Windows 11: 22H2 · 3.0 to 25H2 · 1.0

Configure this setting to control the specific user or group who is authorized to decrypt encrypted passwords. Configuring this setting has no effect unless password encryption has been enabled. If this setting is enabled, encrypted passwords will be decryptable by the specified group. If this setting is disabled or not configured, encrypted passwords will be decryptable by the Domain Admins group. This setting must be configured with either a [added: domain-qualified name of a group or user, or a ]SID in string [removed: format ("S-1-5-21-2127521184-1604012920-1887927527-35197") or the name of a group][added: format. Valid examples include: contoso\LAPSAdmins [email protected] S-1-5-21-2127521184-1604012920-1887927527-35197 Do not enclose the user\group name] or [removed: user][added: SID] in [removed: "domain\(group][added: enclosing quotes] or [removed: user)" format. ][added: parentheses. ]The specified user or group must be resolvable by the managed device, otherwise passwords will not be backed up.[added: NOTE: this setting is ignored when Directory Services Repair Mode (DSRM) account passwords are backed up on a domain controller. In that scenario, this setting always defaults to the Domain Admins group of the domain controller's domain.] See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.

Configures password parameters Password complexity: which characters are used when generating a new password Default: Large letters + small letters + numbers + special characters Password length Minimum: 8 characters Maximum: 64 characters Default: 14 characters Password age in days Minimum: 1 day (7 days when backup directory is configured to be Azure AD) Maximum: 365 days Default: 30 days [added: Passphrase length Minimum: 3 words Maximum: 10 words Default: 6 words ]See https://go.microsoft.com/fwlink/?linkid=2188435[added: for more information. Passphrase list taken from "Deep Dive: EFF's New Wordlists for Random Passphrases" by Electronic Frontier Foundation, and is used under a CC-BY-3.0 Attribution license. See https://go.microsoft.com/fwlink/?linkid=2255471] for more information.

This policy configures post-authentication actions which will be executed after detecting an authentication by the managed account. Grace period: specifies the amount of time (in hours) to wait after an authentication before executing the specified post-authentication actions. If this setting is enabled and greater than zero, the specified post-authentication actions will be executed upon expir[removed: y][added: ation] of the grace period. If this setting is disabled or not configured, the specified post-authentication actions will be executed after a default 24 hour grace period. If this setting is equal to zero, no post-authentication actions will be executed. Actions: specifies the actions to take upon expir[removed: y][added: ation] of the grace period. Reset password: upon expir[removed: y][added: ation] of the grace period, the managed account password [removed: will be ][added: is ]reset. Reset the password and logoff the managed account: upon expir[removed: y][added: ation] of the grace period, the managed account password [removed: will be][added: is reset and any interactive logon sessions using the managed account are logged off. Reset the password and reboot: upon expiration of the grace period, the managed account password is] reset and [added: the managed device is rebooted. Reset the password, logoff the managed account, and terminate ]any [added: remaining processes: upon expiration of the grace period, the managed account password is reset, any ]interactive logon sessions using the managed account [removed: will][added: are logged off, and any remaining processes are] terminated. (NOTE: after any interactive logon sessions are terminated there may still be other authenticated sessions in use by the managed account. The only robust way to ensure that the previous password is longer in use is to reboot the device.)[removed: Reset the password and reboot: upon expiry of the grace period, the managed account password will be reset and the managed device will be immediately rebooted.] If this setting is disabled or not configured, post-authentication actions will default to "Reset the password and logoff the managed account". Note: the DSRM account on domain controllers cannot be configured for post-authentication actions. This policy has no effect on domain controllers and will be ignored even if configured for a DC. See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.

This policy setting allows you to hide the TaskView button.[removed: ][added: ]If you enable this policy setting, the TaskView button will be hidden and the Settings toggle will be disabled.

Specifies the maximum size in GB of Delivery Optimization cache.[removed: ][added: ]This policy overrides the [removed: DO]MaxCacheSize policy.[removed: The value 0 (zero) means "unlimited" cache; Delivery Optimization will clear the cache when the device runs low on disk space.]

Turning off [removed: files from Office.com ][added: this setting ]will prevent File Explorer from requesting [removed: recent ]cloud file metadata and displaying it in the [removed: Quick access view.][added: homepage and other views in File Explorer. Any insights and files available based on account activity will be stopped in views such as Recent, Recommended, Favorites, Details pane, etc.]

[removed: Specify "true" to allow ][added: Specifies whether ]the [removed: device to participate in Peer Caching while connected via ][added: device, with an active ]VPN [removed: to the domain network. This means the device can download from or upload ][added: connection, is allowed ]to [removed: other domain network devices, either on VPN ][added: participate in P2P ]or [removed: on the corporate domain network.][added: not.]

[removed: This policy allows you to delay the use of an HTTP source in a ][added: For ]background download[added: s] that [removed: is allowed to ]use [removed: P2P. After the max delay has reached, ][added: P2P, specifies ]the [removed: download will resume using HTTP, either downloading the entire payload or complementing the bytes that could not be downloaded ][added: time to wait before starting to download ]from [removed: Peers. Note that a download that is waiting for peer sources, will appear to be stuck for ]the [removed: end user. The recommended value is 1 hour (3600).][added: HTTP source.]

[removed: Set this policy to delay the fallback from Cache Server to ][added: For background downloads that use a cache server, specifies ]the [removed: HTTP source for a background content download by X seconds. Note: if you set the policy ][added: time to wait before falling back ]to [removed: delay background ]download from [removed: http, it will apply first (to allow downloads from peers first).][added: the original HTTP source.]

[removed: Set this policy to delay the fallback from Cache Server to ][added: For foreground downloads that use a cache server, specifies ]the [removed: HTTP source for a foreground content download by X seconds. Note: if you set the policy ][added: time to wait before falling back ]to [removed: delay foreground ]download from [removed: http, it will apply first (to allow downloads from peers first).][added: the original HTTP source.]

[removed: This policy allows you to delay the use of an HTTP source in a ][added: For ]foreground [removed: (interactive) download ][added: downloads ]that [removed: is allowed to ]use [removed: P2P. After the max delay has reached, ][added: P2P, specifies ]the [removed: download will resume using HTTP, either downloading the entire payload or complementing the bytes that could not be downloaded ][added: time to wait before starting to download ]from [removed: Peers. Note that a download that is waiting for peer sources, will appear to be stuck for ]the [removed: end user. The recommended value is 1 minute (60).][added: HTTP source.]

This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all [removed: Windows][added: packaged Microsoft] Store apps that use the enterpriseAuthentication capability on a computer. If you enable this policy setting, you can define additional Content URI Rules that all [removed: Windows][added: packaged Microsoft] Store apps that use the enterpriseAuthentication capability on a computer can use. If you disable or don't set this policy setting, [removed: Windows][added: packaged Microsoft] Store apps will only use the static Content URI Rules.

[removed: Set this policy to restrict peer selection to a specific source. Options available are: ][added: Specifies the source of group ID used for peer selection. 0 = Not Set ]1 = AD Site[removed: . ] 2 = Authenticated domain SID[removed: . ] 3 = DHCP Option ID[removed: . ] 4 = DNS Suffix[removed: . ] 5 = [removed: AAD Tenant ID. When set, the Group ][added: Entra ]ID [removed: will be assigned automatically from the selected source. This policy is ignored if the GroupID policy is also set. The options set in this policy only apply to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. For option 3 - DHCP Option ID, the client will query DHCP Option ][added: Tenant ]ID[removed: 234 and use the returned GUID value as the Group ID.]

Specifies the maximum background download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization.[removed: The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. ]

Specifies the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully.[removed: The value 0 (zero) means "unlimited"; Delivery Optimization will hold the files in the cache longer and make the files available for uploads to other devices, as long as the cache size has not exceeded.]

Specifies the maximum cache size that Delivery Optimization [removed: uses][added: can utilize,] as a percentage of [added: the ]available [removed: disk size (1-100).][added: drive space.]

Specifies the maximum foreground download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization.[removed: The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. ]

Specifies the minimum download QoS (Quality of [removed: Service or speed)][added: Service) in KiloBytes/sec] for background [removed: downloads in KiloBytes/second. This policy affects the blending of peer and HTTP sources. Delivery Optimization complements the download from HTTP source to achieve the specified minimum QoS value.][added: downloads.]

[removed: Specify any value between 1 and 100 (in percentage) to allow ][added: Specifies ]the [removed: device to upload data to LAN and Group peers while on DC power (Battery). The recommended value ][added: minimum battery level required for uploading ]to [removed: set if you allow uploads on battery is 40 (for 40%). The device can download from peers ][added: peers, ]while on battery [removed: regardless of this policy. The value 0 means "not-limited"; The cloud service set default value will be used.][added: power.]

Specifies the required minimum [added: total ]disk size [removed: (capacity ]in [removed: GB)][added: GB] for the device to use [removed: Peer Caching. The cloud service set default value will be used. Recommended values: 64 GB to 256 GB. Note: If the DOModifyCacheDrive policy is set, the disk size check will apply to the new working directory specified by this policy.][added: P2P.]

Specifies the minimum content file size in MB [removed: enabled][added: eligible] to use [removed: Peer Caching. Recommended values: 1 MB to 100000 MB.][added: P2P.]

Specifies the minimum [added: total ]RAM size in GB required to use [removed: Peer Caching. For example if the minimum set is 1 GB, then devices with 1 GB or higher available RAM will be allowed to use Peer caching. Recommended values: 1 GB to 4 GB.][added: P2P.]

Specifies the maximum [removed: total ]bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month.[removed: The value 0 (zero) means "unlimited"; No monthly upload limit is applied if 0 is set.]

Specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth.[removed: The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for background downloads.]