id="IgnoreInvalidCertDate" value="false"/&gt;
&lt;data id="IgnoreWrongCertUsage" value="false"/&gt;</Data>
      </Item>
    </Replace>
    <Final/>
  </SyncBody>
</SyncML>

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Establish ActiveX installation policy for sites in Trusted zones
# Name: AxISURLZonePolicies
# Scope: Machine
# State: Enabled
# Source: ActiveXInstallService.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'InstallTrustedOCX' -Kind 'DWord' -Expected 2
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies\InstallTrustedOCX') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'InstallSignedOCX' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies\InstallSignedOCX') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'InstallUnSignedOCX' -Kind 'DWord' -Expected 0
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies\InstallUnSignedOCX') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'IgnoreUnknownCA' -Kind 'DWord' -Expected 0
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies\IgnoreUnknownCA') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'IgnoreInvalidCN' -Kind 'DWord' -Expected 0
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies\IgnoreInvalidCN') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'IgnoreInvalidCertDate' -Kind 'DWord' -Expected 0
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies\IgnoreInvalidCertDate') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'IgnoreWrongCertUsage' -Kind 'DWord' -Expected 0
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies\IgnoreWrongCertUsage') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Establish ActiveX installation policy for sites in Trusted zones
# Name: AxISURLZonePolicies
# Scope: Machine
# State: Enabled
# Source: ActiveXInstallService.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'InstallTrustedOCX' -PropertyType 'DWord' -Value 2

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'InstallSignedOCX' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'InstallUnSignedOCX' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'IgnoreUnknownCA' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'IgnoreInvalidCN' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'IgnoreInvalidCertDate' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies' -Name 'IgnoreWrongCertUsage' -PropertyType 'DWord' -Value 0

History 3 retained releases

22H2 · 1.015 Jul 2024
- Already present in the first release ChangeIntel keeps.

2 later releases left it unchanged.

Template

Internal name: AxISURLZonePolicies
Namespace: Microsoft.Policies.ActiveXInstallService
Template file: ActiveXInstallService.admx
Release: Windows 11 23H2 · 1.0 · file set d784d0ea5f14a680…

Definition, editor controls and support

Definition

<policy class="Machine" displayName="$(string.AxISURLZonePolicies)" explainText="$(string.AxISURLZonePolicies_explain)" key="SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies" name="AxISURLZonePolicies" presentation="$(presentation.AxISURLZonePolicies)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.ActiveXInstallService:AxInstSv" />
      <supportedOn ref="Microsoft.Policies.Windows:SUPPORTED_WindowsVista" />
      <elements>
        <enum id="InstallTrustedOCX" required="true" valueName="InstallTrustedOCX">
          <item displayName="$(string.TrustedZoneDisabled)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.TrustedZonePrompt)">
            <value>
              <decimal value="1" />
            </value>
          </item>
          <item displayName="$(string.TrustedZoneSilentInstall)">
            <value>
              <decimal value="2" />
            </value>
          </item>
        </enum>
        <enum id="InstallSignedOCX" required="true" valueName="InstallSignedOCX">
          <item displayName="$(string.TrustedZoneDisabled)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.TrustedZonePrompt)">
            <value>
              <decimal value="1" />
            </value>
          </item>
          <item displayName="$(string.TrustedZoneSilentInstall)">
            <value>
              <decimal value="2" />
            </value>
          </item>
        </enum>
        <enum id="InstallUnSignedOCX" required="true" valueName="InstallUnSignedOCX">
          <item displayName="$(string.TrustedZoneDisabled)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.TrustedZonePrompt)">
            <value>
              <decimal value="1" />
            </value>
          </item>
        </enum>
        <boolean id="IgnoreUnknownCA" required="false" valueName="IgnoreUnknownCA">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="IgnoreInvalidCN" required="false" valueName="IgnoreInvalidCN">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="IgnoreInvalidCertDate" required="false" valueName="IgnoreInvalidCertDate">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="IgnoreWrongCertUsage" required="false" valueName="IgnoreWrongCertUsage">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
      </elements>
    </policy>

Editor controls

<presentation id="AxISURLZonePolicies" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <dropdownList defaultItem="2" noSort="true" refId="InstallTrustedOCX">Installation Policy for ActiveX control signed by trusted publisher</dropdownList>
        <dropdownList defaultItem="1" noSort="true" refId="InstallSignedOCX">Installation Policy for signed ActiveX control</dropdownList>
        <dropdownList defaultItem="0" noSort="true" refId="InstallUnSignedOCX">Installation Policy for unsigned ActiveX control</dropdownList>
        <text>Permit connection to trusted sites with the following server certificate errors.</text>
        <checkBox defaultChecked="false" refId="IgnoreUnknownCA">Unknown certifcation authority (CA)</checkBox>
        <checkBox defaultChecked="false" refId="IgnoreInvalidCN">Invalid certificate name (CN)</checkBox>
        <checkBox defaultChecked="false" refId="IgnoreInvalidCertDate">Expired certificate validation date</checkBox>
        <checkBox defaultChecked="false" refId="IgnoreWrongCertUsage">Wrong certificate usage</checkBox>
      </presentation>

Supported platforms and category

Microsoft.Policies.ActiveXInstallService:category:AxInstSv
<category displayName="$(string.AxInstSv)" name="AxInstSv" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />  
    </category>
Microsoft.Policies.Products:product:MicrosoftWindows
sha256:4b3cb6917b5e5b7cd142c0157f10882786b3e9ee67c29fd7b8f4c6cb2eec5fe7
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Windows:definition:SUPPORTED_WindowsVista
<definition displayName="$(string.SUPPORTED_WindowsVista)" name="SUPPORTED_WindowsVista" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range minVersionIndex="4" ref="Microsoft.Policies.Products:MicrosoftWindows" />
        </or>
      </definition>
Microsoft.Policies.ActiveXInstallService:category:AxInstSv
<category displayName="$(string.AxInstSv)" name="AxInstSv" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />  
    </category>
<strings><string id="Microsoft.Policies.ActiveXInstallService:AxInstSv">ActiveX Installer Service</string></strings>
Microsoft.Policies.Products:product:MicrosoftWindows
<product displayName="$(string.MicrosoftWindows)" name="MicrosoftWindows" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <majorVersion displayName="$(string.MicrosoftWindows2000)" name="MicrosoftWindows2000" versionIndex="1">
          <minorVersion displayName="$(string.MicrosoftWindows2000_RTM)" name="MicrosoftWindows2000_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP1)" name="MicrosoftWindows2000_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP2)" name="MicrosoftWindows2000_SP2" versionIndex="2" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP3)" name="MicrosoftWindows2000_SP3" versionIndex="3" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP4)" name="MicrosoftWindows2000_SP4" versionIndex="4" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsXP)" name="MicrosoftWindowsXP" versionIndex="2">
          <minorVersion displayName="$(string.MicrosoftWindowsXP_RTM)" name="MicrosoftWindowsXP_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsXP_SP1)" name="MicrosoftWindowsXP_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindowsXP_SP2)" name="MicrosoftWindowsXP_SP2" versionIndex="2" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer2003)" name="MicrosoftWindowsServer2003" versionIndex="3">
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_RTM)" name="MicrosoftWindowsServer2003_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_SP1)" name="MicrosoftWindowsServer2003_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_R2)" name="MicrosoftWindowsServer2003_R2" versionIndex="2" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_SP2)" name="MicrosoftWindowsServer2003_SP2" versionIndex="3" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsVista)" name="MicrosoftWindowsVista" versionIndex="4">
          <minorVersion displayName="$(string.MicrosoftWindowsVista_RTM)" name="MicrosoftWindowsVista_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsVista_SP1)" name="MicrosoftWindowsVista_SP1" versionIndex="1" />
        </majorVersion>
        <majorVersion displayName="$(string.WindowsServer2008)" name="WindowsServer2008" versionIndex="5">
          <minorVersion displayName="$(string.WindowsServer2008_RTM)" name="WindowsServer2008_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.WindowsServer2008_R2)" name="WindowsServer2008_R2" versionIndex="1" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows7)" name="MicrosoftWindows7" versionIndex="6">
          <minorVersion displayName="$(string.MicrosoftWindows7_RTM)" name="MicrosoftWindows7_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer8)" name="MicrosoftWindowsServer8" versionIndex="7">
           <minorVersion displayName="$(string.MicrosoftWindowsServer8_RTM)" name="MicrosoftWindowsServer8_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows8)" name="MicrosoftWindows8" versionIndex="8">
          <minorVersion displayName="$(string.MicrosoftWindows8_RTM)" name="MicrosoftWindows8_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_RT)" name="MicrosoftWindows_RT" versionIndex="9">
          <minorVersion displayName="$(string.MicrosoftWindows_RT_RTM)" name="MicrosoftWindows_RT_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer_6_3)" name="MicrosoftWindowsServer_6_3" versionIndex="10">
           <minorVersion displayName="$(string.MicrosoftWindowsServer_6_3_RTM)" name="MicrosoftWindowsServer_6_3_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_6_3)" name="MicrosoftWindows_6_3" versionIndex="11">
          <minorVersion displayName="$(string.MicrosoftWindows_6_3_RTM)" name="MicrosoftWindows_6_3_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_6_3_RT)" name="MicrosoftWindows_6_3_RT" versionIndex="12">
            <minorVersion displayName="$(string.MicrosoftWindows_6_3_RT_RTM)" name="MicrosoftWindows_6_3_RT_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer_10_0)" name="MicrosoftWindowsServer_10_0" versionIndex="13">
            <minorVersion displayName="$(string.MicrosoftWindowsServer_10_0_RTM)" name="MicrosoftWindowsServer_10_0_RTM" versionIndex="0" />
          </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_10_0)" name="MicrosoftWindows_10_0" versionIndex="14">
            <minorVersion displayName="$(string.MicrosoftWindows_10_0_RTM)" name="MicrosoftWindows_10_0_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_10_0_RT)" name="MicrosoftWindows_10_0_RT" versionIndex="15">
            <minorVersion displayName="$(string.MicrosoftWindows_10_0_RT_RTM)" name="MicrosoftWindows_10_0_RT_RTM" versionIndex="0" />
        </majorVersion>
      </product>
<strings><string id="Microsoft.Policies.Products:MicrosoftWindows">Windows operating system</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000">Windows 2000 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_RTM">Windows 2000</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP1">Windows 2000 Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP2">Windows 2000 Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP3">Windows 2000 Service Pack 3</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP4">Windows 2000 Service Pack 4</string><string id="Microsoft.Policies.Products:MicrosoftWindows7">Windows 7 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows7_RTM">Windows 7</string><string id="Microsoft.Policies.Products:MicrosoftWindows8">Windows 8 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows8_RTM">Windows 8</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003">Windows Server 2003 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_R2">Windows Server 2003 R2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_RTM">Windows Server 2003</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_SP1">Windows Server 2003 Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_SP2">Windows Server 2003 Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer8">Windows Server 2012 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer8_RTM">Windows Server 2012</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_10_0">Windows Server 2016 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_10_0_RTM">Windows Server 2016</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_6_3">Windows Server 2012 R2 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_6_3_RTM">Windows Server 2012 R2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista">Windows Vista operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista_RTM">Windows Vista</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista_SP1">Windows Vista Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP">Windows XP operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_RTM">Windows XP</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_SP1">Windows XP Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_SP2">Windows XP Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0">Windows 10 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RT">Windows 10 RT operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RTM">Windows 10</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RT_RTM">Windows 10 RT</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3">Windows 8.1 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RT">Windows RT 8.1 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RTM">Windows 8.1</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RT_RTM">Windows RT 8.1</string><string id="Microsoft.Policies.Products:MicrosoftWindows_RT">Windows RT operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_RT_RTM">Windows RT</string><string id="Microsoft.Policies.Products:WindowsServer2008">Windows Server 2008 operating systems</string><string id="Microsoft.Policies.Products:WindowsServer2008_R2">Windows Server 2008 R2</string><string id="Microsoft.Policies.Products:WindowsServer2008_RTM">Windows Server 2008</string></strings>
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:WindowsComponents">Windows Components</string><string id="Microsoft.Policies.Windows:WindowsComponents_Help">Contains settings for operating system components.</string></strings>
Microsoft.Policies.Windows:definition:SUPPORTED_WindowsVista
<definition displayName="$(string.SUPPORTED_WindowsVista)" name="SUPPORTED_WindowsVista" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range minVersionIndex="4" ref="Microsoft.Policies.Products:MicrosoftWindows" />
        </or>
      </definition>
<strings><string id="Microsoft.Policies.Windows:SUPPORTED_WindowsVista">At least Windows Vista</string></strings>