Windows 11: 22H2 · 1.0 to 25H2 · 1.0
149 new settings, 73 changed, 1 removed since 22H2 · 1.0. 4 retained releases apart.
Changes that matter
223 settings · compared with 22H2 · 1.0- Computer · Windows Components\Windows Update\Manage end user experience
- Computer · Windows Components\Desktop App Installer
- Computer · Windows Components\Desktop App Installer
-
Computer · Windows Components\Delivery Optimization
- Renamed Delay background download from http (in sec[added: ond]s)
- Description
[removed: This policy allows you to delay the use of an HTTP source in a ][added: For ]background download[added: s] that[removed: is allowed to ]use[removed: P2P. After the max delay has reached, ][added: P2P, specifies ]the[removed: download will resume using HTTP, either downloading the entire payload or complementing the bytes that could not be downloaded ][added: time to wait before starting to download ]from[removed: Peers. Note that a download that is waiting for peer sources, will appear to be stuck for ]the[removed: end user. The recommended value is 1 hour (3600).][added: HTTP source.]Whole description, marked
[removed: This policy allows you to delay the use of an HTTP source in a ][added: For ]background download[added: s] that[removed: is allowed to ]use[removed: P2P. After the max delay has reached, ][added: P2P, specifies ]the[removed: download will resume using HTTP, either downloading the entire payload or complementing the bytes that could not be downloaded ][added: time to wait before starting to download ]from[removed: Peers. Note that a download that is waiting for peer sources, will appear to be stuck for ]the[removed: end user. The recommended value is 1 hour (3600).][added: HTTP source.] - Editor controls or their defaults changed.
- User · Windows Components\Cloud Content
-
Computer · Windows Components\Data Collection and Preview Builds
- Description
[added: This policy is deprecated and will only work on Windows 10 version 1809. Setti…]AllowCommercialDataPipeline configures an Azure Active Directory joined device …device[added: .]
If you disable or do not configure this setting, Microsoft will be … have enabled policies like 'Allow Update Comp…Processing
[removed: ”][added: ']. See the documentation at https://go.microsoft.com/fwlink/?linkid=2011107 for information on this and other policies …Whole description, marked
[added: This policy is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows. ]AllowCommercialDataPipeline configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at https://go.microsoft.com/fwlink/?linkid=2185086. To enable this behavior: 1. Enable this policy setting 2. Join an Azure Active Directory account to the device Windows diagnostic data is collected when the Allow Telemetry policy setting is set to value 1 - Required or above. Configuring this setting does not change the Windows diagnostic data collection level set for the device[added: .] If you disable or do not configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft's privacy statement at https://go.microsoft.com/fwlink/?LinkId=521839 unless you have enabled policies like 'Allow Update Compliance Processing' or 'Allow Desktop Analytics Processing
[removed: ”][added: ']. See the documentation at https://go.microsoft.com/fwlink/?linkid=2011107 for information on this and other policies that will result in Microsoft being the processor of Windows diagnostic data. - Supported on At least Windows Server 2016, Windows 10 Version
[removed: 1903][added: 1809] - Supported on windows:SUPPORTED_Windows_10_0_RS
[removed: 6][added: 5]; resolved; AnyOf; products:MicrosoftWindows [13, ]
- Description
[added: This policy is deprecated and will only work on Windows 10 version 1809. Setti…]AllowCommercialDataPipeline configures an Azure Active Directory joined device …device[added: .]
If you disable or do not configure this setting, Microsoft will be … have enabled policies like 'Allow Update Comp…Processing
-
Computer · Windows Components\Delivery Optimization
- Description
[removed: Set this policy to delay the fallback from Cache Server to ][added: For background downloads that use a cache server, specifies ]the[removed: HTTP source for a background content download by X seconds. Note: if you set the policy ][added: time to wait before falling back ]to[removed: delay background ]download from[removed: http, it will apply first (to allow downloads from peers first).][added: the original HTTP source.]Whole description, marked
[removed: Set this policy to delay the fallback from Cache Server to ][added: For background downloads that use a cache server, specifies ]the[removed: HTTP source for a background content download by X seconds. Note: if you set the policy ][added: time to wait before falling back ]to[removed: delay background ]download from[removed: http, it will apply first (to allow downloads from peers first).][added: the original HTTP source.] - Editor controls or their defaults changed.
- Description
-
Computer · Windows Components\Delivery Optimization
- Description
[removed: Set this policy to delay the fallback from Cache Server to ][added: For foreground downloads that use a cache server, specifies ]the[removed: HTTP source for a foreground content download by X seconds. Note: if you set the policy ][added: time to wait before falling back ]to[removed: delay foreground ]download from[removed: http, it will apply first (to allow downloads from peers first).][added: the original HTTP source.]Whole description, marked
[removed: Set this policy to delay the fallback from Cache Server to ][added: For foreground downloads that use a cache server, specifies ]the[removed: HTTP source for a foreground content download by X seconds. Note: if you set the policy ][added: time to wait before falling back ]to[removed: delay foreground ]download from[removed: http, it will apply first (to allow downloads from peers first).][added: the original HTTP source.] - Editor controls or their defaults changed.
- Description
-
Computer · Windows Components\App Package Deployment
- Renamed Allows development of
[removed: Windows][added: packaged Microsoft] Store apps and installing them from an integrated development environment (IDE)
- Renamed Allows development of
-
Computer · Windows Components\Data Collection and Preview Builds
- Description
This policy [added: is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows.
This policy ]setting, in combination with the Allow Telemetry and Configure the Commercial ID, …
Whole description, marked
This policy [added: is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows. This policy ]setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor for Windows diagnostic data collected from the device, subject to the Product Terms at https://go.microsoft.com/fwlink/?linkid=2185086. To enable this behavior: 1. Enable this policy setting 2. Join an Azure Active Directory account to the device 3. Set Allow Telemetry to value 1 - Required, or higher 4. Set the Configure the Commercial ID setting for your Desktop Analytics workspace When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. This setting has no effect on devices unless they are properly enrolled in Desktop Analytics. If you disable this policy setting, devices will not appear in Desktop Analytics.
- Supported on At least Windows Server 2016, Windows 10 Version 1
[removed: 9][added: 8]09 - Supported on windows:SUPPORTED_Windows_10_0_RS
[removed: 7][added: 5]; resolved; AnyOf; products:MicrosoftWindows [13, ]
- Description
This policy [added: is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows.
This policy ]setting, in combination with the Allow Telemetry and Configure the Commercial ID, …
-
Computer · Windows Components\Delivery Optimization
- Renamed Delay Foreground download from http (in sec[added: ond]s)
- Description
[removed: This policy allows you to delay the use of an HTTP source in a ][added: For ]foreground[removed: (interactive) download ][added: downloads ]that[removed: is allowed to ]use[removed: P2P. After the max delay has reached, ][added: P2P, specifies ]the[removed: download will resume using HTTP, either downloading the entire payload or complementing the bytes that could not be downloaded ][added: time to wait before starting to download ]from[removed: Peers. Note that a download that is waiting for peer sources, will appear to be stuck for ]the[removed: end user. The recommended value is 1 minute (60).][added: HTTP source.]Whole description, marked
[removed: This policy allows you to delay the use of an HTTP source in a ][added: For ]foreground[removed: (interactive) download ][added: downloads ]that[removed: is allowed to ]use[removed: P2P. After the max delay has reached, ][added: P2P, specifies ]the[removed: download will resume using HTTP, either downloading the entire payload or complementing the bytes that could not be downloaded ][added: time to wait before starting to download ]from[removed: Peers. Note that a download that is waiting for peer sources, will appear to be stuck for ]the[removed: end user. The recommended value is 1 minute (60).][added: HTTP source.] - Editor controls or their defaults changed.
-
Computer · Windows Components\Data Collection and Preview Builds
- Description
This policy [added: is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows.
This policy ]setting, in combination with the Allow Telemetry and Configure the Commercial ID, …
Whole description, marked
This policy [added: is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows. This policy ]setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at https://go.microsoft.com/fwlink/?linkid=2185086. To enable this behavior: 1. Enable this policy setting 2. Join an Azure Active Directory account to the device 3. Set Allow Telemetry to value 1 - Required, or higher 4. Set the Configure the Commercial ID setting for your Update Compliance workspace When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. If you disable or do not configure this policy setting, devices will not appear in Update Compliance.
- Supported on At least Windows Server 2016, Windows 10 Version 1
[removed: 9][added: 8]09 - Supported on windows:SUPPORTED_Windows_10_0_RS
[removed: 7][added: 5]; resolved; AnyOf; products:MicrosoftWindows [13, ]
- Description
This policy [added: is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows.
This policy ]setting, in combination with the Allow Telemetry and Configure the Commercial ID, …
- Not allow per-user unsigned packages to install by default (requires explicitly allow per install)NewComputer · Windows Components\App Package Deployment
-
Computer · Windows Components\App runtime
- Renamed Turn on dynamic Content URI Rules for
[removed: Windows store][added: packaged Microsoft Store] apps - Description
… were defined as part of the app manifest and apply to all
[removed: Windows][added: packaged Microsoft] Store apps that use the enterpriseAuthentication capability on a computer. If you … this policy setting, you can define additional Content URI Rules that all[removed: Windows][added: packaged Microsoft] Store apps that use the enterpriseAuthentication capability on a computer can use. If you disable or don't set this policy setting,[removed: Windows][added: packaged Microsoft] Store apps will only use the static Content URI Rules.Whole description, marked
This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all
[removed: Windows][added: packaged Microsoft] Store apps that use the enterpriseAuthentication capability on a computer. If you enable this policy setting, you can define additional Content URI Rules that all[removed: Windows][added: packaged Microsoft] Store apps that use the enterpriseAuthentication capability on a computer can use. If you disable or don't set this policy setting,[removed: Windows][added: packaged Microsoft] Store apps will only use the static Content URI Rules.
- Renamed Turn on dynamic Content URI Rules for
-
Computer · Windows Components\Data Collection and Preview Builds
- Description
This policy [added: is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows.
This policy ]setting configures an Azure Active Directory joined device so that Microsoft is …
Whole description, marked
This policy [added: is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows. This policy ]setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at https://go.microsoft.com/fwlink/?linkid=2185086. To enable this behavior: 1. Enable this policy setting 2. Join an Azure Active Directory account to the device 3. Set Allow Telemetry to value 1 - Required, or higher When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. If you disable or do not configure this policy setting, devices enrolled to the Windows Update for Business deployment service will not be able to take advantage of some deployment service features.
- Supported on At least Windows Server 2016, Windows 10 Version 1
[removed: 9][added: 8]09 - Supported on windows:SUPPORTED_Windows_10_0_RS
[removed: 7][added: 5]; resolved; AnyOf; products:MicrosoftWindows [13, ]
- Description
This policy [added: is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows.
This policy ]setting configures an Azure Active Directory joined device so that Microsoft is …
-
Computer · Windows Components\Delivery Optimization
- Description
[removed: Set this policy to restrict peer selectio…][added: Specifies the source of group ID used for…]1 = AD Site[removed: . ]2 = Authenticated domain SID[removed: . ]3 = DHCP Option ID[removed: . ]4 = DNS Suffix[removed: . ]5 = …Whole description, marked
[removed: Set this policy to restrict peer selection to a specific source. Options available are: ][added: Specifies the source of group ID used for peer selection. 0 = Not Set ]1 = AD Site[removed: . ]2 = Authenticated domain SID[removed: . ]3 = DHCP Option ID[removed: . ]4 = DNS Suffix[removed: . ]5 =[removed: AAD Tenant ID. When set, the Group ][added: Entra ]ID[removed: will be assigned automatically from the selected source. This policy is ignored if the GroupID policy is also set. The options set in this policy only apply to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. For option 3 - DHCP Option ID, the client will query DHCP Option ][added: Tenant ]ID[removed: 234 and use the returned GUID value as the Group ID.] - A choice in “Source of Group IDs” is renamed
[removed: Unset][added: Not Set] (0) (0)
- Description
-
Computer · Windows Components\Delivery Optimization
- Description
… the device can use across all concurrent download activities using Delivery Optimization.
[removed: The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. ]Whole description, marked
Specifies the maximum background download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization.
[removed: The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. ] - Editor controls or their defaults changed.
- Description
… the device can use across all concurrent download activities using Delivery Optimization.
-
Computer and user · Windows Components\Internet Explorer\Internet Control Panel\Advanced Page
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Only use SSL 2.0 (8)
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Use SSL 2.0 and SSL 3.0 (40)
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Use SSL 2.0 and TLS 1.0 (136)
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Use SSL 2.0, SSL 3.0, and TLS 1.0 (168)
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Use SSL 2.0 and TLS 1.1 (520)
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Use SSL 2.0, SSL 3.0, and TLS 1.1 (552)
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Use SSL 2.0, TLS 1.0, and TLS 1.1 (648)
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Use SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 (680)
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Use SSL 2.0 and TLS 1.2 (2056)
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Use SSL 2.0, SSL 3.0, and TLS 1.2 (2088)
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Use SSL 2.0, TLS 1.0, and TLS 1.2 (2184)
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Use SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.2 (2216)
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Use SSL 2.0, TLS 1.1, and TLS 1.2 (2568)
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Use SSL 2.0, SSL 3.0, TLS 1.1, and TLS 1.2 (2600)
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Use SSL 2.0, TLS 1.0, TLS 1.1, and TLS 1.2 (2696)
- A choice in “Secure Protocol combinations” is renamed [added: [Obsolete] ]Use SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, and TLS 1.2 (2728)
- “Secure Protocol combinations” gains the choice [added: Only use TLS 1.3 (8192)]
- “Secure Protocol combinations” gains the choice [added: Use TLS 1.2 and TLS 1.3 (10240)]
- “Secure Protocol combinations” gains the choice [added: Use TLS 1.1, TLS 1.2, and TLS 1.3 (10752)]
- “Secure Protocol combinations” gains the choice [added: Use TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3 (10880)]
- “Secure Protocol combinations” gains the choice [added: Use SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3 (10912)]
-
Computer · Windows Components\Delivery Optimization
- Description
… each file is held in the Delivery Optimization cache after downloading successfully.
[removed: The value 0 (zero) means "unlimited"; Delivery Optimization will hold the files in the cache longer and make the files available for uploads to other devices, as long as the cache size has not exceeded.]Whole description, marked
Specifies the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully.
[removed: The value 0 (zero) means "unlimited"; Delivery Optimization will hold the files in the cache longer and make the files available for uploads to other devices, as long as the cache size has not exceeded.] - Editor controls or their defaults changed.
- Description
… each file is held in the Delivery Optimization cache after downloading successfully.
- Computer and user · Windows Components\Internet Explorer
-
Computer · Windows Components\Delivery Optimization
- Description
Specifies the maximum cache size that Delivery Optimization
[removed: uses][added: can utilize,] as a percentage of [added: the ]available[removed: disk size (1-100).][added: drive space.]Whole description, marked
Specifies the maximum cache size that Delivery Optimization
[removed: uses][added: can utilize,] as a percentage of [added: the ]available[removed: disk size (1-100).][added: drive space.] - Editor controls or their defaults changed.
- Description
Specifies the maximum cache size that Delivery Optimization
-
Computer · Windows Components\Delivery Optimization
- Description
… the device can use across all concurrent download activities using Delivery Optimization.
[removed: The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. ]Whole description, marked
Specifies the maximum foreground download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization.
[removed: The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. ] - Editor controls or their defaults changed.
- Description
… the device can use across all concurrent download activities using Delivery Optimization.
-
Computer · Windows Components\Delivery Optimization
- Description
Specifies the minimum download QoS (Quality of
[removed: Service or speed)][added: Service) in KiloBytes/sec] for background[removed: downloads in KiloBytes/second. This policy affects the blending of peer and HTTP sources. Delivery Optimization complements the download from HTTP source to achieve the specified minimum QoS value.][added: downloads.]Whole description, marked
Specifies the minimum download QoS (Quality of
[removed: Service or speed)][added: Service) in KiloBytes/sec] for background[removed: downloads in KiloBytes/second. This policy affects the blending of peer and HTTP sources. Delivery Optimization complements the download from HTTP source to achieve the specified minimum QoS value.][added: downloads.] - Editor controls or their defaults changed.
- Description
Specifies the minimum download QoS (Quality of
-
Computer · Windows Components\Delivery Optimization
- Description
[removed: Specify any value between 1 and 100 (in percentage) to allow ][added: Specifies ]the[removed: device to upload data to LAN and Group peers while on DC power (Battery). The recommended value ][added: minimum battery level required for uploading ]to[removed: set if you allow uploads on battery is 40 (for 40%). The device can download from peers ][added: peers, ]while on battery[removed: regardless of this policy. The value 0 means "not-limited"; The cloud service set default value will be used.][added: power.]Whole description, marked
[removed: Specify any value between 1 and 100 (in percentage) to allow ][added: Specifies ]the[removed: device to upload data to LAN and Group peers while on DC power (Battery). The recommended value ][added: minimum battery level required for uploading ]to[removed: set if you allow uploads on battery is 40 (for 40%). The device can download from peers ][added: peers, ]while on battery[removed: regardless of this policy. The value 0 means "not-limited"; The cloud service set default value will be used.][added: power.] - Editor controls or their defaults changed.
- Description
-
Computer · Windows Components\Delivery Optimization
- Renamed Minimum disk size allowed to use
[removed: Peer Caching][added: P2P] (in GB) - Description
Specifies the required minimum [added: total ]disk size
[removed: (capacity ]in[removed: GB)][added: GB] for the device to use[removed: Peer Caching. The cloud service set default value will be used. Recommended values: 64 GB to 256 GB. Note: If the DOModifyCacheDrive policy is set, the disk size check will apply to the new working directory specified by this policy.][added: P2P.]Whole description, marked
Specifies the required minimum [added: total ]disk size
[removed: (capacity ]in[removed: GB)][added: GB] for the device to use[removed: Peer Caching. The cloud service set default value will be used. Recommended values: 64 GB to 256 GB. Note: If the DOModifyCacheDrive policy is set, the disk size check will apply to the new working directory specified by this policy.][added: P2P.] - Option “Minimum disk size allowed to use P2P (in GB)” Minimum disk size allowed to use
[removed: Peer Caching][added: P2P] (in GB) - Editor controls or their defaults changed.
- Renamed Minimum disk size allowed to use
- Computer · System\LAPS
-
Computer · Windows Components\Delivery Optimization
- Renamed Minimum
[removed: Peer Caching][added: P2P] Content File Size (in MB) - Description
Specifies the minimum content file size in MB
[removed: enabled][added: eligible] to use[removed: Peer Caching. Recommended values: 1 MB to 100000 MB.][added: P2P.]Whole description, marked
Specifies the minimum content file size in MB
[removed: enabled][added: eligible] to use[removed: Peer Caching. Recommended values: 1 MB to 100000 MB.][added: P2P.] - Option “Minimum P2P Content File Size (in MB)” Minimum
[removed: Peer Caching][added: P2P] Content File Size (in MB) - Editor controls or their defaults changed.
- Renamed Minimum
- Computer · System\LAPS
-
Computer · Windows Components\Delivery Optimization
- Renamed Minimum RAM capacity (inclusive) required to enable use of
[removed: Peer Caching][added: P2P] (in GB) - Description
Specifies the minimum [added: total ]RAM size in GB required to use
[removed: Peer Caching. For example if the minimum set is 1 GB, then devices with 1 GB or higher available RAM will be allowed to use Peer caching. Recommended values: 1 GB to 4 GB.][added: P2P.]Whole description, marked
Specifies the minimum [added: total ]RAM size in GB required to use
[removed: Peer Caching. For example if the minimum set is 1 GB, then devices with 1 GB or higher available RAM will be allowed to use Peer caching. Recommended values: 1 GB to 4 GB.][added: P2P.] - Option “Minimum RAM capacity (inclusive) required to enable use of P2P (in GB)” Minimum RAM capacity (inclusive) required to enable use of
[removed: Peer Caching][added: P2P] (in GB) - Editor controls or their defaults changed.
- Renamed Minimum RAM capacity (inclusive) required to enable use of
- Computer · System\LAPS