ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 07:25 UTC Customize Public modeDiscuss ChangeIntel on Discord
release15 Jul 2024 to 29 Sep 2025

Windows 11: 22H2 · 3.0 to 25H2 · 1.0

126 new settings, 75 changed, 1 removed since 22H2 · 3.0. 3 retained releases apart.

CSVJSONBrowse its 3,621 settings Vendor download page

Changes that matter

202 settings · compared with 22H2 · 3.0
  • Enable remote mailslotsNew
    Computer · Network\Lanman Server
  • Enable SMB over QUICNew
    Computer · Network\Lanman Server
  • Mandate the maximum version of SMBNew
    Computer · Network\Lanman Server
  • Mandate the minimum version of SMBNew
    Computer · Network\Lanman Server
  • Alternative Port MappingsNew
    Computer · Network\Lanman Workstation
  • Audit insecure guest logonNew
    Computer · Network\Lanman Workstation
  • Audit server does not support encryptionNew
    Computer · Network\Lanman Workstation
  • Audit server does not support signingNew
    Computer · Network\Lanman Workstation
  • Block NTLM (LM, NTLM, NTLMv2)New
    Computer · Network\Lanman Workstation
  • Enable Alternative PortsNew
    Computer · Network\Lanman Workstation
  • Enable remote mailslotsNew
    Computer · Network\Lanman Workstation
  • Mandate the maximum version of SMBNew
    Computer · Network\Lanman Workstation
  • Mandate the minimum version of SMBNew
    Computer · Network\Lanman Workstation
  • Require EncryptionNew
    Computer · Network\Lanman Workstation
  • Configures LSASS to run as a protected process
    Computer · System\Local Security Authority
    • Description … current setting in the registry, LSA will run as protected process for [added: all ]clean installed, HVCI capable, client [removed: SKUs that are domain or cloud domain joined devices.][added: SKUs.] This configuration is not UEFI locked. This can be overridden if the …
      Whole description, marked

      This policy controls the configuration under which LSASS is run. If you do not configure this policy and there is no current setting in the registry, LSA will run as protected process for [added: all ]clean installed, HVCI capable, client [removed: SKUs that are domain or cloud domain joined devices.][added: SKUs.] This configuration is not UEFI locked. This can be overridden if the policy is configured. If you configure and set this policy setting to "Disabled", LSA will not run as a protected process. If you configure and set this policy setting to "EnabledWithUEFILock," LSA will run as a protected process and this configuration is UEFI locked. If you configure and set this policy setting to "EnabledWithoutUEFILock", LSA will run as a protected process and this configuration is not UEFI locked.

    • The policy's own registry value [was: System\CurrentControlSet\Control\Lsa][now: Software\Policies\Microsoft\Windows\System]
    • Option “Configure LSA to run as a protected process” writes [was: System\CurrentControlSet\Control\Lsa\RunAsPPL][now: Software\Policies\Microsoft\Windows\System\RunAsPPL]
  • Block NetBIOS-based discovery for domain controller locationNew
    Computer · System\Net Logon\DC Locator DNS Records
  • Turn off toast notifications
    Computer and user · Start Menu and Taskbar\Notifications
    • Applies to [was: User][now: Both]
  • Configure RPC packet level privacy setting for incoming connectionsNew
    Computer · Printers
  • Allow Screen RecorderNew
    User · Windows Components\Snipping Tool
  • Configure SAM change password RPC methods policyNew
    Computer · System\Security Account Manager
  • Specify settings for optional component installation and component repair
    Computer · System
    • Option removed [removed: Never attempt to download payload from Windows Update (CheckBox_NeverUseWU)]
    • Option removed [removed: Download repair content and optional features directly from Windows Update instead of Windows Server Update Services (WSUS) (CheckBox_SidestepWSUS)]
    • Editor controls or their defaults changed.
  • Configure Windows Defender SmartScreen
    Computer and user · Windows Components\Windows Defender SmartScreen\Microsoft Edge
    • The policy's own registry value [was: Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter\EnabledV9][now: Software\Policies\Microsoft\Edge\SmartScreenEnabled]
    • Option removed [removed: EnabledV9]
    • New option [added: SmartScreenEnabled]
  • Prevent bypassing Windows Defender SmartScreen prompts for sites
    Computer and user · Windows Components\Windows Defender SmartScreen\Microsoft Edge
    • The policy's own registry value Software\Policies\Microsoft\[removed: MicrosoftEdge\PhishingFilter][added: Edge]\PreventOverride
    • Option removed [removed: PreventOverride]
    • New option [added: PreventOverride]
  • Remove Personalized Website Recommendations from the Recommended section in the Start Menu
    Computer and user · Start Menu and Taskbar
    • Supported on [removed: At least ]Windows 11 [removed: Version 22H2][added: SE]
    • Supported on windows:SUPPORTED_Windows_11_0_[removed: 22H2][added: SE]; resolved; AnyOf; products:MicrosoftWindows [16, [removed: ]][added: 16]]
  • Prevent users from customizing their Start Screen
    Computer and user · Start Menu and Taskbar
    • Applies to [was: User][now: Both]
  • Remove Notifications and Action Center
    Computer and user · Start Menu and Taskbar
    • Applies to [was: User][now: Both]
  • Show packaged Microsoft Store apps on the taskbar
    User · Start Menu and Taskbar
    • Renamed Show [removed: Windows][added: packaged Microsoft] Store apps on the taskbar
    • Description This policy setting allows users to see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you enable this policy setting, users will see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you disable this policy setting, users won’t see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you don’t configure this policy setting, …
      Whole description, marked

      This policy setting allows users to see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you enable this policy setting, users will see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you disable this policy setting, users won’t see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you don’t configure this policy setting, the default setting for the user’s device will be used, and the user can choose to change it.

  • Restrict clipboard transfer from client to serverNew
    Computer and user · Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection
  • Restrict clipboard transfer from server to clientNew
    Computer and user · Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection
  • Disconnect remote session on lock for Microsoft identity platform authenticationNew
    Computer · Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 21 Oct 07:25 UTC · 258 of 260 readable · 257 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.