ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 01:58 UTC Customize Public modeDiscuss ChangeIntel on Discord
release15 Jul 2024 to 30 Sep 2024

Windows 11: 22H2 · 3.0 to 24H2 · 1.0

85 new settings, 50 changed, 1 removed since 22H2 · 3.0. 2 retained releases apart.

CSVJSONBrowse its 3,580 settings Vendor download page

Changes that matter

136 settings · compared with 22H2 · 3.0
  • Enable remote mailslotsNew
    Computer · Network\Lanman Workstation
  • Enable SMB over QUICNew
    Computer · Network\Lanman Workstation
  • Mandate the maximum version of SMBNew
    Computer · Network\Lanman Workstation
  • Mandate the minimum version of SMBNew
    Computer · Network\Lanman Workstation
  • Require EncryptionNew
    Computer · Network\Lanman Workstation
  • Configures LSASS to run as a protected process
    Computer · System\Local Security Authority
    • Description … current setting in the registry, LSA will run as protected process for [added: all ]clean installed, HVCI capable, client [removed: SKUs that are domain or cloud domain joined devices.][added: SKUs.] This configuration is not UEFI locked. This can be overridden if the …
      Whole description, marked

      This policy controls the configuration under which LSASS is run. If you do not configure this policy and there is no current setting in the registry, LSA will run as protected process for [added: all ]clean installed, HVCI capable, client [removed: SKUs that are domain or cloud domain joined devices.][added: SKUs.] This configuration is not UEFI locked. This can be overridden if the policy is configured. If you configure and set this policy setting to "Disabled", LSA will not run as a protected process. If you configure and set this policy setting to "EnabledWithUEFILock," LSA will run as a protected process and this configuration is UEFI locked. If you configure and set this policy setting to "EnabledWithoutUEFILock", LSA will run as a protected process and this configuration is not UEFI locked.

    • The policy's own registry value [was: System\CurrentControlSet\Control\Lsa][now: Software\Policies\Microsoft\Windows\System]
    • Option “Configure LSA to run as a protected process” writes [was: System\CurrentControlSet\Control\Lsa\RunAsPPL][now: Software\Policies\Microsoft\Windows\System\RunAsPPL]
  • Disable caching of the Windows Hello for Business credential after sign-inNew
    Computer · Windows Components\Windows Hello for Business
  • Block NetBIOS-based discovery for domain controller locationNew
    Computer · System\Net Logon\DC Locator DNS Records
  • Turn off toast notifications
    Computer and user · Start Menu and Taskbar\Notifications
    • Applies to [was: User][now: Both]
  • Configure RPC packet level privacy setting for incoming connectionsNew
    Computer · Printers
  • Configure Windows protected printNew
    Computer · Printers
  • Allow Screen RecorderNew
    User · Windows Components\Snipping Tool
  • Configure SAM change password RPC methods policyNew
    Computer · System\Security Account Manager
  • Specify settings for optional component installation and component repair
    Computer · System
    • Option removed [removed: Never attempt to download payload from Windows Update (CheckBox_NeverUseWU)]
    • Option removed [removed: Download repair content and optional features directly from Windows Update instead of Windows Server Update Services (WSUS) (CheckBox_SidestepWSUS)]
    • Editor controls or their defaults changed.
  • Configure Windows Defender SmartScreen
    Computer and user · Windows Components\Windows Defender SmartScreen\Microsoft Edge
    • The policy's own registry value [was: Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter\EnabledV9][now: Software\Policies\Microsoft\Edge\SmartScreenEnabled]
    • Option removed [removed: EnabledV9]
    • New option [added: SmartScreenEnabled]
  • Prevent bypassing Windows Defender SmartScreen prompts for sites
    Computer and user · Windows Components\Windows Defender SmartScreen\Microsoft Edge
    • The policy's own registry value Software\Policies\Microsoft\[removed: MicrosoftEdge\PhishingFilter][added: Edge]\PreventOverride
    • Option removed [removed: PreventOverride]
    • New option [added: PreventOverride]
  • Remove Personalized Website Recommendations from the Recommended section in the Start Menu
    Computer and user · Start Menu and Taskbar
    • Supported on [removed: At least ]Windows 11 [removed: Version 22H2][added: SE]
    • Supported on windows:SUPPORTED_Windows_11_0_[removed: 22H2][added: SE]; resolved; AnyOf; products:MicrosoftWindows [16, [removed: ]][added: 16]]
  • Prevent users from customizing their Start Screen
    Computer and user · Start Menu and Taskbar
    • Applies to [was: User][now: Both]
  • Remove Notifications and Action Center
    Computer and user · Start Menu and Taskbar
    • Applies to [was: User][now: Both]
  • Show packaged Microsoft Store apps on the taskbar
    User · Start Menu and Taskbar
    • Renamed Show [removed: Windows][added: packaged Microsoft] Store apps on the taskbar
    • Description This policy setting allows users to see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you enable this policy setting, users will see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you disable this policy setting, users won’t see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you don’t configure this policy setting, …
      Whole description, marked

      This policy setting allows users to see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you enable this policy setting, users will see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you disable this policy setting, users won’t see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you don’t configure this policy setting, the default setting for the user’s device will be used, and the user can choose to change it.

  • Restrict clipboard transfer from client to serverNew
    Computer and user · Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection
  • Restrict clipboard transfer from server to clientNew
    Computer and user · Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection
  • Disconnect remote session on lock for Microsoft identity platform authenticationNew
    Computer · Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security
  • Disconnect remote session on lock for legacy authenticationNew
    Computer · Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security
  • Select RDP transport protocols
    Computer · Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections
    • Description … to use UDP. You can select one of the following options: "Use [removed: both][added: either] UDP [removed: and TCP", "Use only TCP" ][added: or TCP (default)" ]or "Use [removed: either UDP or TCP (default)"][added: only TCP"] If you select "Use either UDP or TCP" and the UDP connection …
      Whole description, marked

      This policy setting allows you to specify which protocols can be used for Remote Desktop Protocol (RDP) access to this server. If you enable this policy setting, you must specify if you would like RDP to use UDP. You can select one of the following options: "Use [removed: both][added: either] UDP [removed: and TCP", "Use only TCP" ][added: or TCP (default)" ]or "Use [removed: either UDP or TCP (default)"][added: only TCP"] If you select "Use either UDP or TCP" and the UDP connection is successful, most of the RDP traffic will use UDP. If the UDP connection is not successful or if you select "Use only TCP," all of the RDP traffic will use TCP. If you disable or do not configure this policy setting, RDP will choose the optimal protocols for delivering the best user experience.

    • “Select Transport Type” loses the choice [removed: Use both UDP and TCP (0)]
  • Do not allow WebAuthn redirection
    Computer · Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection
    • Supported on At least Windows Server [removed: 2019 Version 2004,][added: 2019,] Windows 10 Version 2004
  • Allow access to BitLocker-protected fixed data drives from earlier versions of Windows
    Computer · Windows Components\BitLocker Drive Encryption\Fixed Data Drives
    • Supported on At least Windows Server 2008 R2 or Windows 7[added: through Windows Server 2022 or Windows 11 Version 22H2]
    • Supported on windows:SUPPORTED_Windows7[added: To1122H2]; resolved; [removed: AnyOf; products:MicrosoftWindows [6, ]; products:WindowsServer2008 [1, ]][added: Blank; ]
  • Allow access to BitLocker-protected removable data drives from earlier versions of Windows
    Computer · Windows Components\BitLocker Drive Encryption\Removable Data Drives
    • Supported on At least Windows Server 2008 R2 or Windows 7[added: through Windows Server 2022 or Windows 11 Version 22H2]
    • Supported on windows:SUPPORTED_Windows7[added: To1122H2]; resolved; [removed: AnyOf; products:MicrosoftWindows [6, ]; products:WindowsServer2008 [1, ]][added: Blank; ]
  • Turn off Saving Snapshots for WindowsNew
    User · Windows Components\Windows AI
  • Turn on asynchronous inspectionNew
    Computer · Windows Components\Microsoft Defender Antivirus\Network Inspection System
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 21 Oct 01:58 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.