Windows 11 24H2 · 1.0

This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all [removed: Windows][added: packaged Microsoft] Store apps that use the enterpriseAuthentication capability on a computer. If you enable this policy setting, you can define additional Content URI Rules that all [removed: Windows][added: packaged Microsoft] Store apps that use the enterpriseAuthentication capability on a computer can use. If you disable or don't set this policy setting, [removed: Windows][added: packaged Microsoft] Store apps will only use the static Content URI Rules.

Specifies if the DNS client would use the DDR protocol. The Discovery of Designated Resolvers (DDR) protocol allows Windows to move from unencrypted DNS to encrypted DNS when only the IP address of a resolver is known. If you enable this policy, the DNS client will use the DDR protocol. If you disable this policy setting, or if you do not configure this policy setting, [removed: computers][added: the DNS client] will use locally configured settings.

Specifies if the DNS client will perform name resolution over [removed: DNS over HTTPS (DoH).][added: encrypted protocols.] By default, the DNS client will do classic DNS name resolution (over UDP or [removed: TCP).][added: TCP port 53).] This setting can enhance the DNS client to use [removed: DoH protocol][added: encrypted protocols] to resolve domain names. To use this policy setting, click Enabled, and then select one of the following options from the drop-down list: Prohibit [removed: DoH: No DoH][added: encryption: no encrypted] name resolution will be performed. Allow [removed: DoH: Perform DoH queries][added: encryption: Use encrypted name resolution] if the configured [removed: DNS ]servers support it. If they don't support it, try classic name resolution. Require [removed: DoH:][added: encryption:] Allow only [removed: DoH][added: encrypted] name resolution. If there are no [removed: DoH capable ][added: configured ]DNS servers [removed: configured,][added: that handle encryption,] name resolution will fail. [added: In addition to the generic encryption policy, additional policies can be configured at the individual protocol level. For example, in order to force DoT name resolution only, a combination of "Require encryption" and "Block DoH" would be needed (vice versa to force DoH). For the example above, it is the admin's responsibility to ensure that if DoT is forced, there are valid DoT servers configured on the machine (vice versa for DoH). ]If you disable this policy setting, or if you do not configure this policy setting, [removed: computers][added: the DNS client] will use locally configured settings. DDR (Discovery of Designated Resolvers) plaintext traffic [removed: is][added: will be] allowed as it is necessary for auto-discovering [removed: DoH][added: encryption] settings.

This policy setting specifies whether JScript or JScript9Legacy is [removed: loaded for MSHTML/WebOC/MSXML/Cscript based invocations.][added: loaded.] If you enable this policy [removed: setting,][added: setting or not configured,] JScript9Legacy will be loaded in situations where JScript is instantiated. If you disable this policy, then JScript will be utilized.[removed: If this policy is left unconfigured, then MSHTML will use JScript9Legacy and MSXML/Cscript will use JScript.]

Configures password parameters Password complexity: which characters are used when generating a new password Default: Large letters + small letters + numbers + special characters Password length Minimum: 8 characters Maximum: 64 characters Default: 14 characters Password age in days Minimum: 1 day (7 days when backup directory is configured to be Azure AD) Maximum: 365 days Default: 30 days [added: Passphrase length Minimum: 3 words Maximum: 10 words Default: 6 words ]See https://go.microsoft.com/fwlink/?linkid=2188435[added: for more information. Passphrase list taken from "Deep Dive: EFF's New Wordlists for Random Passphrases" by Electronic Frontier Foundation, and is used under a CC-BY-3.0 Attribution license. See https://go.microsoft.com/fwlink/?linkid=2255471] for more information.

This policy configures post-authentication actions which will be executed after detecting an authentication by the managed account. Grace period: specifies the amount of time (in hours) to wait after an authentication before executing the specified post-authentication actions. If this setting is enabled and greater than zero, the specified post-authentication actions will be executed upon expir[removed: y][added: ation] of the grace period. If this setting is disabled or not configured, the specified post-authentication actions will be executed after a default 24 hour grace period. If this setting is equal to zero, no post-authentication actions will be executed. Actions: specifies the actions to take upon expir[removed: y][added: ation] of the grace period. Reset password: upon expir[removed: y][added: ation] of the grace period, the managed account password [removed: will be ][added: is ]reset. Reset the password and logoff the managed account: upon expir[removed: y][added: ation] of the grace period, the managed account password [removed: will be][added: is reset and any interactive logon sessions using the managed account are logged off. Reset the password and reboot: upon expiration of the grace period, the managed account password is] reset and [added: the managed device is rebooted. Reset the password, logoff the managed account, and terminate ]any [added: remaining processes: upon expiration of the grace period, the managed account password is reset, any ]interactive logon sessions using the managed account [removed: will][added: are logged off, and any remaining processes are] terminated. (NOTE: after any interactive logon sessions are terminated there may still be other authenticated sessions in use by the managed account. The only robust way to ensure that the previous password is longer in use is to reboot the device.)[removed: Reset the password and reboot: upon expiry of the grace period, the managed account password will be reset and the managed device will be immediately rebooted.] If this setting is disabled or not configured, post-authentication actions will default to "Reset the password and logoff the managed account". Note: the DSRM account on domain controllers cannot be configured for post-authentication actions. This policy has no effect on domain controllers and will be ignored even if configured for a DC. See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.