NTLM Enhanced Blocking

ComputerNeeds changes for IntuneNew in 26H2 · 1.0BlockNtlm

Supported on At least Windows 11 Version 24H2

26H2 · 1.0

What it does

This policy setting allows the NTLM security package to block NTLM authentication requests based on the new, enhanced blocking policies at the Machine level. These enhanced blocking policies allow you to block NTLM authentication based on new criteria, such as the type of the account, the role of the device, or the type of application. If the overall policy is set to "Disabled" or "Not Configured", the subsettings below will not take effect. If the overall policy is set to "Enabled", the subpolicies below will take effect based on their configuration. Unless configured, all policies are set to "Audit" mode. Policies that are set to "Audit" will log a warning about the NTLM request that could be blocked, but will not block it. Multiple policies that are marked as "Audit" can be enabled at the same time, and they will be logged in an unified event log. If any policy is marked as "Enabled", the NTLM authentication request will be blocked if it matches the criteria of the policy. If multiple policies are marked as "Enabled", the NTLM authentication request will be blocked if it matches the criteria of any of the policies. An event log will be generated for the first policy that blocks the NTLM authentication. In scenarios where there are both "Audit" and "Enabled" policies, the "Enabled" policy will take precedence. All of the enhanced blocking policies outlined here share the same allow list, which specifies the accounts, devices, and applications that are allowed to use NTLM authentication. The allow list can contain a series of target names or SPNs to allow the authentication. For more information, please visit aka.ms/ntlmlogandblock.

What it writes

Hive: HKEY_LOCAL_MACHINE
Registry key: Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters
Value name: EnhancedNtlmBlocks
When enabled: DWORD 1
When disabled: DWORD 0

Why it needs changes for Intune

Policy references a Windows supportedOn definition.
ADMX-INTUNE-WINDOWS-SUPPORTEDON-REFERENCE

In Intune

No native CSP; import the ADMX (needs changes first).

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 9 Nov 2026.

Options

Option	Type	Registry value	Allowed values
Block NTLM for Domain Accounts Single Sign-OnDefault: Audit (1)	Drop-down list (enum)	`BlockDomainAccountSSO`	Audit`1` Enabled`2` Disabled`0`
Block NTLM for Domain ControllersDefault: Audit (1)	Drop-down list (enum)	`BlockDomainControllerAuth`	Audit`1` Enabled`2` Disabled`0`
Block NTLM when Machine binding failsDefault: Audit (1)	Drop-down list (enum)	`EnforceMachineBinding`	Audit`1` Enabled`2` Disabled`0`
Block all NTLM authenticationDefault: Audit (1)	Drop-down list (enum)	`BlockAll`	Audit`1` Enabled`2` Disabled`0`
Specify the allow list for enhanced blocking policies	Multi-line text (multiText)	`EnhancedMachineBlockingAllowList`	Any

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Enabled · Computer · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters]
"BlockAll"=dword:00000001
"BlockDomainAccountSSO"=dword:00000001
"BlockDomainControllerAuth"=dword:00000001
"EnforceMachineBinding"=dword:00000001
"EnhancedMachineBlockingAllowList"=hex(7):00,00,00,00
"EnhancedNtlmBlocks"=dword:00000001

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: NTLM Enhanced Blocking
# Name: BlockNtlm
# Scope: Machine
# State: Enabled
# Source: Ntlm.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'EnhancedNtlmBlocks' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'BlockDomainAccountSSO' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'BlockDomainControllerAuth' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'EnforceMachineBinding' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'BlockAll' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'EnhancedMachineBlockingAllowList' -PropertyType 'MultiString' -Value @()

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.
The generated payload is incomplete because one or more ADMX element values were not supplied: EnhancedMachineBlockingWithAllowListBox

ADMX profile candidate (OMA-URI)

./Device/Vendor/MSFT/Policy/Config/ADMX_Ntlm/BlockNtlm

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' {
            $actualBits = if ($actual -is [uint64]) { $actual } else { [BitConverter]::ToUInt64([BitConverter]::GetBytes([int64]$actual), 0) }
            $expectedBits = if ($Expected -is [uint64]) { $Expected } else { [BitConverter]::ToUInt64([BitConverter]::GetBytes([int64]$Expected), 0) }
            return $actualBits -eq $expectedBits
        }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: NTLM Enhanced Blocking
# Name: BlockNtlm
# Scope: Machine
# State: Enabled
# Source: Ntlm.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'EnhancedNtlmBlocks' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters\EnhancedNtlmBlocks') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'BlockDomainAccountSSO' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters\BlockDomainAccountSSO') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'BlockDomainControllerAuth' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters\BlockDomainControllerAuth') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'EnforceMachineBinding' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters\EnforceMachineBinding') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'BlockAll' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters\BlockAll') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'EnhancedMachineBlockingAllowList' -Kind 'MultiString' -Expected @()
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters\EnhancedMachineBlockingAllowList') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: NTLM Enhanced Blocking
# Name: BlockNtlm
# Scope: Machine
# State: Enabled
# Source: Ntlm.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'EnhancedNtlmBlocks' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'BlockDomainAccountSSO' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'BlockDomainControllerAuth' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'EnforceMachineBinding' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'BlockAll' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters' -Name 'EnhancedMachineBlockingAllowList' -PropertyType 'MultiString' -Value @()

History 6 retained releases

26H2 · 1.029 Sep 2026

Registry key: Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters · Value name: EnhancedNtlmBlocks
- Added in this release.

Template

Internal name: BlockNtlm
Namespace: Microsoft.Policies.NTLM
Template file: Ntlm.admx
Release: Windows 11 26H2 · 1.0 · file set d777fedd6ae12a6d…

Definition, editor controls and support

Definition

<policy class="Machine" displayName="$(string.EnhancedMachineBlockingWithAllowListId)" explainText="$(string.EnhancedMachineBlockingWithAllowListId_Explained)" key="Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters" name="BlockNtlm" presentation="$(presentation.EnhancedMachineBlockingWithAllowListId)" valueName="EnhancedNtlmBlocks" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.NTLM:NTLM" />
      <supportedOn ref="Microsoft.Policies.Windows:SUPPORTED_Windows_11_0_24H2" />
      <enabledValue>
        <decimal value="1" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
      <elements>
        <enum id="DomainSingleSignOnDropDown" valueName="BlockDomainAccountSSO">
            <item displayName="$(string.Audit)">
                <value>
                    <decimal value="1" />
                </value>
            </item>
            <item displayName="$(string.Enabled)">
                <value>
                    <decimal value="2" />
                </value>
            </item>
            <item displayName="$(string.Disabled)">
                <value>
                    <decimal value="0" />
                </value>
            </item>
        </enum>
        <enum id="DomainControllerAuthDropDown" valueName="BlockDomainControllerAuth">
            <item displayName="$(string.Audit)">
                <value>
                    <decimal value="1" />
                </value>
            </item>
            <item displayName="$(string.Enabled)">
                <value>
                    <decimal value="2" />
                </value>
            </item>
            <item displayName="$(string.Disabled)">
                <value>
                    <decimal value="0" />
                </value>
            </item>
        </enum>
        <enum id="MachineBindingDropDown" valueName="EnforceMachineBinding">
            <item displayName="$(string.Audit)">
                <value>
                    <decimal value="1" />
                </value>
            </item>
            <item displayName="$(string.Enabled)">
                <value>
                    <decimal value="2" />
                </value>
            </item>
            <item displayName="$(string.Disabled)">
                <value>
                    <decimal value="0" />
                </value>
            </item>
        </enum>
        <enum id="BlockAllDropDown" valueName="BlockAll">
            <item displayName="$(string.Audit)">
                <value>
                    <decimal value="1" />
                </value>
            </item>
            <item displayName="$(string.Enabled)">
                <value>
                    <decimal value="2" />
                </value>
            </item>
            <item displayName="$(string.Disabled)">
                <value>
                    <decimal value="0" />
                </value>
            </item>
        </enum>
        <multiText id="EnhancedMachineBlockingWithAllowListBox" valueName="EnhancedMachineBlockingAllowList" />
      </elements>
    </policy>

Editor controls

<presentation id="EnhancedMachineBlockingWithAllowListId" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <dropdownList defaultItem="0" noSort="true" refId="DomainSingleSignOnDropDown">Block NTLM for Domain Accounts Single Sign-On</dropdownList>
        <dropdownList defaultItem="0" noSort="true" refId="DomainControllerAuthDropDown">Block NTLM for Domain Controllers</dropdownList>
        <dropdownList defaultItem="0" noSort="true" refId="MachineBindingDropDown">Block NTLM when Machine binding fails</dropdownList>
        <dropdownList defaultItem="0" noSort="true" refId="BlockAllDropDown">Block all NTLM authentication</dropdownList>
        <multiTextBox refId="EnhancedMachineBlockingWithAllowListBox">Specify the allow list for enhanced blocking policies:</multiTextBox>
      </presentation>

Supported platforms and category

Microsoft.Policies.NTLM:category:NTLM
<category displayName="$(string.NTLM)" name="NTLM" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:System" />
    </category>
Microsoft.Policies.Products:product:MicrosoftWindows
sha256:1d505469d0a97dec7153fd9cf33cb08b4082d070963b74b2110e28bf291f1a4c
Microsoft.Policies.Windows:category:System
<category displayName="$(string.System)" explainText="$(string.System_Help)" name="System" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Windows:definition:SUPPORTED_Windows_11_0_24H2
<definition displayName="$(string.SUPPORTED_Windows_11_0_24H2)" name="SUPPORTED_Windows_11_0_24H2" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
          <or>
              <range minVersionIndex="16" ref="Microsoft.Policies.Products:MicrosoftWindows" />
          </or>
      </definition>
Microsoft.Policies.NTLM:category:NTLM
<category displayName="$(string.NTLM)" name="NTLM" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:System" />
    </category>
<strings><string id="Microsoft.Policies.NTLM:NTLM">NTLM</string></strings>
Microsoft.Policies.Products:product:MicrosoftWindows
<product displayName="$(string.MicrosoftWindows)" name="MicrosoftWindows" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <majorVersion displayName="$(string.MicrosoftWindows2000)" name="MicrosoftWindows2000" versionIndex="1">
          <minorVersion displayName="$(string.MicrosoftWindows2000_RTM)" name="MicrosoftWindows2000_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP1)" name="MicrosoftWindows2000_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP2)" name="MicrosoftWindows2000_SP2" versionIndex="2" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP3)" name="MicrosoftWindows2000_SP3" versionIndex="3" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP4)" name="MicrosoftWindows2000_SP4" versionIndex="4" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsXP)" name="MicrosoftWindowsXP" versionIndex="2">
          <minorVersion displayName="$(string.MicrosoftWindowsXP_RTM)" name="MicrosoftWindowsXP_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsXP_SP1)" name="MicrosoftWindowsXP_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindowsXP_SP2)" name="MicrosoftWindowsXP_SP2" versionIndex="2" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer2003)" name="MicrosoftWindowsServer2003" versionIndex="3">
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_RTM)" name="MicrosoftWindowsServer2003_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_SP1)" name="MicrosoftWindowsServer2003_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_R2)" name="MicrosoftWindowsServer2003_R2" versionIndex="2" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_SP2)" name="MicrosoftWindowsServer2003_SP2" versionIndex="3" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsVista)" name="MicrosoftWindowsVista" versionIndex="4">
          <minorVersion displayName="$(string.MicrosoftWindowsVista_RTM)" name="MicrosoftWindowsVista_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsVista_SP1)" name="MicrosoftWindowsVista_SP1" versionIndex="1" />
        </majorVersion>
        <majorVersion displayName="$(string.WindowsServer2008)" name="WindowsServer2008" versionIndex="5">
          <minorVersion displayName="$(string.WindowsServer2008_RTM)" name="WindowsServer2008_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.WindowsServer2008_R2)" name="WindowsServer2008_R2" versionIndex="1" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows7)" name="MicrosoftWindows7" versionIndex="6">
          <minorVersion displayName="$(string.MicrosoftWindows7_RTM)" name="MicrosoftWindows7_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer8)" name="MicrosoftWindowsServer8" versionIndex="7">
           <minorVersion displayName="$(string.MicrosoftWindowsServer8_RTM)" name="MicrosoftWindowsServer8_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows8)" name="MicrosoftWindows8" versionIndex="8">
          <minorVersion displayName="$(string.MicrosoftWindows8_RTM)" name="MicrosoftWindows8_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_RT)" name="MicrosoftWindows_RT" versionIndex="9">
          <minorVersion displayName="$(string.MicrosoftWindows_RT_RTM)" name="MicrosoftWindows_RT_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer_6_3)" name="MicrosoftWindowsServer_6_3" versionIndex="10">
           <minorVersion displayName="$(string.MicrosoftWindowsServer_6_3_RTM)" name="MicrosoftWindowsServer_6_3_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_6_3)" name="MicrosoftWindows_6_3" versionIndex="11">
          <minorVersion displayName="$(string.MicrosoftWindows_6_3_RTM)" name="MicrosoftWindows_6_3_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_6_3_RT)" name="MicrosoftWindows_6_3_RT" versionIndex="12">
            <minorVersion displayName="$(string.MicrosoftWindows_6_3_RT_RTM)" name="MicrosoftWindows_6_3_RT_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer_10_0)" name="MicrosoftWindowsServer_10_0" versionIndex="13">
            <minorVersion displayName="$(string.MicrosoftWindowsServer_10_0_RTM)" name="MicrosoftWindowsServer_10_0_RTM" versionIndex="0" />
          </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_10_0)" name="MicrosoftWindows_10_0" versionIndex="14">
            <minorVersion displayName="$(string.MicrosoftWindows_10_0_RTM)" name="MicrosoftWindows_10_0_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_10_0_RT)" name="MicrosoftWindows_10_0_RT" versionIndex="15">
            <minorVersion displayName="$(string.MicrosoftWindows_10_0_RT_RTM)" name="MicrosoftWindows_10_0_RT_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_11_0)" name="MicrosoftWindows_11_0" versionIndex="16">
          <minorVersion displayName="$(string.MicrosoftWindows_11_0_RTM)" name="MicrosoftWindows_11_0_RTM" versionIndex="0" />
        </majorVersion>
      </product>
<strings><string id="Microsoft.Policies.Products:MicrosoftWindows">Windows operating system</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000">Windows 2000 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_RTM">Windows 2000</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP1">Windows 2000 Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP2">Windows 2000 Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP3">Windows 2000 Service Pack 3</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP4">Windows 2000 Service Pack 4</string><string id="Microsoft.Policies.Products:MicrosoftWindows7">Windows 7 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows7_RTM">Windows 7</string><string id="Microsoft.Policies.Products:MicrosoftWindows8">Windows 8 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows8_RTM">Windows 8</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003">Windows Server 2003 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_R2">Windows Server 2003 R2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_RTM">Windows Server 2003</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_SP1">Windows Server 2003 Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_SP2">Windows Server 2003 Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer8">Windows Server 2012 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer8_RTM">Windows Server 2012</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_10_0">Windows Server 2016 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_10_0_RTM">Windows Server 2016</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_6_3">Windows Server 2012 R2 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_6_3_RTM">Windows Server 2012 R2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista">Windows Vista operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista_RTM">Windows Vista</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista_SP1">Windows Vista Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP">Windows XP operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_RTM">Windows XP</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_SP1">Windows XP Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_SP2">Windows XP Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0">Windows 10 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RT">Windows 10 RT operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RTM">Windows 10</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RT_RTM">Windows 10 RT</string><string id="Microsoft.Policies.Products:MicrosoftWindows_11_0">Windows 11 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_11_0_RTM">Windows 11</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3">Windows 8.1 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RT">Windows RT 8.1 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RTM">Windows 8.1</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RT_RTM">Windows RT 8.1</string><string id="Microsoft.Policies.Products:MicrosoftWindows_RT">Windows RT operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_RT_RTM">Windows RT</string><string id="Microsoft.Policies.Products:WindowsServer2008">Windows Server 2008 operating systems</string><string id="Microsoft.Policies.Products:WindowsServer2008_R2">Windows Server 2008 R2</string><string id="Microsoft.Policies.Products:WindowsServer2008_RTM">Windows Server 2008</string></strings>
Microsoft.Policies.Windows:category:System
<category displayName="$(string.System)" explainText="$(string.System_Help)" name="System" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:System">System</string><string id="Microsoft.Policies.Windows:System_Help">Allows configuration of various system component settings.</string></strings>
Microsoft.Policies.Windows:definition:SUPPORTED_Windows_11_0_24H2
<definition displayName="$(string.SUPPORTED_Windows_11_0_24H2)" name="SUPPORTED_Windows_11_0_24H2" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
          <or>
              <range minVersionIndex="16" ref="Microsoft.Policies.Products:MicrosoftWindows" />
          </or>
      </definition>
<strings><string id="Microsoft.Policies.Windows:SUPPORTED_Windows_11_0_24H2">At least Windows 11 Version 24H2</string></strings>