Windows 11 24H2 · 1.0

Enhanced Sign-in Security (ESS) isolates Windows Hello biometric (face and fingerprint) template data and matching operations to trusted hardware or specified memory regions, meaning the rest of the operating system cannot access or tamper with them. Because the channel of communication between the sensors and the algorithm is also secured, it is impossible for malware to inject or replay data in order to simulate a user signing in or to lock a user out of their machine. If you enable this policy then it can have following possible values: 0 - Enhanced Sign-in Security [removed: En][added: dis]abled with peripheral [removed: and built-in non-ESS ]sensors [removed: Enhanced sign-in security ][added: ESS ]will be [removed: en][added: dis]abled on systems with capable software and [removed: hardware, following the existing default behavior in Windows. ][added: hardware. ]Authentication operations of peripheral Windows Hello capable devices will be allowed, subject to current feature limitations.[removed: In addition, with this setting, ESS will be enabled on devices with a mixture of biometric devices, such as an ESS capable FPR and a non-ESS capable camera.] 1 - Enhanced Sign-in Security [removed: E][added: e]nabled without peripheral [removed: or built-in non-ESS ]sensors (default and [removed: recommended for highest security) Enhanced sign-in security ][added: recommended) ESS ]will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of any peripheral biometric device will be blocked and not available for Windows Hello. If you disable or not configure this policy then non-ESS sensors will be blocked on the ESS device. [added: ]

This policy setting allows you to control the domain controller (DC) location algorithm. By default, the DC location algorithm prefers DNS-based discovery if the DNS domain name is known. If DNS-based discovery fails and the NetBIOS domain name is known, the algorithm then uses NetBIOS-based discovery as a fallback mechanism. NetBIOS-based discovery uses a WINS server and mailslot messages but does not use site information. Hence it does not ensure that clients will discover the closest DC. It also allows a hub-site client to discover a branch-site DC even if the branch-site DC only registers site-specific DNS records (as recommended). For these reasons, NetBIOS-based discovery is not recommended. Note that this policy setting does not affect NetBIOS-based discovery for DC location if only the NetBIOS domain name is known. If you enable or do not configure this policy setting, the DC location algorithm does not use NetBIOS-based discovery as a fallback mechanism when DNS-based discovery fails. This is the default behavior. If you disable this policy setting, the DC location algorithm can use NetBIOS-based discovery as a fallback mechanism when DNS based discovery fails.[added: This setting has no effect unless the BlockNetbiosDiscovery setting is disabled. NetBIOS-based discovery is considered unsecure, has many limitations, and will be deprecated in a future release. For these reasons, NetBIOS-based discovery is not recommended. See https://aka.ms/dclocatornetbiosdeprecation for more information.]

This policy setting lets you disable OneDrive as the default save location. It does not prevent apps and users from saving files on OneDrive. If you disable this policy setting, files will be saved locally by default. Users will still be able to change the value of this setting to save to OneDrive by default. They will also be able to open and save files on OneDrive using the OneDrive app and file picker, and [removed: Windows][added: packaged Microsoft] Store apps will still be able to access OneDrive using the WinRT API. If you enable or do not configure this policy setting, users with a connected account will save documents to OneDrive by default.

This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: * Users can’t access OneDrive from the OneDrive app and file picker. * [removed: Windows][added: Packaged Microsoft] Store apps can’t access OneDrive using the WinRT API. * OneDrive doesn’t appear in the navigation pane in File Explorer. * OneDrive files aren’t kept in sync with the cloud. * Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage.

This policy setting lets you prevent apps and features from working with files on OneDrive for Windows 8.1. If you enable this policy setting: * Users can’t access OneDrive from the OneDrive app and file picker. * [removed: Windows][added: Packaged Microsoft] Store apps can’t access OneDrive using the WinRT API. * OneDrive doesn’t appear in the navigation pane in File Explorer. * OneDrive files aren’t kept in sync with the cloud. * Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage.

Determines whether Redirection Guard is enabled for the print spooler. You can enable this setting to configure the Redirection Guard policy being applied to spooler. If you disable or do not configure this policy setting, Redirection Guard will default to being '[removed: e][added: E]nabled'. If you enable this setting you may select the following options: -- Enabled : Redirection Guard will prevent any file redirections from being followed -- Disabed : Redirection Guard will not be enabled and file redirections may be used within the spooler process -- Audit : Redirection Guard will log events as though it were enabled but will not actually prevent file redirections from being used within the spooler.