Windows 11: 22H2 · 1.0 to 25H2 · 1.0

Specifies the drive [added: that ]Delivery Optimization [removed: shall][added: should] use for its[removed: cache. By default, %SystemDrive% is used to store the] cache. The drive location can be specified using environment variables, drive letter or using a full path.

This policy setting determines if the SMB client will allow insecure guest logons to an SMB server. If you enable this policy setting or if you do not configure this policy setting, the SMB client will allow insecure guest logons. If you disable this policy setting, the SMB client will reject insecure guest logons. [added: If you enable signing, the SMB client will reject insecure guest logons. ]Insecure guest logons are used by file servers to allow unauthenticated access to shared folders. While uncommon in an enterprise environment, insecure guest logons are frequently used by consumer Network Attached Storage (NAS) appliances acting as file servers. Windows file servers require authentication and do not use insecure guest logons by default. Since insecure guest logons are unauthenticated, important security features such as SMB Signing and SMB Encryption are disabled. As a result, clients that allow insecure guest logons are vulnerable to a variety of man-in-the-middle attacks that can result in data loss, data corruption, and exposure to malware. Additionally, any data written to a file server using an insecure guest logon is potentially accessible to anyone on the network. Microsoft recommends disabling insecure guest logons and configuring file servers to require authenticated access."

Enhanced Sign-in Security [added: (ESS) ]isolates Windows Hello biometric (face and fingerprint) template data and matching operations to trusted hardware or specified memory regions, meaning the rest of the operating system cannot access or tamper with them. Because the channel of communication between the sensors and the algorithm is also secured, it is impossible for malware to inject or replay data in order to simulate a user signing in or to lock a user out of their machine.[removed: While this policy is enabled on Windows 11 devices, external biometric authentication with Windows Hello will be blocked. Any non-authentication operational functionalities such as camera usage will be unaffected. ][added: ]If you enable this policy then it can have following possible values: 0 - Enhanced Sign-in Security [removed: Disabled (not recommended) Enhanced sign-in security ][added: disabled with peripheral sensors ESS ]will be disabled on [removed: all systems, enabling the use of external biometric authentication. If a user has enrolled in ][added: systems with capable software and hardware. Authentication operations of peripheral ]Windows Hello [removed: with Enhanced Sign-in Security enabled, when the feature gets disabled, they ][added: capable devices ]will [removed: lose their enrollment and must reset PIN. At that point they will have the option ][added: be allowed, subject ]to [removed: re-enroll in biometrics. OS will not attempt to start secure components, even if the secure hardware and software components are present.][added: current feature limitations.] 1 - Enhanced Sign-in Security [removed: Enabled (default and recommended for highest security) Enhanced sign-in security ][added: enabled without peripheral sensors (default and recommended) ESS ]will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of any [added: peripheral ]biometric device [removed: that Enhanced Sign-in Security does not support, including that of peripheral devices, ]will be blocked and not available for Windows Hello. If you disable or not configure this policy then [removed: Enhanced Sign-in Security is preferred on the device. The behavior ][added: non-ESS sensors ]will be [removed: same as enabling ][added: blocked on ]the [removed: policy and setting value to 1. ][added: ESS device. ]

Specifies that [removed: computers][added: the DNS client] may attach suffixes to an unqualified multi-label name before sending subsequent DNS queries if the original name query fails. A name containing dots, but not dot-terminated, is called an unqualified multi-label name, for example "server.corp" is an unqualified multi-label name. The name "server.corp.contoso.com." is an example of a fully qualified name because it contains a terminating dot. For example, if attaching suffixes is allowed, an unqualified multi-label name query for "server.corp" will be queried by the DNS client first. If the query succeeds, the response is returned to the client. If the query fails, the unqualified multi-label name is appended with DNS suffixes. These suffixes can be derived from a combination of the local DNS client's primary domain suffix, a connection-specific domain suffix, and a DNS suffix search list. If attaching suffixes is allowed, and a DNS client with a primary domain suffix of "contoso.com" performs a query for "server.corp" the DNS client will send a query for "server.corp" first, and then a query for "server.corp.contoso.com." second if the first query fails. If you enable this policy setting, suffixes are allowed to be appended to an unqualified multi-label name if the original name query fails. If you disable this policy setting, no suffixes are appended to unqualified multi-label name queries if the original name query fails. If you do not configure this policy setting, [removed: computers][added: the DNS client] will use [removed: their][added: its] local[removed: DNS client] settings to determine the query behavior for unqualified multi-label names.

Specifies a connection-specific DNS suffix. This policy setting supersedes local connection-specific DNS suffixes, and those configured using DHCP. To use this policy setting, click Enabled, and then enter a string value representing the DNS suffix. If you enable this policy setting, the DNS suffix that you enter will be applied to all network connections used by [removed: computers that receive this policy setting.][added: the DNS client.] If you disable this policy setting, or if you do not configure this policy setting, [removed: computers][added: the DNS client] will use the local or DHCP supplied connection specific DNS suffix, if configured.

Specifies if the devolution level that DNS clients will use if they perform primary DNS suffix devolution during the name resolution process. With devolution, a DNS client creates queries by appending a single-label, unqualified domain name with the parent suffix of the primary DNS suffix name, and the parent of that suffix, and so on, stopping if the name is successfully resolved or at a level determined by devolution settings. Devolution can be used when a user or application submits a query for a single-label domain name. The DNS client appends DNS suffixes to the single-label, unqualified domain name based on the state of the Append primary and connection specific DNS suffixes radio button and Append parent suffixes of the primary DNS suffix check box on the DNS tab in Advanced TCP/IP Settings for the Internet Protocol (TCP/IP) Properties dialog box. Devolution is not enabled if a global suffix search list is configured using Group Policy. If a global suffix search list is not configured, and the Append primary and connection specific DNS suffixes radio button is selected, the DNS client appends the following names to a single-label name when it sends DNS queries: The primary DNS suffix, as specified on the Computer Name tab of the System control panel. Each connection-specific DNS suffix, assigned either through DHCP or specified in the DNS suffix for this connection box on the DNS tab in the Advanced TCP/IP Settings dialog box for each connection. For example, when a user submits a query for a single-label name such as "example," the DNS client attaches a suffix such as "microsoft.com" resulting in the query "example.microsoft.com," before sending the query to a DNS server. If a DNS suffix search list is not specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the primary DNS suffix of the [removed: computer][added: DNS client] (drops the leftmost label of the primary DNS suffix), attaches this devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server. For example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the non-dot-terminated single-label name "example," and the DNS query for example.ooo.aaa.microsoft.com fails, the DNS client devolves the primary DNS suffix (drops the leftmost label) till the specified devolution level, and submits a query for example.aaa.microsoft.com. If this query fails, the primary DNS suffix is devolved further if it is under specified devolution level and the query example.microsoft.com is submitted. If this query fails, devolution continues if it is under specified devolution level and the query example.microsoft.com is submitted, corresponding to a devolution level of two. The primary DNS suffix cannot be devolved beyond a devolution level of two. The devolution level can be configured using this policy setting. The default devolution level is two. If you enable this policy setting and DNS devolution is also enabled, DNS clients use the DNS devolution level that you specify. If this policy setting is disabled, or if this policy setting is not configured, DNS clients use the default devolution level of two provided that DNS devolution is enabled.

Specifies whether the DNS client should convert internationalized domain names (IDNs) to Punycode when the [removed: computer][added: DNS client] is on non-domain networks with no WINS servers configured. If this policy setting is enabled, IDNs are not converted to Punycode. If this policy setting is disabled, or if this policy setting is not configured, IDNs are converted to Punycode when the [removed: computer][added: DNS client] is on non-domain networks with no WINS servers configured.

Per Process System DPI is an application compatibility feature for desktop applications that do not render properly after a display-scale factor (DPI) change. When the display scale factor of the primary display changes (which can happen when you connect or disconnect a display that has a different display scale factor (DPI), connect remotely from a device with a different display scale factor, or manually change the display scale factor), many desktop applications can display blurry. Desktop applications that have not been updated to display properly in this scenario will be blurry until the user logs out and back in to Windows.[removed: ][added: ]When you enable this policy some blurry applications will be crisp after they are restarted, without requiring the user to log out and back in to Windows.[removed: ][added: ]Be aware of the following: Per Process System DPI will only improve the rendering of desktop applications that are positioned on the primary display. Some desktop applications can still be blurry on secondary displays that have different display scale factors.[removed: ][added: ]Per Process System DPI will not work for all applications as some older desktop applications will always be blurry on high DPI displays.[removed: ][added: ]In some cases, you may see some odd behavior in some desktop applications. If that happens, Per Process System DPI should be disabled. Enabling this setting lets you specify the system-wide default for desktop applications as well as per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system.

Defines the DNS servers to which [removed: a computer][added: the DNS client] sends queries when it attempts to resolve names. This policy setting supersedes the list of DNS servers configured locally and those configured using DHCP. To use this policy setting, click Enabled, and then enter a space-delimited list of IP addresses in the available field. To use this policy setting, you must enter at least one IP address. If you enable this policy setting, the list of DNS servers is applied to all network connections used by [removed: computers that receive this policy setting.][added: the DNS client.] If you disable this policy setting, or if you do not configure this policy setting, [removed: computers][added: the DNS client] will use the local or DHCP supplied list of DNS servers, if configured.

Specifies if the DNS client will perform name resolution over NetBIOS. By default, the DNS client will disable NetBIOS name resolution on public networks for security reasons. To use this policy setting, click Enabled, and then select one of the following options from the drop-down list: Disable NetBIOS name resolution: Never allow NetBIOS name resolution. Allow NetBIOS name resolution: Always allow NetBIOS name resolution. Disable NetBIOS name resolution on public networks: Only allow NetBIOS name resolution on network adapters which are not connected to public networks. NetBIOS learning mode: Always allow NetBIOS name resolution and use it as a fallback after mDNS/LLMNR queries fail. If you disable this policy setting, or if you do not configure this policy setting, [removed: computers][added: the DNS client] will use locally configured settings.

This policy lets you restrict launching of Internet Explorer as a standalone browser. If you enable this policy, it: - Prevents Internet Explorer 11 from launching as a standalone browser. - Restricts Internet Explorer's usage to Microsoft Edge's native 'Internet Explorer mode'. - Redirects [removed: all ]attempts at launching Internet Explorer 11 to Microsoft Edge Stable Channel browser. - Overrides any other policies that redirect to Internet Explorer 11.[added: Even with this policy enabled launching Internet Explorer 11 using COM automation will still be allowed. To disable COM automation launches of Internet Explorer 11 use the "Disable Internet Explorer 11 COM Automation" group policy.] If you disable, or don’t configure this policy, all sites are opened using the current active browser settings. Note: Microsoft Edge Stable Channel must be installed for this policy to take effect.

Specifies the primary DNS suffix used by [removed: computers][added: the DNS client] in DNS name registration and DNS name resolution. To use this policy setting, click Enabled and enter the entire primary DNS suffix you want to assign. For example: microsoft.com. Important: In order for changes to this policy setting to be applied on [removed: computers that receive it, ][added: the DNS client, ]you must restart Windows. If you enable this policy setting, it supersedes the primary DNS suffix configured in the DNS Suffix and NetBIOS Computer Name dialog box using the System control panel. You can use this policy setting to prevent users, including local administrators, from changing the primary DNS suffix. If you disable this policy setting, or if you do not configure this policy setting, [removed: each computer][added: the DNS client] uses [removed: its][added: the] local primary DNS suffix, which is usually the DNS name of Active Directory domain to which it is joined.

Specifies if [removed: a computer][added: the DNS client] performing dynamic DNS registration will register A and PTR resource records with a concatenation of its computer name and a connection-specific DNS suffix, in addition to registering these records with a concatenation of its computer name and the primary DNS suffix. By default, a DNS client performing dynamic DNS registration registers A and PTR resource records with a concatenation of its computer name and the primary DNS suffix. For example, a computer name of mycomputer and a primary DNS suffix of microsoft.com will be registered as: mycomputer.microsoft.com. If you enable this policy setting, [removed: a computer][added: the DNS client] will register A and PTR resource records with its connection-specific DNS suffix, in addition to the primary DNS suffix. This applies to all network connections used by [removed: computers that receive this policy setting.][added: the DNS client.] For example, with a computer name of mycomputer, a primary DNS suffix of microsoft.com, and a connection specific DNS suffix of VPNconnection, [removed: a computer][added: the DNS client] will register A and PTR resource records for mycomputer.VPNconnection and mycomputer.microsoft.com when this policy setting is enabled. Important: This policy setting is ignored [removed: on a][added: by the] DNS client [removed: computer ]if dynamic DNS registration is disabled. If you disable this policy setting, or if you do not configure this policy setting, [removed: a][added: the] DNS client[removed: computer] will not register any A and PTR resource records using a connection-specific DNS suffix.