Windows 11 Group Policy settings
3,503 settings · 23H2 · 1.0 · 15 Jul 2024 · latest is 25H2 · 1.0
- Allow devices compliant with InstantGo or HSTI to opt out of pre-boot PIN.
- Allow enhanced PINs for startup
- Allow network unlock at startup
- Allow Secure Boot for integrity validation
- Choose how BitLocker-protected operating system drives can be recovered
- Configure minimum PIN length for startup
- Configure pre-boot recovery message and URL
- Configure TPM platform validation profile (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2)
- Configure TPM platform validation profile for BIOS-based firmware configurations
- Configure TPM platform validation profile for native UEFI firmware configurations
- Configure use of hardware-based encryption for operating system drives
- Configure use of passwords for operating system drives
- Disallow standard users from changing the PIN or password
- Enable use of BitLocker authentication requiring preboot keyboard input on slates
- Enforce drive encryption type on operating system drives
- Require additional authentication at startup
- Require additional authentication at startup (Windows Server 2008 and Windows Vista)
- Reset platform validation data after BitLocker recovery
- Use enhanced Boot Configuration Data validation profile
Windows 11 · template release
23H2 · 1.0
Published 15 Jul 2024 · 3,503 settings · 5 releases kept
7 new settings, 8 changed since 22H2 · 3.0
Changed in 23H2 · 1.0 15 settings
- Automatic Data Collection
- Configure authorized password decryptors
- Configure password backup directory
- Configure size of encrypted password history
- Dev drive filter attach policy
- Disallow downloads from Microsoft Connected Cache servers when the device connects via VPN
- Enable dev drive
- Enable optional updates
- Name of administrator account to manage
- Password Settings
- Post-authentication actions
- Turn off account notifications in Start