Windows 11: 22H2 · 3.0 to 25H2 · 1.0

Specifies if the DNS client would use the DDR protocol. The Discovery of Designated Resolvers (DDR) protocol allows Windows to move from unencrypted DNS to encrypted DNS when only the IP address of a resolver is known. If you enable this policy, the DNS client will use the DDR protocol. If you disable this policy setting, or if you do not configure this policy setting, [removed: computers][added: the DNS client] will use locally configured settings.

Specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth.[removed: The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads.]

Specifies if the DNS client will perform name resolution over [removed: DNS over HTTPS (DoH).][added: encrypted protocols.] By default, the DNS client will do classic DNS name resolution (over UDP or [removed: TCP).][added: TCP port 53).] This setting can enhance the DNS client to use [removed: DoH protocol][added: encrypted protocols] to resolve domain names. To use this policy setting, click Enabled, and then select one of the following options from the drop-down list: Prohibit [removed: DoH: No DoH][added: encryption: no encrypted] name resolution will be performed. Allow [removed: DoH: Perform DoH queries][added: encryption: Use encrypted name resolution] if the configured [removed: DNS ]servers support it. If they don't support it, try classic name resolution. Require [removed: DoH:][added: encryption:] Allow only [removed: DoH][added: encrypted] name resolution. If there are no [removed: DoH capable ][added: configured ]DNS servers [removed: configured,][added: that handle encryption,] name resolution will fail. [added: In addition to the generic encryption policy, additional policies can be configured at the individual protocol level. For example, in order to force DoT name resolution only, a combination of "Require encryption" and "Block DoH" would be needed (vice versa to force DoH). For the example above, it is the admin's responsibility to ensure that if DoT is forced, there are valid DoT servers configured on the machine (vice versa for DoH). ]If you disable this policy setting, or if you do not configure this policy setting, [removed: computers][added: the DNS client] will use locally configured settings. DDR (Discovery of Designated Resolvers) plaintext traffic [removed: is][added: will be] allowed as it is necessary for auto-discovering [removed: DoH][added: encryption] settings.

[removed: Set this policy ][added: Specifies ]to restrict peer selection [removed: via][added: using the] selected [removed: option. Options available are: ][added: method, in addition to the DownloadMode policy. ]0 = [removed: NAT.][added: None] 1 = Subnet mask[removed: .] 2 = Local discovery [removed: (DNS-SD). The default value has changed from 0 (no restriction) to 1 (restrict to the subnet). These options apply to both Download Mode LAN (1) and Group (2).][added: (DNS-SD)]

This policy setting allows you to prevent Windows from [removed: retrieving device metadata from the Internet. ][added: downloading applications associated with device metadata. ]If you enable this policy setting, Windows does not [removed: retrieve][added: download applications associated with] device metadata for installed [removed: devices from the Internet. ][added: devices. ]This policy setting overrides the setting in the Device Installation Settings dialog box (Control Panel > System and Security > System > Advanced System Settings > Hardware tab). If you disable or do not configure this policy setting, the setting in the Device Installation Settings dialog box controls whether Windows [removed: retrieves device metadata from the Internet.][added: downloads applications associated with device metadata.]

Prevent the "accessibility" group from syncing to and from this PC. This turns off and disables the "accessibility" group on the "Windows backup" settings page in PC settings. If you enable this policy setting, the "accessibility"[removed: ,] group will not be synced. Use the option "Allow users to turn accessibility syncing on" so that syncing is turned off by default but not disabled. If you do not set or disable this setting, syncing of the "accessibility" group is on by default and configurable by the user.

Prevent the "language preferences" group from syncing to and from this PC. This turns off and disables the "languages preferences" group on the "Windows backup" settings page in PC settings. If you enable this policy setting, the "language preferences"[removed: ,] group will not be synced. Use the option "Allow users to turn language preferences syncing on" so that syncing is turned off by default but not disabled. If you do not set or disable this setting, syncing of the "language preferences" group is on by default and configurable by the user.

This policy setting specifies whether JScript or JScript9Legacy is [removed: loaded for MSHTML/WebOC/MSXML/Cscript based invocations.][added: loaded.] If you enable this policy [removed: setting,][added: setting or not configured,] JScript9Legacy will be loaded in situations where JScript is instantiated. If you disable this policy, then JScript will be utilized.[removed: If this policy is left unconfigured, then MSHTML will use JScript9Legacy and MSXML/Cscript will use JScript.]

This policy controls the configuration under which LSASS is run. If you do not configure this policy and there is no current setting in the registry, LSA will run as protected process for [added: all ]clean installed, HVCI capable, client [removed: SKUs that are domain or cloud domain joined devices.][added: SKUs.] This configuration is not UEFI locked. This can be overridden if the policy is configured. If you configure and set this policy setting to "Disabled", LSA will not run as a protected process. If you configure and set this policy setting to "EnabledWithUEFILock," LSA will run as a protected process and this configuration is UEFI locked. If you configure and set this policy setting to "EnabledWithoutUEFILock", LSA will run as a protected process and this configuration is not UEFI locked.

This policy setting allows users to see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you enable this policy setting, users will see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you disable this policy setting, users won’t see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you don’t configure this policy setting, the default setting for the user’s device will be used, and the user can choose to change it.

This policy setting allows you to specify which protocols can be used for Remote Desktop Protocol (RDP) access to this server. If you enable this policy setting, you must specify if you would like RDP to use UDP. You can select one of the following options: "Use [removed: both][added: either] UDP [removed: and TCP", "Use only TCP" ][added: or TCP (default)" ]or "Use [removed: either UDP or TCP (default)"][added: only TCP"] If you select "Use either UDP or TCP" and the UDP connection is successful, most of the RDP traffic will use UDP. If the UDP connection is not successful or if you select "Use only TCP," all of the RDP traffic will use TCP. If you disable or do not configure this policy setting, RDP will choose the optimal protocols for delivering the best user experience.

Disabled (Default): If Not Configured or Disabled, [removed: network protection is not allowed to ][added: datagram processing will ]be [removed: configured into block or audit mode on Windows Server.][added: enabled for network protection.] Enabled: If Enabled, [removed: administrators can control whether Network Protection is allowed to be configured into block or audit mode on Windows Server. Note, that this configuration is dependent on the EnableNetworkProtection configuration. If this configuration is false, EnableNetworkProtection ][added: datagram processing ]will be [removed: ignored, otherwise][added: disabled for] network [removed: protection will start on Windows Server depending on the value of EnableNetworkProtection.][added: protection.]