Windows 11: 22H2 · 1.0 to 24H2 · 1.0

This policy setting allows you to hide the TaskView button.[removed: ][added: ]If you enable this policy setting, the TaskView button will be hidden and the Settings toggle will be disabled.

Turning off [removed: files from Office.com ][added: this setting ]will prevent File Explorer from requesting [removed: recent ]cloud file metadata and displaying it in the [removed: Quick access view.][added: homepage and other views in File Explorer. Any insights and files available based on account activity will be stopped in views such as Recent, Recommended, Favorites, Details pane, etc.]

[added: This policy is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows. ]AllowCommercialDataPipeline configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at https://go.microsoft.com/fwlink/?linkid=2185086. To enable this behavior: 1. Enable this policy setting 2. Join an Azure Active Directory account to the device Windows diagnostic data is collected when the Allow Telemetry policy setting is set to value 1 - Required or above. Configuring this setting does not change the Windows diagnostic data collection level set for the device[added: .] If you disable or do not configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft's privacy statement at https://go.microsoft.com/fwlink/?LinkId=521839 unless you have enabled policies like 'Allow Update Compliance Processing' or 'Allow Desktop Analytics Processing[removed: ”][added: ']. See the documentation at https://go.microsoft.com/fwlink/?linkid=2011107 for information on this and other policies that will result in Microsoft being the processor of Windows diagnostic data.

This policy [added: is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows. This policy ]setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor for Windows diagnostic data collected from the device, subject to the Product Terms at https://go.microsoft.com/fwlink/?linkid=2185086. To enable this behavior: 1. Enable this policy setting 2. Join an Azure Active Directory account to the device 3. Set Allow Telemetry to value 1 - Required, or higher 4. Set the Configure the Commercial ID setting for your Desktop Analytics workspace When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. This setting has no effect on devices unless they are properly enrolled in Desktop Analytics. If you disable this policy setting, devices will not appear in Desktop Analytics.

This policy [added: is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows. This policy ]setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at https://go.microsoft.com/fwlink/?linkid=2185086. To enable this behavior: 1. Enable this policy setting 2. Join an Azure Active Directory account to the device 3. Set Allow Telemetry to value 1 - Required, or higher 4. Set the Configure the Commercial ID setting for your Update Compliance workspace When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. If you disable or do not configure this policy setting, devices will not appear in Update Compliance.

This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all [removed: Windows][added: packaged Microsoft] Store apps that use the enterpriseAuthentication capability on a computer. If you enable this policy setting, you can define additional Content URI Rules that all [removed: Windows][added: packaged Microsoft] Store apps that use the enterpriseAuthentication capability on a computer can use. If you disable or don't set this policy setting, [removed: Windows][added: packaged Microsoft] Store apps will only use the static Content URI Rules.

This policy [added: is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows. This policy ]setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at https://go.microsoft.com/fwlink/?linkid=2185086. To enable this behavior: 1. Enable this policy setting 2. Join an Azure Active Directory account to the device 3. Set Allow Telemetry to value 1 - Required, or higher When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. If you disable or do not configure this policy setting, devices enrolled to the Windows Update for Business deployment service will not be able to take advantage of some deployment service features.

Specifies if the DNS client would use the DDR protocol. The Discovery of Designated Resolvers (DDR) protocol allows Windows to move from unencrypted DNS to encrypted DNS when only the IP address of a resolver is known. If you enable this policy, the DNS client will use the DDR protocol. If you disable this policy setting, or if you do not configure this policy setting, [removed: computers][added: the DNS client] will use locally configured settings.

This setting controls the inclusion of [removed: Microsoft Edge ][added: app ]tabs into Alt+Tab. This can be set to show [removed: all tabs, ]the most recent [removed: 3][added: 3, 5] or [removed: 5][added: 20] tabs, or no tabs from [removed: Microsoft Edge.][added: apps.] If this is set to show "Open windows only", the whole feature will be disabled.

Specifies if the DNS client will perform name resolution over [removed: DNS over HTTPS (DoH).][added: encrypted protocols.] By default, the DNS client will do classic DNS name resolution (over UDP or [removed: TCP).][added: TCP port 53).] This setting can enhance the DNS client to use [removed: DoH protocol][added: encrypted protocols] to resolve domain names. To use this policy setting, click Enabled, and then select one of the following options from the drop-down list: Prohibit [removed: DoH: No DoH][added: encryption: no encrypted] name resolution will be performed. Allow [removed: DoH: Perform DoH queries][added: encryption: Use encrypted name resolution] if the configured [removed: DNS ]servers support it. If they don't support it, try classic name resolution. Require [removed: DoH:][added: encryption:] Allow only [removed: DoH][added: encrypted] name resolution. If there are no [removed: DoH capable ][added: configured ]DNS servers [removed: configured,][added: that handle encryption,] name resolution will fail. [added: In addition to the generic encryption policy, additional policies can be configured at the individual protocol level. For example, in order to force DoT name resolution only, a combination of "Require encryption" and "Block DoH" would be needed (vice versa to force DoH). For the example above, it is the admin's responsibility to ensure that if DoT is forced, there are valid DoT servers configured on the machine (vice versa for DoH). ]If you disable this policy setting, or if you do not configure this policy setting, [removed: computers][added: the DNS client] will use locally configured settings. DDR (Discovery of Designated Resolvers) plaintext traffic [removed: is][added: will be] allowed as it is necessary for auto-discovering [removed: DoH][added: encryption] settings.

This policy setting allows you to specify the type of Remote Desktop Services client access license (RDS CAL) that is required to connect to this RD Session Host server. You can use this policy setting to select one of two licensing modes: Per User or Per Device. Per User licensing mode requires that each user account connecting to this RD Session Host server have an RDS Per User CAL issued from an RD Licensing server. Per Device licensing mode requires that each device connecting to this RD Session Host server have an RDS Per Device CAL issued from an RD Licensing server. If you enable this policy setting, the Remote Desktop licensing mode that you specify is honored by the Remote Desktop license server and RD Session Host. If you disable or do not configure this policy setting, the licensing mode is not specified at the Group Policy level.[added: Note: AAD Per User mode is deprecated on Windows 11 and above.]

This policy setting specifies whether JScript or JScript9Legacy is [removed: loaded for MSHTML/WebOC/MSXML/Cscript based invocations.][added: loaded.] If you enable this policy [removed: setting,][added: setting or not configured,] JScript9Legacy will be loaded in situations where JScript is instantiated. If you disable this policy, then JScript will be utilized.[removed: If this policy is left unconfigured, then MSHTML will use JScript9Legacy and MSXML/Cscript will use JScript.]

This policy controls the configuration under which LSASS is run. If you do not configure this policy and there is no current setting in the registry, LSA will run as protected process for [added: all ]clean installed, HVCI capable, client [removed: SKUs that are domain or cloud domain joined devices.][added: SKUs.] This configuration is not UEFI locked. This can be overridden if the policy is configured. If you configure and set this policy setting to "Disabled", LSA will not run as a protected process. If you configure and set this policy setting to "EnabledWithUEFILock," LSA will run as a protected process and this configuration is UEFI locked. If you configure and set this policy setting to "EnabledWithoutUEFILock", LSA will run as a protected process and this configuration is not UEFI locked.

This policy setting allows users to see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you enable this policy setting, users will see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you disable this policy setting, users won’t see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you don’t configure this policy setting, the default setting for the user’s device will be used, and the user can choose to change it.

This policy setting allows you to specify which protocols can be used for Remote Desktop Protocol (RDP) access to this server. If you enable this policy setting, you must specify if you would like RDP to use UDP. You can select one of the following options: "Use [removed: both][added: either] UDP [removed: and TCP", "Use only TCP" ][added: or TCP (default)" ]or "Use [removed: either UDP or TCP (default)"][added: only TCP"] If you select "Use either UDP or TCP" and the UDP connection is successful, most of the RDP traffic will use UDP. If the UDP connection is not successful or if you select "Use only TCP," all of the RDP traffic will use TCP. If you disable or do not configure this policy setting, RDP will choose the optimal protocols for delivering the best user experience.