ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 259/260 feeds/APIs · 416/439 docs · checked 07:58 UTC Customize Public modeDiscuss ChangeIntel on Discord
release15 Jul 2024 to 29 Sep 2025

Windows 11: 23H2 · 1.0 to 25H2 · 1.0

119 new settings, 71 changed, 1 removed since 23H2 · 1.0. 2 retained releases apart.

CSVJSONBrowse its 3,621 settings Vendor download page

Changes that matter

191 settings · compared with 23H2 · 1.0
  • This setting controls datagram processing for network protection.
    Computer · Windows Components\Microsoft Defender Antivirus\Network Inspection System
    • Description Disabled (Default): If Not Conf…[removed: network protection is not allowed to ][added: datagram processing will ]be [removed: configured into block or audit mode on Windows …][added: enabled for network protection.] Enabled: If Enabled, [removed: administrators can control whether Network Protecti…][added: datagram processing ]will be [removed: ignored, otherwise][added: disabled for] network [removed: protection will start on Windows Server depending on the value of EnableNetworkProtection.][added: protection.]
      Whole description, marked

      Disabled (Default): If Not Configured or Disabled, [removed: network protection is not allowed to ][added: datagram processing will ]be [removed: configured into block or audit mode on Windows Server.][added: enabled for network protection.] Enabled: If Enabled, [removed: administrators can control whether Network Protection is allowed to be configured into block or audit mode on Windows Server. Note, that this configuration is dependent on the EnableNetworkProtection configuration. If this configuration is false, EnableNetworkProtection ][added: datagram processing ]will be [removed: ignored, otherwise][added: disabled for] network [removed: protection will start on Windows Server depending on the value of EnableNetworkProtection.][added: protection.]

    • Template definition changed; registry values, options and limits are the same.
  • Disable gradual rollout of Microsoft Defender updates.
    Computer · Windows Components\Microsoft Defender Antivirus\MpEngine
    • Supported on [was: windows:SUPPORTED_Windows_10_RS1][now: At least Windows Server 2016, Windows 10 Version 1607]
    • Supported on [was: windows:SUPPORTED_Windows_10_RS1; unresolved; Blank; ][now: windows:SUPPORTED_Windows_10_0_RS1; resolved; AnyOf; products:MicrosoftWindows [13, ]]
  • Convert warn verdict to blockNew
    Computer · Windows Components\Microsoft Defender Antivirus\Network Inspection System
  • Apply a list of exclusions to specific attack surface reduction (ASR) rulesNew
    Computer · Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Attack Surface Reduction
  • Prevent users and apps from accessing dangerous websites
    Computer · Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Network Protection
    • Template definition changed; registry values, options and limits are the same.
  • Enable EDR in block modeNew
    Computer · Windows Components\Microsoft Defender Antivirus\Features
  • Intel TDT Integration LevelNew
    Computer · Windows Components\Microsoft Defender Antivirus\Features
  • Control whether or not exclusions are visible to Local Admins
    Computer · Windows Components\Microsoft Defender Antivirus
    • Renamed Control whether or not exclusions are visible to Local Admins[removed: .]
  • Control whether exclusions are visible to local usersNew
    Computer · Windows Components\Microsoft Defender Antivirus
  • Configure real-time protection and Security Intelligence Updates during OOBENew
    Computer · Windows Components\Microsoft Defender Antivirus\Real-time Protection
  • Configure performance mode statusNew
    Computer · Windows Components\Microsoft Defender Antivirus\Real-time Protection
  • Set exclusions from Brute-Force ProtectionNew
    Computer · Windows Components\Microsoft Defender Antivirus\Remediation\Behavioral Network Blocks\Brute-Force Protection
  • Configure Brute-Force Protection aggressivenessNew
    Computer · Windows Components\Microsoft Defender Antivirus\Remediation\Behavioral Network Blocks\Brute-Force Protection
  • Configure Remote Encryption Protection ModeNew
    Computer · Windows Components\Microsoft Defender Antivirus\Remediation\Behavioral Network Blocks\Brute-Force Protection
  • Configure Brute-Force Protection blocking timeNew
    Computer · Windows Components\Microsoft Defender Antivirus\Remediation\Behavioral Network Blocks\Brute-Force Protection
  • Set exclusions from Remote Encryption ProtectionNew
    Computer · Windows Components\Microsoft Defender Antivirus\Remediation\Behavioral Network Blocks\Remote Encryption Protection
  • Configure how aggressively Remote Encryption Protection blocks threatsNew
    Computer · Windows Components\Microsoft Defender Antivirus\Remediation\Behavioral Network Blocks\Remote Encryption Protection
  • Configure Remote Encryption Protection ModeNew
    Computer · Windows Components\Microsoft Defender Antivirus\Remediation\Behavioral Network Blocks\Remote Encryption Protection
  • Configure Remote Encryption Protection blocking timeNew
    Computer · Windows Components\Microsoft Defender Antivirus\Remediation\Behavioral Network Blocks\Remote Encryption Protection
  • Configure whether to report Dynamic Signature dropped eventsNew
    Computer · Windows Components\Microsoft Defender Antivirus\Reporting
  • Select the channel for Microsoft Defender daily security intelligence updates
    Computer · Windows Components\Microsoft Defender Antivirus
    • “Select the channel for Microsoft Defender daily security intelligence updates” loses the choice [removed: Critical - Time delay (6)]
  • Trigger a quick scan after X days without any scansNew
    Computer · Windows Components\Microsoft Defender Antivirus\Scan
  • Configure scanning of network files
    Computer · Windows Components\Microsoft Defender Antivirus\Scan
    • Renamed [removed: Scan][added: Configure scanning of] network files
    • Description This policy setting allows [removed: you to configure scanning for network files. It][added: the scanning of network files using on access protection. The default] is [removed: recommended that you do not enable this setting.][added: enabled. Recommended to remain enabled in most cases.] If you enable [added: or do not configure ]this setting, network files will be scanned. If you disable[removed: or do not configure] this setting, network files will not be scanned.
      Whole description, marked

      This policy setting allows [removed: you to configure scanning for network files. It][added: the scanning of network files using on access protection. The default] is [removed: recommended that you do not enable this setting.][added: enabled. Recommended to remain enabled in most cases.] If you enable [added: or do not configure ]this setting, network files will be scanned. If you disable[removed: or do not configure] this setting, network files will not be scanned.

  • Scan excluded files and directories during quick scansNew
    Computer · Windows Components\Microsoft Defender Antivirus\Scan
  • Configure security intelligence updates according to the scheduler for VDI clients.New
    Computer · Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates
  • Display additional text to clients when they need to perform an actionRemoved
    Computer · Windows Components\Microsoft Defender Antivirus\Client Interface
  • Do not apply the Mark of the Web tag to files copied from insecure sourcesNew
    Computer · Windows Components\File Explorer
  • Configure the transmission of the user's password in the content of MPR notifications sent by winlogon.
    Computer · Windows Components\Windows Logon Options
    • Renamed [removed: Enable][added: Configure the transmission of the user's password in the content of] MPR notifications [removed: for the system][added: sent by winlogon.]
    • Description This policy controls [added: whether ]the [removed: configuration under which winlogon sends][added: user's password is included in the content of] MPR notifications [added: sent by winlogon ]in the system. If you [removed: en][added: dis]able this setting or do not configure it, winlogon sends MPR notifications [removed: if a credential manager is configured.][added: with empty password fields of the user's authentication info.] If you [removed: dis][added: en]able this setting, winlogon [removed: does not send MPR notifications.][added: sends MPR notifications containing the user's password in the authentication info.]
      Whole description, marked

      This policy controls [added: whether ]the [removed: configuration under which winlogon sends][added: user's password is included in the content of] MPR notifications [added: sent by winlogon ]in the system. If you [removed: en][added: dis]able this setting or do not configure it, winlogon sends MPR notifications [removed: if a credential manager is configured.][added: with empty password fields of the user's authentication info.] If you [removed: dis][added: en]able this setting, winlogon [removed: does not send MPR notifications.][added: sends MPR notifications containing the user's password in the authentication info.]

  • Allow audio input in Windows Sandbox
    Computer · Windows Components\Windows Sandbox
    • Supported on [was: windows:SUPPORTED_Windows_11_0_NOSERVER_ENTERPRISE_EDUCATION_PRO_SANDBOX][now: At least Windows 11 Pro, Enterprise, or Education with Windows Sandbox]
    • Supported on windows:SUPPORTED_Windows_11_0_NOSERVER_ENTERPRISE_EDUCATION_PRO_SANDBOX; [removed: unresolved; Blank; ][added: resolved; AnyOf; products:MicrosoftWindows [16, 16]]
  • Allow clipboard sharing with Windows Sandbox
    Computer · Windows Components\Windows Sandbox
    • Supported on [was: windows:SUPPORTED_Windows_11_0_NOSERVER_ENTERPRISE_EDUCATION_PRO_SANDBOX][now: At least Windows 11 Pro, Enterprise, or Education with Windows Sandbox]
    • Supported on windows:SUPPORTED_Windows_11_0_NOSERVER_ENTERPRISE_EDUCATION_PRO_SANDBOX; [removed: unresolved; Blank; ][added: resolved; AnyOf; products:MicrosoftWindows [16, 16]]
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 21 Oct 07:58 UTC · 259 of 260 readable · 258 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.