Windows 11: 23H2 · 1.0 to 25H2 · 1.0

[removed: ]This policy setting allows you to turn off Windows Copilot.[removed: ][added: ]If you enable this policy setting, users will not be able to use Copilot. The Copilot icon will not appear on the taskbar either.[removed: ][added: ]If you disable or do not configure this policy setting, users will be able to use Copilot when it's available to them.

This policy setting specifies whether JScript or JScript9Legacy is [removed: loaded for MSHTML/WebOC/MSXML/Cscript based invocations.][added: loaded.] If you enable this policy [removed: setting,][added: setting or not configured,] JScript9Legacy will be loaded in situations where JScript is instantiated. If you disable this policy, then JScript will be utilized.[removed: If this policy is left unconfigured, then MSHTML will use JScript9Legacy and MSXML/Cscript will use JScript.]

Configures password parameters Password complexity: which characters are used when generating a new password Default: Large letters + small letters + numbers + special characters Password length Minimum: 8 characters Maximum: 64 characters Default: 14 characters Password age in days Minimum: 1 day (7 days when backup directory is configured to be Azure AD) Maximum: 365 days Default: 30 days [added: Passphrase length Minimum: 3 words Maximum: 10 words Default: 6 words ]See https://go.microsoft.com/fwlink/?linkid=2188435[added: for more information. Passphrase list taken from "Deep Dive: EFF's New Wordlists for Random Passphrases" by Electronic Frontier Foundation, and is used under a CC-BY-3.0 Attribution license. See https://go.microsoft.com/fwlink/?linkid=2255471] for more information.

This policy configures post-authentication actions which will be executed after detecting an authentication by the managed account. Grace period: specifies the amount of time (in hours) to wait after an authentication before executing the specified post-authentication actions. If this setting is enabled and greater than zero, the specified post-authentication actions will be executed upon expir[removed: y][added: ation] of the grace period. If this setting is disabled or not configured, the specified post-authentication actions will be executed after a default 24 hour grace period. If this setting is equal to zero, no post-authentication actions will be executed. Actions: specifies the actions to take upon expir[removed: y][added: ation] of the grace period. Reset password: upon expir[removed: y][added: ation] of the grace period, the managed account password [removed: will be ][added: is ]reset. Reset the password and logoff the managed account: upon expir[removed: y][added: ation] of the grace period, the managed account password [removed: will be][added: is reset and any interactive logon sessions using the managed account are logged off. Reset the password and reboot: upon expiration of the grace period, the managed account password is] reset and [added: the managed device is rebooted. Reset the password, logoff the managed account, and terminate ]any [added: remaining processes: upon expiration of the grace period, the managed account password is reset, any ]interactive logon sessions using the managed account [removed: will][added: are logged off, and any remaining processes are] terminated. (NOTE: after any interactive logon sessions are terminated there may still be other authenticated sessions in use by the managed account. The only robust way to ensure that the previous password is longer in use is to reboot the device.)[removed: Reset the password and reboot: upon expiry of the grace period, the managed account password will be reset and the managed device will be immediately rebooted.] If this setting is disabled or not configured, post-authentication actions will default to "Reset the password and logoff the managed account". Note: the DSRM account on domain controllers cannot be configured for post-authentication actions. This policy has no effect on domain controllers and will be ignored even if configured for a DC. See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.

This policy controls the configuration under which LSASS is run. If you do not configure this policy and there is no current setting in the registry, LSA will run as protected process for [added: all ]clean installed, HVCI capable, client [removed: SKUs that are domain or cloud domain joined devices.][added: SKUs.] This configuration is not UEFI locked. This can be overridden if the policy is configured. If you configure and set this policy setting to "Disabled", LSA will not run as a protected process. If you configure and set this policy setting to "EnabledWithUEFILock," LSA will run as a protected process and this configuration is UEFI locked. If you configure and set this policy setting to "EnabledWithoutUEFILock", LSA will run as a protected process and this configuration is not UEFI locked.

This policy setting allows users to see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you enable this policy setting, users will see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you disable this policy setting, users won’t see [removed: Windows][added: packaged Microsoft] Store apps on the taskbar. If you don’t configure this policy setting, the default setting for the user’s device will be used, and the user can choose to change it.

This policy setting allows you to specify which protocols can be used for Remote Desktop Protocol (RDP) access to this server. If you enable this policy setting, you must specify if you would like RDP to use UDP. You can select one of the following options: "Use [removed: both][added: either] UDP [removed: and TCP", "Use only TCP" ][added: or TCP (default)" ]or "Use [removed: either UDP or TCP (default)"][added: only TCP"] If you select "Use either UDP or TCP" and the UDP connection is successful, most of the RDP traffic will use UDP. If the UDP connection is not successful or if you select "Use only TCP," all of the RDP traffic will use TCP. If you disable or do not configure this policy setting, RDP will choose the optimal protocols for delivering the best user experience.

Disabled (Default): If Not Configured or Disabled, [removed: network protection is not allowed to ][added: datagram processing will ]be [removed: configured into block or audit mode on Windows Server.][added: enabled for network protection.] Enabled: If Enabled, [removed: administrators can control whether Network Protection is allowed to be configured into block or audit mode on Windows Server. Note, that this configuration is dependent on the EnableNetworkProtection configuration. If this configuration is false, EnableNetworkProtection ][added: datagram processing ]will be [removed: ignored, otherwise][added: disabled for] network [removed: protection will start on Windows Server depending on the value of EnableNetworkProtection.][added: protection.]

This policy setting allows [removed: you to configure scanning for network files. It][added: the scanning of network files using on access protection. The default] is [removed: recommended that you do not enable this setting.][added: enabled. Recommended to remain enabled in most cases.] If you enable [added: or do not configure ]this setting, network files will be scanned. If you disable[removed: or do not configure] this setting, network files will not be scanned.

This policy controls [added: whether ]the [removed: configuration under which winlogon sends][added: user's password is included in the content of] MPR notifications [added: sent by winlogon ]in the system. If you [removed: en][added: dis]able this setting or do not configure it, winlogon sends MPR notifications [removed: if a credential manager is configured.][added: with empty password fields of the user's authentication info.] If you [removed: dis][added: en]able this setting, winlogon [removed: does not send MPR notifications.][added: sends MPR notifications containing the user's password in the authentication info.]