Windows 11 25H2 · 1.0

This policy setting allows you to enable or disable Microsoft Application Virtualization (App-V) feature. Reboot is needed for disable to take effect.[removed: Note: Application Virtualization (App-V) will reach end-of-life April 2026. After that time, the App-V client will be excluded from new versions of the Windows operating system. See aka.ms/AppVDeprecation for more information.]

[removed: This policy allows you to set ][added: Specifies ]one or more Microsoft Connected Cache servers that will be used by your client(s).[removed: ][added: ]One or more values can be added as either fully qualified domain names (FQDN) or IP addresses. To add multiple values, separate each FQDN or IP address by commas.[removed: ]

[removed: This policy allows you to specify ][added: Specifies ]how your client(s) can discover Microsoft Connected Cache servers dynamically. [removed: Options available are: 0 = Disable DNS-SD. ]1 = DHCP Option 235[removed: . ] 2 = DHCP Option 235 [removed: Force. If this policy is not configured, the client will attempt to automatically find a cache server using DNS-SD. If set to 0, the client will not use DNS-SD to automatically find a cache server. If set to 1 or 2, the client will query DHCP Option ID 235 and use the returned value as the Cache Server Hostname. Option 2 overrides the Cache Server Hostname policy, if configured.][added: Force]

[removed: Disallow][added: Specify to disallow] downloads from Microsoft Connected Cache servers when the device connects via VPN. [removed: By default,][added: When unchecked] the device is allowed to download from Microsoft Connected Cache when connected via VPN.[added: Check the box to block these downloads.]

Specifies the [removed: download ]method that Delivery Optimization can use [removed: in downloads of Windows Updates, Apps and App updates. The following list shows the supported values: ][added: to download content on behalf of various Microsoft products. ]0 = HTTP only, no peering[removed: . ] 1 = HTTP blended with peering behind the same NAT[removed: . ] 2 = HTTP blended with peering across a private [removed: group. Peering occurs on devices in the same Active Directory Site (if exist) or the same domain by default. When this option is selected, peering will cross NATs. To create a custom ]group[removed: use Group ID in combination with Mode 2. ][added: ]3 = HTTP blended with Internet [removed: Peering. ][added: peering ]99 = [removed: Simple download mode with][added: HTTP only, no peering,] no [removed: peering. Delivery Optimization downloads using HTTP only and does not attempt to contact the Delivery Optimization ][added: use of DO ]cloud service[removed: s. ] 100 = Bypass [removed: mode. Windows 10: Do not use Delivery Optimization and use BITS instead. ][added: mode, deprecated in ]Windows [removed: 11: Deprecated, use Simple mode instead.][added: 11]

[removed: Group ID must be set as a GUID. This Policy specifies ][added: Specifies ]an arbitrary group ID that the device belongs to.[removed: Use this if you need to create a single group for Local Network Peering for branches that are on different domains or are not on the same LAN. Note: this is a best effort optimization and should not ][added: A GUID must ]be [removed: relied on for an authentication of identity.][added: used.]

Specifies the drive [added: that ]Delivery Optimization [removed: shall][added: should] use for its[removed: cache. By default, %SystemDrive% is used to store the] cache. The drive location can be specified using environment variables, drive letter or using a full path.

[removed: This policy allows you to set ][added: Specifies ]one or more keywords used to recognize VPN connections. To add multiple keywords, separate [removed: them with commas.][added: each by a comma.]

Per Process System DPI is an application compatibility feature for desktop applications that do not render properly after a display-scale factor (DPI) change. When the display scale factor of the primary display changes (which can happen when you connect or disconnect a display that has a different display scale factor (DPI), connect remotely from a device with a different display scale factor, or manually change the display scale factor), many desktop applications can display blurry. Desktop applications that have not been updated to display properly in this scenario will be blurry until the user logs out and back in to Windows.[removed: ][added: ]When you enable this policy some blurry applications will be crisp after they are restarted, without requiring the user to log out and back in to Windows.[removed: ][added: ]Be aware of the following: Per Process System DPI will only improve the rendering of desktop applications that are positioned on the primary display. Some desktop applications can still be blurry on secondary displays that have different display scale factors.[removed: ][added: ]Per Process System DPI will not work for all applications as some older desktop applications will always be blurry on high DPI displays.[removed: ][added: ]In some cases, you may see some odd behavior in some desktop applications. If that happens, Per Process System DPI should be disabled. Enabling this setting lets you specify the system-wide default for desktop applications as well as per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system.

This policy lets you restrict launching of Internet Explorer as a standalone browser. If you enable this policy, it: - Prevents Internet Explorer 11 from launching as a standalone browser. - Restricts Internet Explorer's usage to Microsoft Edge's native 'Internet Explorer mode'. - Redirects [removed: all ]attempts at launching Internet Explorer 11 to Microsoft Edge Stable Channel browser. - Overrides any other policies that redirect to Internet Explorer 11.[added: Even with this policy enabled launching Internet Explorer 11 using COM automation will still be allowed. To disable COM automation launches of Internet Explorer 11 use the "Disable Internet Explorer 11 COM Automation" group policy.] If you disable, or don’t configure this policy, all sites are opened using the current active browser settings. Note: Microsoft Edge Stable Channel must be installed for this policy to take effect.

This policy setting determines if NTLM [removed: could][added: can] be used to access [removed: to ]specified servers. If you enable this policy setting (va[removed: il][added: li]d only if [removed: the Block ]NTLM (LM, NTLM, NTLMv2) [removed: policy ]is [removed: enabled),][added: blocked),] NTLM [removed: could][added: can] be used to access servers specified. Please enter the desired servers (DNS name, IP address or NetBIOS name) in the edit box, one server name per line. If you disable or do not configure this policy setting, the NTLM access to servers will be determined by other settings.

This policy setting controls whether the SMB client will enable SMB over QUIC. If you disable this policy setting, the SMB client will not allow initiating connections over QUIC. In this case, if the user attempts to connect over QUIC, SMB client will attempt to connect over TCP. If you do not configure this policy setting, the SMB client may allow initiating connections over QUIC. [added: ]

Determines whether Allow Adaptive Dimming When [removed: Battery Saver On][added: External Display Connected] checkbox is forced checked/unchecked by the MDM policy. The user will not be able to change this setting and the checkbox in the UI will be greyed out.

Determines whether Allow Lock on Leave When [removed: Battery Saver On][added: External Display Connected] checkbox is forced checked/unchecked by the MDM policy. The user will not be able to change this setting and the checkbox in the UI will be greyed out.

[removed: ]This policy setting allows you to turn off Windows Copilot.[removed: ][added: ]If you enable this policy setting, users will not be able to use Copilot. The Copilot icon will not appear on the taskbar either.[removed: ][added: ]If you disable or do not configure this policy setting, users will be able to use Copilot when it's available to them.