Windows 11 Group Policy settings
3,580 settings · 24H2 · 1.0 · 30 Sep 2024 · latest is 25H2 · 1.0
- Disconnect remote session on lock for legacy authentication Windows Components › Remote Desktop Services › Remote Desktop Session Host › Security
- Set exclusions from Remote Encryption Protection Windows Components › Microsoft Defender Antivirus › Remediation › Behavioral Network Blocks › Remote Encryption Protection
- Allow access to BitLocker-protected fixed data drives from earlier versions of Windows Windows Components › BitLocker Drive Encryption › Fixed Data Drives
- Allow access to BitLocker-protected removable data drives from earlier versions of Windows Windows Components › BitLocker Drive Encryption › Removable Data Drives
- Allow audio input in Windows Sandbox Windows Components › Windows Sandbox
- Allow clipboard sharing with Windows Sandbox Windows Components › Windows Sandbox
- Allow legacy functionality for Internet Shortcut files Windows Components › Internet Explorer
- Allow mapping folders into Windows Sandbox Windows Components › Windows Sandbox
- Allow name-based strong mappings for certificates System › KDC
- Allow networking in Windows Sandbox Windows Components › Windows Sandbox
- Allow printer sharing with Windows Sandbox Windows Components › Windows Sandbox
- Allow retrieving the Azure AD Kerberos Ticket Granting Ticket during logon System › Kerberos
- Allow Screen Recorder Windows Components › Snipping Tool
- Allow vGPU sharing for Windows Sandbox Windows Components › Windows Sandbox
- Allow video input in Windows Sandbox Windows Components › Windows Sandbox
- Allows development of packaged Microsoft Store apps and installing them from an integrated development environment (IDE) Windows Components › App Package Deployment
- Alternative Port Mappings Network › Lanman Workstation
- Always automatically restart at the scheduled time Windows Components › Windows Update › Legacy Policies
- Apply a list of exclusions to specific attack surface reduction (ASR) rules Windows Components › Microsoft Defender Antivirus › Microsoft Defender Exploit Guard › Attack Surface Reduction
- Audit client does not support encryption Network › Lanman Server
- Audit client does not support signing Network › Lanman Server
- Audit insecure guest logon Network › Lanman Server
- Audit insecure guest logon Network › Lanman Workstation
- Audit server does not support encryption Network › Lanman Workstation
- Audit server does not support signing Network › Lanman Workstation
- Block NetBIOS-based discovery for domain controller location System › Net Logon › DC Locator DNS Records
- Block NTLM (LM, NTLM, NTLMv2) Network › Lanman Workstation
- Block NTLM Server Exception List Network › Lanman Workstation
- Configure automatic account management System › LAPS
- Configure Brute-Force Protection aggressiveness Windows Components › Microsoft Defender Antivirus › Remediation › Behavioral Network Blocks › Brute-Force Protection
- Configure Brute-Force Protection blocking time Windows Components › Microsoft Defender Antivirus › Remediation › Behavioral Network Blocks › Brute-Force Protection
- Configure Discovery of Designated Resolvers (DDR) protocol Network › DNS Client
- Configure encrypted name resolution Network › DNS Client
- Configure how aggressively Remote Encryption Protection blocks threats Windows Components › Microsoft Defender Antivirus › Remediation › Behavioral Network Blocks › Remote Encryption Protection
- Configure multicast DNS (mDNS) protocol Network › DNS Client
- Configure performance mode status Windows Components › Microsoft Defender Antivirus › Real-time Protection
- Configure real-time protection and Security Intelligence Updates during OOBE Windows Components › Microsoft Defender Antivirus › Real-time Protection
- Configure Remote Encryption Protection blocking time Windows Components › Microsoft Defender Antivirus › Remediation › Behavioral Network Blocks › Remote Encryption Protection
- Configure Remote Encryption Protection Mode Windows Components › Microsoft Defender Antivirus › Remediation › Behavioral Network Blocks › Brute-Force Protection
- Configure Remote Encryption Protection Mode Windows Components › Microsoft Defender Antivirus › Remediation › Behavioral Network Blocks › Remote Encryption Protection
- Configure RPC packet level privacy setting for incoming connections Printers
- Configure SAM change password RPC methods policy System › Security Account Manager
- Configure scanning of network files Windows Components › Microsoft Defender Antivirus › Scan
- Configure security intelligence updates according to the scheduler for VDI clients. Windows Components › Microsoft Defender Antivirus › Security Intelligence Updates
- Configure the behavior of the sudo command System
- Configure the transmission of the user's password in the content of MPR notifications sent by winlogon. Windows Components › Windows Logon Options
- Configure whether to report Dynamic Signature dropped events Windows Components › Microsoft Defender Antivirus › Reporting
- Configure Windows Defender SmartScreen Windows Components › Windows Defender SmartScreen › Microsoft Edge
- Configure Windows protected print Printers
- Configures LSASS to run as a protected process System › Local Security Authority
- Control whether exclusions are visible to local users Windows Components › Microsoft Defender Antivirus
- Control whether or not exclusions are visible to Local Admins Windows Components › Microsoft Defender Antivirus
- Convert warn verdict to block Windows Components › Microsoft Defender Antivirus › Network Inspection System
- Deploy App Control for Business System › Device Guard
- Disable caching of the Windows Hello for Business credential after sign-in Windows Components › Windows Hello for Business
- Disable gradual rollout of Microsoft Defender updates. Windows Components › Microsoft Defender Antivirus › MpEngine
- Disconnect remote session on lock for Microsoft identity platform authentication Windows Components › Remote Desktop Services › Remote Desktop Session Host › Security
- Do not allow password expiration time longer than required by policy System › LAPS
- Do not allow WebAuthn redirection Windows Components › Remote Desktop Services › Remote Desktop Session Host › Device and Resource Redirection
- Do not apply the Mark of the Web tag to files copied from insecure sources Windows Components › File Explorer
- Enable Alternative Ports Network › Lanman Workstation
- Enable App Installer Local Archive Malware Scan Override Windows Components › Desktop App Installer
- Enable App Installer Microsoft Store Source Certificate Validation Bypass Windows Components › Desktop App Installer
- Enable authentication rate limiter Network › Lanman Server
- Enable Delegated Managed Service Account logons System › Kerberos
- Enable EDR in block mode Windows Components › Microsoft Defender Antivirus › Features
- Enable optional updates Windows Components › Windows Update › Manage updates offered from Windows Update
- Enable remote mailslots Network › Lanman Server
- Enable remote mailslots Network › Lanman Workstation
- Enable SMB over QUIC Network › Lanman Server
- Enable SMB over QUIC Network › Lanman Workstation
- Enable Windows Package Manager command line interfaces Windows Components › Desktop App Installer
- Enable Windows Package Manager Configuration Windows Components › Desktop App Installer
- Hide the TaskView button Start Menu and Taskbar
- Intel TDT Integration Level Windows Components › Microsoft Defender Antivirus › Features
- Limit remote access to the Event Log Service Windows Components › Event Log Service
- Load a specific theme Control Panel › Personalization
- Mandate the maximum version of SMB Network › Lanman Server
- Mandate the maximum version of SMB Network › Lanman Workstation
- Mandate the minimum version of SMB Network › Lanman Server
- Mandate the minimum version of SMB Network › Lanman Workstation
- Not allow per-user unsigned packages to install by default (requires explicitly allow per install) Windows Components › App Package Deployment
- Password Settings System › LAPS
- Post-authentication actions System › LAPS
- Prevent bypassing Windows Defender SmartScreen prompts for sites Windows Components › Windows Defender SmartScreen › Microsoft Edge
- Prevent users and apps from accessing dangerous websites Windows Components › Microsoft Defender Antivirus › Microsoft Defender Exploit Guard › Network Protection
- Prevent users from customizing their Start Screen Start Menu and Taskbar
- Remove Notifications and Action Center Start Menu and Taskbar
- Remove Personalized Website Recommendations from the Recommended section in the Start Menu Start Menu and Taskbar
- Replace JScript by loading JScript9Legacy in place of JScript. Windows Components › Internet Explorer
- Require Encryption Network › Lanman Workstation
- Restrict clipboard transfer from client to server Windows Components › Remote Desktop Services › Remote Desktop Session Host › Device and Resource Redirection
- Restrict clipboard transfer from server to client Windows Components › Remote Desktop Services › Remote Desktop Session Host › Device and Resource Redirection
- Restricts the UI language Windows uses for all logged users Control Panel › Regional and Language Options
- Restricts the UI languages Windows should use for the selected user Control Panel › Regional and Language Options
- Scan excluded files and directories during quick scans Windows Components › Microsoft Defender Antivirus › Scan
- Select RDP transport protocols Windows Components › Remote Desktop Services › Remote Desktop Session Host › Connections
- Select the channel for Microsoft Defender daily security intelligence updates Windows Components › Microsoft Defender Antivirus
- Set authentication rate limiter delay (milliseconds) Network › Lanman Server
- Set exclusions from Brute-Force Protection Windows Components › Microsoft Defender Antivirus › Remediation › Behavioral Network Blocks › Brute-Force Protection
Windows 11 · template release
24H2 · 1.0
Published 30 Sep 2024 · 3,580 settings · 5 releases kept
78 new settings, 46 changed, 1 removed since 23H2 · 1.0
Changed in 24H2 · 1.0 124 settings
- Disconnect remote session on lock for legacy authentication
- Set exclusions from Remote Encryption Protection
- Allow access to BitLocker-protected fixed data drives from earlier versions of Windows
- Allow access to BitLocker-protected removable data drives from earlier versions of Windows
- Allow audio input in Windows Sandbox
- Allow clipboard sharing with Windows Sandbox
- Allow legacy functionality for Internet Shortcut files
- Allow mapping folders into Windows Sandbox
- Allow name-based strong mappings for certificates
- Allow networking in Windows Sandbox
- Allow printer sharing with Windows Sandbox
- Allow retrieving the Azure AD Kerberos Ticket Granting Ticket during logon