<html dir="ltr" xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" gpmc_reportInitialized="false">
<head>
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta http-equiv="Content-Type" content="text/html; charset=UTF-16" />
<title>Local Policy DoD Windows 10 STIG Comp v3r4</title>
<!-- Styles -->
<style type="text/css">
                body    { background-color:#FFFFFF; border:1px solid #666666; color:#000000; font-size:68%; font-family:MS Shell Dlg; margin:0,0,10px,0; word-break:normal; word-wrap:break-word; }

                table   { font-size:100%; table-layout:fixed; width:100%; }

                td,th   { overflow:visible; text-align:left; vertical-align:top; white-space:normal; }

                .title  { background:#FFFFFF; border:none; color:#333333; display:inline-table; height:24px; margin:0px,0px,0px,0px; padding-top:0px; position:relative; table-layout:fixed; z-index:5; }

                .he0_expanded    { background-color:#FEF7D6; border:1px solid #BBBBBB; color:#3333CC; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:0px; margin-right:0px; padding-left:8px; padding-right:5em; padding-top:4px; position:relative; }

                .he1_expanded    { background-color:#A0BACB; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:20px; margin-right:0px; padding-left:8px; padding-right:5em; padding-top:4px; position:relative; }

                .he0h_expanded   { background-color: #FEF0D0; border: 1px solid #BBBBBB; color: #000000; cursor: hand; display: block; font-family: MS Shell Dlg; font-size: 100%; font-weight: bold; height: 2.25em; margin-bottom: -1px; margin-left: 5px; margin-right: 0px; padding-left: 8px; padding-right: 5em; padding-top: 4px; position: relative;  }
                .he1h_expanded   { background-color: #7197B3; border: 1px solid #BBBBBB; color: #000000; cursor: hand; display: block; font-family: MS Shell Dlg; font-size: 100%; font-weight: bold; height: 2.25em; margin-bottom: -1px; margin-left: 10px; margin-right: 0px; padding-left: 8px; padding-right: 5em; padding-top: 4px; position: relative; }

                .he1    { background-color:#A0BACB; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:20px; margin-right:0px; padding-left:8px; padding-right:5em; padding-top:4px; position:relative; }

                .he2    { background-color:#C0D2DE; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:30px; margin-right:0px; padding-left:8px; padding-right:5em; padding-top:4px; position:relative; }

                .he3    { background-color:#D9E3EA; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:40px; margin-right:0px; padding-left:11px; padding-right:5em; padding-top:4px; position:relative; }

                .he4    { background-color:#E8E8E8; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:50px; margin-right:0px; padding-left:11px; padding-right:5em; padding-top:4px; position:relative; }

                .he4h   { background-color:#E8E8E8; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:55px; margin-right:0px; padding-left:11px; padding-right:5em; padding-top:4px; position:relative; }

                .he4i   { background-color:#F9F9F9; border:1px solid #BBBBBB; color:#000000; display:block; font-family:MS Shell Dlg; font-size:100%; margin-bottom:-1px; margin-left:55px; margin-right:0px; padding-bottom:5px; padding-left:21px; padding-top:4px; position:relative; }

                .he2i   { background-color:#F9F9F9; border:1px solid #BBBBBB; color:#000000; display:block; font-family:MS Shell Dlg; font-size:100%; margin-bottom:-1px; margin-left:35px; margin-right:0px; padding-bottom:5px; padding-left:21px; padding-top:4px; position:relative;}
                .he5    { background-color:#E8E8E8; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:60px; margin-right:0px; padding-left:11px; padding-right:5em; padding-top:4px; position:relative; }

                .he5h   { background-color:#E8E8E8; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; padding-left:11px; padding-right:5em; padding-top:4px; margin-bottom:-1px; margin-left:65px; margin-right:0px; position:relative; }

                .he5i   { background-color:#F9F9F9; border:1px solid #BBBBBB; color:#000000; display:block; font-family:MS Shell Dlg; font-size:100%; margin-bottom:-1px; margin-left:65px; margin-right:0px; padding-left:21px; padding-bottom:5px; padding-top: 4px; position:relative; }

                div .expando { color:#000000; text-decoration:none; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:normal; position:absolute; right:10px; text-decoration:underline; z-index: 0; }

                .he0 .expando { font-size:100%; }

                .info, .info3, .info4, .disalign  { line-height:1.6em; padding:0px,0px,0px,0px; margin:0px,0px,0px,0px; }

                .disalign TD                      { padding-bottom:5px; padding-right:10px; }

                .info TD                          { padding-right:10px; width:50%; }

                .info3 TD                         { padding-right:10px; width:33%; }

                .info4 TD, .info4 TH              { padding-right:10px; width:25%; }

                .info TH, .info3 TH, .info4 TH, .disalign TH { border-bottom:1px solid #CCCCCC; padding-right:10px; }

                .subtable, .subtable3             { border:1px solid #CCCCCC; margin-left:0px; background:#FFFFFF; margin-bottom:10px; }

                .subtable TD, .subtable3 TD       { padding-left:10px; padding-right:5px; padding-top:3px; padding-bottom:3px; line-height:1.1em; }

                .subtable TH, .subtable3 TH       { border-bottom:1px solid #CCCCCC; font-weight:normal; padding-left:10px; line-height:1.6em;  }

                .subtable .footnote               { border-top:1px solid #CCCCCC; }

                .subtable3 .footnote, .subtable .footnote { border-top:1px solid #CCCCCC; }

                .subtable_frame     { background:#D9E3EA; border:1px solid #CCCCCC; margin-bottom:10px; margin-left:15px; }

                .subtable_frame TD  { line-height:1.1em; padding-bottom:3px; padding-left:10px; padding-right:15px; padding-top:3px; }

                .subtable_frame TH  { border-bottom:1px solid #CCCCCC; font-weight:normal; padding-left:10px; line-height:1.6em; }

                .subtableInnerHead { border-bottom:1px solid #CCCCCC; border-top:1px solid #CCCCCC; }

                .explainlink            { color:#0000FF; text-decoration:none; cursor:hand; }

                .explainlink:hover      { color:#0000FF; text-decoration:underline; }

                .spacer { background:transparent; border:1px solid #BBBBBB; color:#FFFFFF; display:block; font-family:MS Shell Dlg; font-size:100%; height:10px; margin-bottom:-1px; margin-left:43px; margin-right:0px; padding-top: 4px; position:relative; }

                .filler { background:transparent; border:none; color:#FFFFFF; display:block; font:100% MS Shell Dlg; line-height:8px; margin-bottom:-1px; margin-left:53px; margin-right:0px; padding-top:4px; position:relative; }

                .container { display:block; position:relative; }

                .rsopheader { background-color:#A0BACB; border-bottom:1px solid black; color:#333333; font-family:MS Shell Dlg; font-size:130%; font-weight:bold; padding-bottom:5px; text-align:center; }

                .rsopname { color:#333333; font-family:MS Shell Dlg; font-size:130%; font-weight:bold; padding-left:11px; }

                .gponame{ color:#333333; font-family:MS Shell Dlg; font-size:130%; font-weight:bold; padding-left:11px; }

                .gpotype{ color:#333333; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; padding-left:11px; }

                #uri    { color:#333333; font-family:MS Shell Dlg; font-size:100%; padding-left:11px; }

                #dtstamp{ color:#333333; font-family:MS Shell Dlg; font-size:100%; padding-left:11px; text-align:left; width:30%; }

                #objshowhide { color:#000000; cursor:hand; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; margin-right:0px; padding-right:10px; text-align:right; text-decoration:underline; z-index:2; word-wrap:normal; }

                #gposummary { display:block; }

                #gpoinformation { display:block; }

                @media print {

                    #objshowhide{ display:none; }

                    body    { color:#000000; border:1px solid #000000; }

                    .title  { color:#000000; border:1px solid #000000; }

                    .he0_expanded    { color:#000000; border:1px solid #000000; }

                    .he1h_expanded   { color:#000000; border:1px solid #000000; }

                    .he1_expanded    { color:#000000; border:1px solid #000000; }

                    .he1    { color:#000000; border:1px solid #000000; }

                    .he2    { color:#000000; background:#EEEEEE; border:1px solid #000000; }

                    .he3    { color:#000000; border:1px solid #000000; }

                    .he4    { color:#000000; border:1px solid #000000; }

                    .he4h   { color:#000000; border:1px solid #000000; }

                    .he4i   { color:#000000; border:1px solid #000000; }

                    .he5    { color:#000000; border:1px solid #000000; }

                    .he5h   { color:#000000; border:1px solid #000000; }

                    .he5i   { color:#000000; border:1px solid #000000; }

                    }

</style>
<!-- Scripts -->
<script type="text/javascript" language="javascript">
/*
String "strShowHide(0/1)"
0 = Hide all mode.
1 = Show all mode.
*/

var windowsArray = new Array();
var strShowHide = 1;

//Localized strings

var strShow = "show";
var strHide = "hide";
var strShowAll = "show all";
var strHideAll = "hide all";
var strShown = "shown";
var strHidden = "hidden";
var strExpandoNumPixelsFromEdge = "10px";


function IsSectionHeader(obj) {
    return (obj.className === "he0_expanded") || (obj.className === "he0h_expanded") || (obj.className === "he1h_expanded") || (obj.className === "he1_expanded") || (obj.className === "he1") || (obj.className === "he2") || (obj.className === "he3") || (obj.className === "he4") || (obj.className === "he4h") || (obj.className === "he5") || (obj.className === "he5h");
}

function IsSectionExpandedByDefault(objHeader) {
    if (objHeader === null) {
        return false;
    } else {
        return (objHeader.className.slice(objHeader.className.lastIndexOf("_")) === "_expanded");
    }
}

function SetSectionState(objHeader, strState) {
    var i = 0;
    var j;
    var all = objHeader.parentElement.ownerDocument.all;

    if (all === null) {
        return;
    }

    for (j = 0; j < all.length; j++) {
        if (all[j] === objHeader) {
            break;
        }
        i = i + 1;
    }

    for (j = i; j < all.length; j++) {
        if (all[i].className === "container") {
            break;
        }
        i = i + 1;
    }

    var objContainer = all[i];

    if (strState === "toggle") {
        if (objContainer.style.display === "none") {
            SetSectionState(objHeader, "show");
        }
        else {
            SetSectionState(objHeader, "hide");
        }
    }
    else {
        var objExpando = objHeader.children[1];

        if (strState === "show") {
            objContainer.style.display = "block";
            objExpando.innerText = strHide;
        }
        else if (strState === "hide") {
            objContainer.style.display = "none";
            objExpando.innerText = strShow;
        }
    }
}

function ShowSection(objHeader) {
    SetSectionState(objHeader, "show");
}

function HideSection(objHeader) {
    SetSectionState(objHeader, "hide");
}

function ToggleSection(objHeader) {
    SetSectionState(objHeader, "toggle");
}

/*================================================================================
' link at the top of the page to collapse/expand all collapsable elements
'================================================================================
*/
function objshowhide_onClick() {
    var obji;
    var objBody = document.body.getElementsByTagName("*");

    if (objBody === null) {
        return;
    }
    
    switch (strShowHide) {
        case 0:
            strShowHide = 1;
            window.objshowhide.innerText = strShowAll;
            for (obji = 0; obji < objBody.length; obji++) {
                if (objBody[obji].className !== 'undefined' && IsSectionHeader(objBody[obji])) {
                    HideSection(objBody[obji]);
                }
            }
            break;
        case 1:
            strShowHide = 0;
            window.objshowhide.innerText = strHideAll;
            for (obji = 0; obji < objBody.length; obji++) {
                if (objBody[obji].className !== 'undefined' && IsSectionHeader(objBody[obji])) {
                    ShowSection(objBody[obji]);
                }
            }
            break;
    }
}

/*================================================================================
' onload collapse all except the first two levels of headers (he0, he1)
'================================================================================*/
function window_onload() {
    // Only initialize once.  The UI may reinsert a report into the webbrowser control,
    // firing onLoad multiple times.
    if (document.documentElement.getAttribute("gpmc_reportInitialized").toUpperCase() !== "TRUE") {
        // Set text direction
        fDetDir(document.dir.toUpperCase());

        // Initialize sections to default expanded/collapsed state.
        var objBody = document.body.getElementsByTagName("*");

        if (objBody === null) {
            return;
        }

        for (var obji = 0; obji < objBody.length; obji++) {
            if (IsSectionHeader(objBody[obji])) {
                if (IsSectionExpandedByDefault(objBody[obji])) {
                    ShowSection(objBody[obji]);
                }
                else {
                    HideSection(objBody[obji]);
                }
            }
        }

        objshowhide.innerText = strShowAll;

        document.documentElement.setAttribute("gpmc_reportInitialized", "true");
    }
}

/*'================================================================================
' When direction (LTR/RTL) changes, change adjust for readability
'================================================================================
*/
function document_onPropertyChange() {
    if (window.event.propertyName === "dir") {
        fDetDir(document.dir.toUpperCase());
    }
}

function fDetDir(strDir) {
    var colRules;
    var nug;
    var i;
    var strClass;

    switch (strDir.toUpperCase()) {
        case "LTR":
            colRules = document.styleSheets[0].cssRules;
            if (colRules !== null && colRules !== undefined ) {            
                for (i = 0; i < colRules.length - 1; i++) {
                    nug = colRules[i];
                    strClass = nug.selectorText;
                    if (nug.style.textAlign === "right") {
                        nug.style.textAlign = "left";
                    }
                    switch (strClass) {
                        case "div .expando":
                            nug.style.Left = "";
                            nug.style.Right = strExpandoNumPixelsFromEdge;
                            break;
                        case "#objshowhide":
                            nug.style.textAlign = "right";
                            break;
                    }
                }
            }
            break;
        case "RTL":
            colRules = document.styleSheets[0].cssRules;
            if (colRules !== null && colRules !== undefined ) {            
                for (i = 0; i < colRules.length - 1; i++) {
                    nug = colRules[i];
                    strClass = nug.selectorText;
                    if (nug.style.textAlign === "left") {
                        nug.style.textAlign = "right";
                    }
                    switch (strClass) {
                        case "div .expando":
                            nug.style.Left = strExpandoNumPixelsFromEdge;
                            nug.style.Right = "";
                            break;
                        case "#objshowhide":
                            nug.style.textAlign = "left";
                            break;
                    }
                }
            }
            break;
    }
}

/*'================================================================================
'When printing reports, if a given section is expanded, let's says "shown" (instead of "hide" in the UI).
'================================================================================
*/
function window_onbeforeprint() {
    var obji;
    for (obji in document.all) {
        if (document.all.hasOwnProperty(obji)) {
            if (obji.className === "expando") {
                if (obji.innerText === strHide) {
                    obji.innerText = strShown;
                }
                if (obji.innerText === strShow) {
                    obji.innerText = strHidden;
                }
            }
        }
    }
}

/*================================================================================
'If a section is collapsed, change to "hidden" in the printout (instead of "show").
'================================================================================
*/
function window_onafterprint() {
    var obji;
    for (obji in document.all) {
        if (document.all.hasOwnProperty(obji)) {
            if (obji.className === "expando") {
                if (obji.innerText === strShown) {
                    obji.innerText = strHide;
                }
                if (obji.innerText === strHidden) {
                    obji.innerText = strShow;
                }
            }
        }
    }
}

/*================================================================================
' Adding keypress support for accessibility
'================================================================================
*/
function document_onkeypress(event) {
    var chCode = ('charCode' in event) ? event.charCode : event.keyCode;

    //space bar (32) or carriage return (13) or line feed (10)
    if (chCode == "32" || chCode == "13" || chCode == "10") {
        if (event.srcElement.className === "expando") {
            document_onclick();
            event.returnValue = false;
        }
        if (event.srcElement.className === "sectionTitle") {
            document_onclick();
            event.returnValue = false;
        }
        if (event.srcElement.id === "objshowhide") {
            objshowhide_onClick();
            event.returnValue = false;
        }
    }
}

/*================================================================================
' When user clicks anywhere in the document body, determine if user is clicking
' on a header element.
'================================================================================
*/
function document_onclick() {
    var strsrc = window.event.srcElement;

    while (strsrc.className === "sectionTitle" || strsrc.className === "expando") {
        strsrc = strsrc.parentElement;
    }

    // Only handle clicks on headers.
    if (!IsSectionHeader(strsrc)) {
        return;
    }

    ToggleSection(strsrc);

    window.event.returnValue = false;
}

function ToggleState(e) {
    var objParentDisplayItem;
    var objDisplayItem;
    var i;

    if (e.innerText === strShow) {
        e.innerText = strHide;
        objParentDisplayItem = e.parentNode;
        objDisplayItem = objParentDisplayItem.childNodes;
        for (i = 0; i < objDisplayItem.length; i++) {
            if (objDisplayItem[i].id === "showItem") {
                objDisplayItem[i].style.display = "Block";
            }
        }
    }
    else {
        e.innerText = strShow;
        objParentDisplayItem = e.parentNode;
        objDisplayItem = objParentDisplayItem.childNodes;
        for (i = 0; i < objDisplayItem.length; i++) {
            if (objDisplayItem[i].id === "showItem") {
                objDisplayItem[i].style.display = "None";
            }
        }
    }
}

function traverseToURL(url) {
    if (url != null) {
        var urlInitialSubstr = url.substring(0, 4).toLowerCase();
        if (urlInitialSubstr === "http") {
            window.open(url, "_blank");
        }
    }
}

function getExplainWindowTitle() {
    return document.getElementById("explainText_windowTitle").innerHTML;
}

function getExplainWindowStyles() {
    return document.getElementById("explainText_windowStyles").innerHTML;
}

function getExplainWindowSettingPathLabel() {
    return document.getElementById("explainText_settingPathLabel").innerHTML;
}

function getExplainWindowExplainTextLabel() {
    return document.getElementById("explainText_explainTextLabel").innerHTML;
}

function getExplainWindowPrintButton() {
    return document.getElementById("explainText_printButton").innerHTML;
}

function getExplainWindowCloseButton() {
    return document.getElementById("explainText_closeButton").innerHTML;
}

function getNoExplainTextAvailable() {
    return document.getElementById("explainText_noExplainTextAvailable").innerHTML;
}

function getExplainWindowSupportedLabel() {
    return document.getElementById("explainText_supportedLabel").innerHTML;
}

function getNoSupportedTextAvailable() {
    return document.getElementById("explainText_noSupportedTextAvailable").innerHTML;
}

function showExplainText(srcElement)
{
    var strDiagArgs;

    var strSettingName = srcElement.getAttribute("gpmc_settingName");
    var strSettingPath = srcElement.getAttribute("gpmc_settingPath");
    var strSettingDescription = srcElement.getAttribute("gpmc_settingDescription");

    if (strSettingDescription === "")
    {
        strSettingDescription = getNoExplainTextAvailable();
    }

    var strSupported = srcElement.getAttribute("gpmc_supported");

    if (strSupported === "")
    {
        strSupported = getNoSupportedTextAvailable();
    }

    var strHtml = "<html dir=" + document.dir +  ">\n";
    strHtml += "<head>\n";
    strHtml += "<title>" + getExplainWindowTitle() + "</title>\n";
    strHtml += "<style type='text/css'>\n" + getExplainWindowStyles() + "</style>\n";
    strHtml += "</head>\n";
    strHtml += "<body>\n";
    strHtml += "<div class='head'>" + strSettingName +"</div>\n";
    strHtml += "<div class='path'><b>" + getExplainWindowSettingPathLabel() + "</b><br/>" + strSettingPath +"</div>\n";
    strHtml += "<div class='path'><b>" + getExplainWindowSupportedLabel() + "</b><br/>" + strSupported +"</div>\n";
    strHtml += "<div class='info'>\n";
    strHtml += "<div class='hdr'>" + getExplainWindowExplainTextLabel() + "</div>\n";
    strHtml += "<div class='bdy'>" + strSettingDescription + "</div>\n";
    strHtml += "<div class='btn'>";
    strHtml += getExplainWindowPrintButton();
    strHtml += getExplainWindowCloseButton();
    strHtml += "</div></body></html>";

    // IE specific method for showing the popup.
    if(navigator.userAgent.indexOf("MSIE") > 0 && window.location.toString().indexOf("file:") === -1)
    {
        strDiagArgs = "dialogHeight=360px;dialogWidth=630px;status=no;scroll=yes;resizable=yes;minimize=yes;maximize=yes;";

        var vModeless = window.showModelessDialog("about:blank", window, strDiagArgs);
        vModeless.document.write(strHtml);
        vModeless.document.close();
        vModeless.location.reload(false);
                        
        window.event.returnValue = false;
    }
    else
    {
        strDiagArgs = "height=360px, width=630px, status=no, toolbar=no, scrollbars=yes, resizable=yes ";
        
        var expWin = window.open("", "expWin", strDiagArgs);
        expWin.document.write("");
        expWin.document.close();
        expWin.document.write(strHtml);
        expWin.document.close();
        expWin.focus();
    }
    
    return false;
}

function showEvents(srcElement,bVerbose,bInformational,bWarning,bError)
{
    var strWindowId = "EventDetails_" + srcElement.getAttribute("eventLogActivityId");
    if((windowsArray[strWindowId]) && (windowsArray[strWindowId].closed === false)) {
        windowsArray[strWindowId].focus();
    } else {
        var eventIdLabelNode, eventTimeLabelNode, eventDescriptionLabelNode, eventDetailsLabelNode, eventXmlLabelNode, gpEventsTitleNode;
        var eventIdLabelNodeText, eventTimeLabelNodeText, eventDescriptionLabelNodeText, eventXmlLabelNodeText, gpEventsTitleNodeText, eventDetailsLabelNodeText;
        var singlePassEventsDetailsNode, eventRecordArray;
        var dataNotFoundWarningLabelNode, dataNotFoundWarningLabelNodeText;
        var mainSection;
        var attributeValue;
        var singlePassEventsDetails;
        var singlePassEventsDetailsChildren;
        var node;
        var children;
        var xmlDocumentRoot;
        var xmlDocument;
        var serializer;
        var itemSub;
        var doc;

        if (window.XMLSerializer) 
        {
           serializer = new XMLSerializer();
        }

        if (window.DOMParser) 
        {
           // This browser appears to support DOMParser
           parser = new DOMParser();

           doc = document.getElementById("data-island").textContent;
           xmlDocumentRoot = parser.parseFromString(doc, "application/xml");
           xmlDocument = xmlDocumentRoot.documentElement;
           itemSub = 1;
        } 
        else 
        { 
           // Internet Explorer, create a new XML document using ActiveX 
           // and use loadXML as a DOM parser. 
           try 
           {
              doc = document.getElementById("data-island");

              xmlDocumentRoot = new ActiveXObject("Msxml2.DOMDocument.6.0"); 
              xmlDocumentRoot.async = false; 
              xmlDocumentRoot.loadXML(doc.innerHTML);
              xmlDocument = xmlDocumentRoot.documentElement;
              itemSub = 0;
           } 
           catch(e) 
           {
              // Not supported.
           }
        }

        if (xmlDocument != null) {
            mainSection = xmlDocument.getElementsByTagName("MainSection")[0].childNodes;

            if (mainSection != null) {
                for (children = 0; children < mainSection.length; children++) {
                    node = mainSection[children];
                    if (node.nodeType === 1 && node.nodeName === 'Label') {
                        attributeValue = node.getAttribute("Name");
                        if (attributeValue != null) {
                            if (attributeValue === 'ComponentStatus_EventId') {
                                eventIdLabelNode = node.childNodes[1];
                            }
                            if (attributeValue === 'ComponentStatus_EventTime') {
                                eventTimeLabelNode = node.childNodes[1];
                            }
                            if (attributeValue === 'ComponentStatus_EventDescription') {
                                eventDescriptionLabelNode = node.childNodes[1];
                            }
                            if (attributeValue === 'ComponentStatus_EventXml') {
                                eventXmlLabelNode = node.childNodes[1];
                            }
                            if (attributeValue === 'ComponentStatus_EventDetails') {
                                eventDetailsLabelNode = node.childNodes[1];
                            }
                            if (attributeValue === 'ComponentStatus_GPEvents') {
                                gpEventsTitleNode = node.childNodes[1];
                            }
                            if (attributeValue === 'Warning_DataNotFound') {
                                dataNotFoundWarningLabelNode = node.childNodes[1];
                            }
                        }
                    }
                }
            }

            singlePassEventsDetails = xmlDocument.getElementsByTagName("SinglePassEventsDetails");
            if (singlePassEventsDetails != null) {
                for (singlePassEventsDetailsChildren = 0; singlePassEventsDetailsChildren < singlePassEventsDetails.length; singlePassEventsDetailsChildren++) {
                    node = singlePassEventsDetails[singlePassEventsDetailsChildren];
                    attributeValue = node.getAttribute("ActivityId");
                    if (attributeValue === srcElement.getAttribute("eventLogActivityId")) {
                        singlePassEventsDetailsNode = node;
                    }
                }
            }
        }
        
        eventIdLabelNodeText = null;
        if (eventIdLabelNode != null) {
            if (eventIdLabelNode.childNodes.length > 0) {
                eventIdLabelNodeText = eventIdLabelNode.childNodes[0].nodeValue;
            }
        }
        if (eventIdLabelNodeText == null) {
            eventIdLabelNodeText = "Event ID";
        }

        eventTimeLabelNodeText = null;
        if (eventTimeLabelNode != null) {
            if (eventTimeLabelNode.firstChild.childNodes.length > 0) {
                eventTimeLabelNodeText = eventTimeLabelNode.childNodes[0].nodeValue;
            }
        }
        if (eventTimeLabelNodeText == null) {
            eventTimeLabelNodeText = "Event Time";
        }

        eventDescriptionLabelNodeText = null;
        if (eventDescriptionLabelNode != null) {
            if (eventDescriptionLabelNode.childNodes.length > 0) {
                eventDescriptionLabelNodeText = eventDescriptionLabelNode.childNodes[0].nodeValue;
            }
        }
        if (eventDescriptionLabelNodeText == null) {
            eventDescriptionLabelNodeText = "Event Description";
        }

        eventXmlLabelNodeText = null;
        if (eventXmlLabelNode != null) {
            if (eventXmlLabelNode.childNodes.length > 0) {
                eventXmlLabelNodeText = eventXmlLabelNode.childNodes[0].nodeValue;
            }
        }
        if (eventXmlLabelNodeText == null) {
            eventXmlLabelNodeText = "Event XML";
        }

        gpEventsTitleNodeText = null;
        if (gpEventsTitleNode != null) {
            if (gpEventsTitleNode.childNodes.length > 0) {
                gpEventsTitleNodeText = gpEventsTitleNode.childNodes[0].nodeValue;
            }
        }
        if (gpEventsTitleNodeText == null) {
            gpEventsTitleNodeText = "Group Policy Events";
        }

        eventDetailsLabelNodeText = null;
        if (eventDetailsLabelNode != null) {
            if (eventDetailsLabelNode.childNodes.length > 0) {
                eventDetailsLabelNodeText = eventDetailsLabelNode.childNodes[0].nodeValue;
            }
        }
        if (eventDetailsLabelNodeText == null) {
            eventDetailsLabelNodeText = "Event Details";
        }

        dataNotFoundWarningLabelNodeText = null;
        if (dataNotFoundWarningLabelNode != null) {
            if (dataNotFoundWarningLabelNode.childNodes.length > 0) {
                dataNotFoundWarningLabelNodeText = dataNotFoundWarningLabelNode.childNodes[0].nodeValue;
            }
        }
        if (dataNotFoundWarningLabelNodeText == null) {
            dataNotFoundWarningLabelNodeText = "Data Not Found";
        }
                
        if(singlePassEventsDetailsNode != null)
        {
            eventRecordArray = singlePassEventsDetailsNode.getElementsByTagName("EventRecord");
        }
        
        var htmlText = "<html dir=" + document.dir +  ">";
        htmlText = htmlText + "<head>";
        htmlText = htmlText + "<meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\" />";
        htmlText = htmlText + "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-16\" />";
        htmlText = htmlText + "<title>" + gpEventsTitleNodeText + "</title>";
        htmlText = htmlText + "</head><style type=\"text/css\">";
        htmlText = htmlText + "body    { background-color:#FFFFFF; color:#000000; font-size:68%; font-family:MS Shell Dlg; margin:0,0,10px,0; word-break:normal; word-wrap:break-word; }";
        htmlText = htmlText + "table   { font-size:100%; table-layout:fixed; width:100%; }";
        htmlText = htmlText + "td,th   { overflow:visible; text-align:left; vertical-align:top; white-space:normal; }";
        htmlText = htmlText + ".he1    { text-align: center; vertical-align: middle; background-color:#C0D2DE; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:4em; position:relative; }";
        htmlText = htmlText + ".centerTxt { text-align: center; }";
        htmlText = htmlText + ".txtFormat1 { text-align: left; vertical-align:top; white-space:pre-line; }";
        htmlText = htmlText + "</style>";
      
        htmlText = htmlText + "<script> function toggle(e) {";
        htmlText = htmlText + "if (e.style.display === \"none\"){ e.style.display = \"\"; }";
        htmlText = htmlText + "else { e.style.display = \"none\"; }";
        htmlText = htmlText + "}</";
        htmlText = htmlText + "script";
        htmlText = htmlText + ">";
      
        htmlText = htmlText + "<body><table border=1><tr>";
        htmlText = htmlText + "<th class=\"he1\"><strong>" + eventIdLabelNodeText + "</strong></th>";
        htmlText = htmlText + "<th class=\"he1\"><strong>" + eventTimeLabelNodeText + "</strong></th>";
        htmlText = htmlText + "<th class=\"he1\"><strong>" + eventDescriptionLabelNodeText + "</strong></th>";
        htmlText = htmlText + "<th class=\"he1\"><strong>" + eventDetailsLabelNodeText + "</strong></th>";

        htmlText = htmlText + "</tr>";
        var i;
        var eventId;
        var eventTime;
        var eventDescription;
        var eventXml;
        var eventType;
        var displayEvent;
        var eventXmlId;
        var displayBgColor;

        if(eventRecordArray != null && eventRecordArray.length > 0)
        {
            for (i=0; i < eventRecordArray.length; i++)
            {
                displayEvent = false;
                var eventIdElements = eventRecordArray[i].getElementsByTagName("EventId");        
                if((eventIdElements != null) && (eventIdElements.length > 0) && (eventIdElements[0].firstChild != null))
                {
                    eventId =  eventIdElements[0].firstChild.nodeValue;
                }
                else
                {
                    eventId =  dataNotFoundWarningLabelNodeText;
                }
                var eventTimeElements = eventRecordArray[i].getElementsByTagName("EventTime");
                if((eventTimeElements != null) && (eventTimeElements.length > 0) && (eventTimeElements[0].firstChild != null))
                {
                    eventTime = eventTimeElements[0].firstChild.nodeValue;
                }
                else
                {
                    eventTime = dataNotFoundWarningLabelNodeText;
                }
                var eventDescriptionElements = eventRecordArray[i].getElementsByTagName("EventDescription");
                if((eventDescriptionElements != null) && (eventDescriptionElements.length > 0) && (eventDescriptionElements[0].firstChild != null))
                {
                        eventDescription = eventDescriptionElements[0].firstChild.nodeValue;
                }
                else
                {
                    eventDescription = dataNotFoundWarningLabelNodeText;
                }
                var eventXmlElements = eventRecordArray[i].getElementsByTagName("EventXml");
                if((eventXmlElements != null) && (eventXmlElements.length > 0) && (eventXmlElements[0].firstChild != null))
                {
                    if (window.XMLSerializer) 
                    {
                       var xml = serializer.serializeToString(eventXmlElements[0].firstChild);
                       eventXml = xml;
                    } 
                    else 
                    {
                       if (typeof eventXmlElements[0].firstChild.xml != "undefined") 
                       {
                          eventXml = eventXmlElements[0].firstChild.xml;
                       }
                    }
                }
                else
                {
                    eventXml = dataNotFoundWarningLabelNodeText;
                }
                var eventLevelElements = eventRecordArray[i].getElementsByTagName("EventLevel");
                if((eventLevelElements != null) && (eventLevelElements.length > 0) && (eventLevelElements[0].firstChild != null))
                {
                    eventType = eventLevelElements[0].firstChild.nodeValue;
                }
                else
                {
                    eventType = 5;
                }
                
                if((bVerbose === true)&&(eventType == 5))
                {
                    displayEvent = true;
                }
                else if((bInformational === true)&&(eventType == 4))
                {
                    displayEvent = true;
                }
                else if((bWarning === true)&&(eventType == 3))
                {
                    displayEvent = true;
                }
                else if((bError === true)&&((eventType == 1)||(eventType == 2)))
                {
                    displayEvent = true;
                }
                
                if (displayEvent === true)
                {
                    eventXmlId = "EventXml" + (i+"");
                    htmlText = htmlText + "<tr>";
                    htmlText = htmlText + "<td class=\"centerTxt\" style=\"background:" + displayBgColor +"\">" + eventId + "</td>";
                    htmlText = htmlText + "<td class=\"centerTxt\" style=\"background:" + displayBgColor +"\">" + eventTime + "</td>";
                    htmlText = htmlText + "<td class=\"txtFormat1\" style=\"background:" + displayBgColor +"\">" + eventDescription + "</td>";
                    htmlText = htmlText + "<td style=\"background:" + displayBgColor +"\"><span style=\"color:blue; cursor:hand\" onclick=\"toggle(" + eventXmlId +");\" onKeyPress=\"toggle(" + eventXmlId + ");\" tabIndex=1 >";
                    htmlText = htmlText + eventXmlLabelNodeText + "</span><br/>";
                    htmlText = htmlText + "<span style=\"display:none\" id=" + eventXmlId +">";
                    htmlText = htmlText + eventXml + "</span>";
                    htmlText = htmlText + "</td>";
                    htmlText = htmlText + "</tr>";
                }
            }
        }
        htmlText = htmlText + "</table></body></html>";

        if(windowsArray[strWindowId])
        {
            delete windowsArray[strWindowId];
        }
        
        // IE specific method for showing the popup.
        if(navigator.userAgent.indexOf("MSIE") > 0 && window.location.toString().indexOf("file:") === -1)
        {
            var strDiagArgs = "dialogHeight=360px;dialogWidth=630px;status=no;scroll=yes;resizable=yes;minimize=yes;maximize=yes;";

            var vModeless = window.showModelessDialog("about:blank", window, strDiagArgs);
            vModeless.document.write(htmlText);
            vModeless.document.close();
            vModeless.location.reload(false);
            windowsArray[strWindowId] = vModeless;            
        }
        else
        {
            var strDiagArgs = "height=360px, width=630px, status=no, toolbar=no, scrollbars=yes, resizable=yes";
        
            windowsArray[strWindowId] = window.open("", "", strDiagArgs);
            windowsArray[strWindowId].document.write(htmlText);
            windowsArray[strWindowId].focus();
        } 
    }

    xmlDocumentRoot = null;
}

function cleanUp() {
    var windowsArray = this.windowsArray;
    for (var currentWindow in windowsArray) {
        if (windowsArray.hasOwnProperty(currentWindow)) {
            windowsArray[currentWindow].close();
        }
    }
}

function getMessageText(messageNode) {
    if (messageNode != null) {
        if (messageNode.firstChild != null) {
            if (messageNode.firstChild.nodeType === 3) {
                for (var i = 0; i < messageNode.childNodes.length; i++) 
                {
                    var curNode = messageNode.childNodes[i];
                    if(curNode.nodeType === 1){
                        return curNode.childNodes[0].nodeValue;
                    }
                }
            } else {
                return messageNode.firstChild.childNodes[0].nodeValue;
            }
        }
    }
    return null;
}

function showComponentProcessingDetails(srcElement) {
    var strWindowId = "ProcessingDetails_" + srcElement.getAttribute("eventLogActivityId");
    if ((windowsArray[strWindowId]) && (windowsArray[strWindowId].closed === false)) {
        windowsArray[strWindowId].focus();
    } else {
        var doc;
        var parser;
        var xmlDocumentRoot;
        var xmlDocument;

        var extensionsProcessedLabelNode, slowLinkThresholdLabelNode, linkSpeedLabelNode, extensionsProcessedTimeTakenNode;
        var domainControllerIpLabelNode, domainControllerNameLabelNode, processingTypeLabelNode, loopbackModeLabelNode;
        var processingTriggerLabelNode, extensionNameLabelNode, timeTakenLabelNode;
        var dataNotFoundWarningLabelNode;
        var singlePassEventsDetailsNode, totalProcessingTimeLabelNode, refreshMessageLabelNode;
        var processingDetailsUserTitleNode, processingDetailsComputerTitleNode;
        var policySectionNode;
        var policyEventsDetailsNode, detailsLabelNode;

        var extensionsProcessedLabelNodeText, slowLinkThresholdLabelNodeText, linkSpeedLabelNodeText, extensionsProcessedTimeTakenNodeText;
        var domainControllerIpLabelNodeText, domainControllerNameLabelNodeText, processingTypeLabelNodeText, loopbackModeLabelNodeText;
        var processingTriggerLabelNodeText, extensionNameLabelNodeText, timeTakenLabelNodeText;
        var dataNotFoundWarningLabelNodeText, totalProcessingTimeLabelNodeText, refreshMessageLabelNodeText;
        var processingDetailsUserTitleNodeText, processingDetailsComputerTitleNodeText;
        var detailsLabelNodeText;

        var slowLinkThresholdValue, linkSpeedValue, domainControllerIpValue, domainControllerNameValue;
        var processingTypeValue, loopbackModeValue, processingTriggerValue, totalPolicyProcessingTime, extensionProcessingTimeArray;
        var cseNameArray = new Array();
        var cseElapsedTimeArray = new Array();
        var policyApplicationFinishedTime;

        var isComputerProcessing;
        var strDiagArgs;
        var mainSection;
        var attributeValue;
        var singlePassEventsDetails;
        var singlePassEventsDetailsChildren;
        var node;
        var children;
        var itemSub;

        if (window.DOMParser) 
        {
           // This browser appears to support DOMParser
           parser = new DOMParser();
           doc = document.getElementById("data-island").textContent;

           xmlDocumentRoot = parser.parseFromString(doc, "application/xml");

           xmlDocument = xmlDocumentRoot.documentElement;

           itemSub = 1;
        } 
        else 
        { 
           // Internet Explorer, create a new XML document using ActiveX 
           // and use loadXML as a DOM parser. 
           try 
           {
              doc = document.getElementById("data-island");

              xmlDocumentRoot = new ActiveXObject("Msxml2.DOMDocument.6.0"); 
              xmlDocumentRoot.async = false; 
              xmlDocumentRoot.loadXML(doc.innerHTML);
              xmlDocument = xmlDocumentRoot.documentElement;
              itemSub = 0;
           } 
           catch(e) 
           {
              // Not supported.
           }
        }

        if (xmlDocument != null) {
            mainSection = xmlDocument.getElementsByTagName("MainSection")[0].childNodes;

            if (mainSection != null) {
                for (children = 0; children < mainSection.length; children++) {
                    node = mainSection[children];
                    if (node.nodeType === 1 && node.nodeName === 'Label') {
                        attributeValue = node.getAttribute("Name")
                        if (attributeValue != null) {
                            if (attributeValue === 'ComponentStatus_ExtensionsProcessed') {
                                extensionsProcessedLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_SlowLinkThreshold') {
                                slowLinkThresholdLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_LinkSpeed') {
                                linkSpeedLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_TimeTaken') {
                                extensionsProcessedTimeTakenNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_DomainControllerIP') {
                                domainControllerIpLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_DomainControllerName') {
                                domainControllerNameLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_ProcessingTrigger') {
                                processingTriggerLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_ExtensionName') {
                                extensionNameLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_TimeTaken') {
                                timeTakenLabelNode = node;
                            }
                            if (attributeValue === 'Warning_DataNotFound') {
                                dataNotFoundWarningLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_TotalProcessingTime') {
                                totalProcessingTimeLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_RefreshMessage') {
                                refreshMessageLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_UserProcessingDetails') {
                                processingDetailsUserTitleNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_ComputerProcessingDetails') {
                                detailsLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_ProcessingType') {
                                processingTypeLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_LoopbackMode') {
                                loopbackModeLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_UserProcessingDetails') {
                                processingDetailsUserTitleNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_ComputerProcessingDetails') {
                                processingDetailsComputerTitleNode = node;
                            }
                        }
                    }
                }
            }

            singlePassEventsDetails = xmlDocument.getElementsByTagName("SinglePassEventsDetails");
            if (singlePassEventsDetails != null) {
                for (singlePassEventsDetailsChildren = 0; singlePassEventsDetailsChildren < singlePassEventsDetails.length; singlePassEventsDetailsChildren++) {
                    node = singlePassEventsDetails[singlePassEventsDetailsChildren];
                    if (node.getAttribute("ActivityId") === srcElement.getAttribute("eventLogActivityId")) {
                        singlePassEventsDetailsNode = node;
                    }
                }
            }

            if (singlePassEventsDetailsNode) {
                policyEventsDetailsNode = singlePassEventsDetailsNode.parentNode;
                if (policyEventsDetailsNode) {
                    policySectionNode = policyEventsDetailsNode.parentNode;
                    if (policySectionNode) {
                        if (policySectionNode.nodeName === 'UserPolicySection') {
                            isComputerProcessing = false;
                        }
                        if (policySectionNode.nodeName === 'ComputerPolicySection') {
                            isComputerProcessing = true;
                        }
                    }
                }
            }
        }

        
        extensionsProcessedLabelNodeText = getMessageText(extensionsProcessedLabelNode);
        slowLinkThresholdLabelNodeText = getMessageText(slowLinkThresholdLabelNode);
        linkSpeedLabelNodeText = getMessageText(linkSpeedLabelNode);
        domainControllerIpLabelNodeText = getMessageText(domainControllerIpLabelNode);
        domainControllerNameLabelNodeText = getMessageText(domainControllerNameLabelNode);
        processingTypeLabelNodeText = getMessageText(processingTypeLabelNode);
        loopbackModeLabelNodeText = getMessageText(loopbackModeLabelNode);
        processingTriggerLabelNodeText = getMessageText(processingTriggerLabelNode);
        extensionNameLabelNodeText = getMessageText(extensionNameLabelNode);
        timeTakenLabelNodeText = getMessageText(timeTakenLabelNode);
        processingDetailsUserTitleNodeText = getMessageText(processingDetailsUserTitleNode);
        processingDetailsComputerTitleNodeText = getMessageText(processingDetailsComputerTitleNode);
        dataNotFoundWarningLabelNodeText = getMessageText(dataNotFoundWarningLabelNode);
        totalProcessingTimeLabelNodeText = getMessageText(totalProcessingTimeLabelNode);
        refreshMessageLabelNodeText = getMessageText(refreshMessageLabelNode);
        detailsLabelNodeText = getMessageText(detailsLabelNode);
     

        slowLinkThresholdValue = null;
        linkSpeedValue = null;
        domainControllerIpValue = null;
        domainControllerNameValue = null;
        processingTypeValue = null;
        loopbackModeValue = null;
        processingTriggerValue = null;

        if (singlePassEventsDetailsNode != null) {
            slowLinkThresholdValue = singlePassEventsDetailsNode.getAttribute("SlowLinkThresholdInKbps");
            linkSpeedValue = singlePassEventsDetailsNode.getAttribute("LinkSpeedInKbps");
            domainControllerIpValue = singlePassEventsDetailsNode.getAttribute("DomainControllerIPAddress");
            domainControllerNameValue = singlePassEventsDetailsNode.getAttribute("DomainControllerName");
            processingTypeValue = singlePassEventsDetailsNode.getAttribute("ProcessingAppMode");
            loopbackModeValue = singlePassEventsDetailsNode.getAttribute("PolicyProcessingMode");
            processingTriggerValue = singlePassEventsDetailsNode.getAttribute("ProcessingTrigger");
            totalPolicyProcessingTime = singlePassEventsDetailsNode.getAttribute("PolicyElapsedTime");
            extensionProcessingTimeArray = singlePassEventsDetailsNode.getElementsByTagName("ExtensionProcessingTime");
        }
        if (slowLinkThresholdValue == null) {
            slowLinkThresholdValue = dataNotFoundWarningLabelNodeText;
        }
        if (linkSpeedValue == null) {
            linkSpeedValue = dataNotFoundWarningLabelNodeText;
        }
        if (domainControllerIpValue == null) {
            domainControllerIpValue = dataNotFoundWarningLabelNodeText;
        }
        else {
            domainControllerIpValue = domainControllerIpValue.replace(/^\\\\/, "");
        }
        if (domainControllerNameValue == null) {
            domainControllerNameValue = dataNotFoundWarningLabelNodeText;
        }
        else {
            domainControllerNameValue = domainControllerNameValue.replace(/^\\\\/, "");
        }
        if (processingTypeValue == null) {
            processingTypeValue = dataNotFoundWarningLabelNodeText;
        }
        if (loopbackModeValue == null) {
            loopbackModeValue = dataNotFoundWarningLabelNodeText;
        }
        if (processingTriggerValue == null) {
            processingTriggerValue = dataNotFoundWarningLabelNodeText;
        }

        if (extensionProcessingTimeArray != null && extensionProcessingTimeArray.length > 0) {
            var cseName;
            var cseElapsedTime;
            var cseProcessedTime;
            var cseId;
            var i;
            var index = 0;
            for (i = 0; i < extensionProcessingTimeArray.length; i++) {
                var cseNameElements = extensionProcessingTimeArray[i].getElementsByTagName("ExtensionName");
                var cseElapsedTimeElements = extensionProcessingTimeArray[i].getElementsByTagName("ElapsedTime");
                var cseProcessedTimeElements = extensionProcessingTimeArray[i].getElementsByTagName("ProcessedTime");
                var cseIdElements = extensionProcessingTimeArray[i].getElementsByTagName("ExtensionGuid");
                if ((cseNameElements.length > 0) && (cseElapsedTimeElements.length > 0) && (cseProcessedTimeElements.length > 0) && (cseIdElements.length > 0)) {
                    if ((cseNameElements[0].firstChild != null) && (cseElapsedTimeElements[0].firstChild != null) && (cseProcessedTimeElements[0].firstChild != null) && (cseIdElements[0].firstChild != null)) {
                        cseName = cseNameElements[0].firstChild.nodeValue;
                        cseElapsedTime = cseElapsedTimeElements[0].firstChild.nodeValue;
                        cseProcessedTime = cseProcessedTimeElements[0].firstChild.nodeValue;
                        cseId = cseIdElements[0].firstChild.nodeValue;
                        if ((cseName != null) && (cseElapsedTime != null) && (cseProcessedTime != null) && (cseId != null)) {
                            cseNameArray[index] = cseName;
                            cseElapsedTimeArray[index] = cseElapsedTime;
                            index = index + 1;
                            if (cseId === '{00000000-0000-0000-0000-000000000000}') {
                                policyApplicationFinishedTime = cseProcessedTime;
                            }
                        }
                    }
                }
            }
        }
          
        var htmlText = "<html dir=" + document.dir +  ">";
        htmlText = htmlText + "<head>";
        htmlText = htmlText + "<meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\" />";
        htmlText = htmlText + "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-16\" />";
        if(isComputerProcessing != null)
        {
            if(isComputerProcessing === true)
            {
                htmlText = htmlText + "<title>" + processingDetailsComputerTitleNodeText + "</title>";
            }
            else
            {
                htmlText = htmlText + "<title>" + processingDetailsUserTitleNodeText + "</title>";
            }
        }
        

        htmlText = htmlText + "</head><style type=\"text/css\">";
        htmlText = htmlText + "body    { background-color:#FFFFFF; color:#000000; font-size:68%; font-family:MS Shell Dlg; margin:0,0,10px,0; word-break:normal; word-wrap:break-word; }";
        htmlText = htmlText + "table   { font-size:100%; table-layout:fixed; width:100%; }";
        htmlText = htmlText + "td,th   { overflow:visible; text-align:left; vertical-align:top; white-space:normal; }";
        htmlText = htmlText + ".he0    { background-color:#FEF7D6; border:1px solid #BBBBBB; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:0px; margin-right:0px; padding-left:8px; padding-right:5em; padding-top:4px; position:relative; width:100%; }";
        htmlText = htmlText + ".he1    { color:#000000; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2em;margin-left: 5 px; margin-top: 5 px; position:relative; width:100%; }";
        htmlText = htmlText + ".tblspecialfmt { border:1px solid black;border-collapse:collapse; }";
        htmlText = htmlText + ".tblfirstcolfmt { border-left-width: 1px;border-top-width: 1px;border-bottom-width: 1px;border-right-width: 0px;border-style: solid; border-color: black; }";
        htmlText = htmlText + ".tblsecondcolfmt { border-left-width: 0px;border-top-width: 1px;border-bottom-width: 1px;border-right-width: 1px;border-style: solid; border-color: black; }";
        htmlText = htmlText + "</style>";
        htmlText = htmlText + "<body>";
        htmlText = htmlText + "<span class=\"he1\">" + refreshMessageLabelNodeText + " " + policyApplicationFinishedTime + "</span>" ;
        htmlText = htmlText + "<div class=\"he0\">" + detailsLabelNodeText + "</div>"
        htmltext = htmlText + "<table><tr>";

        htmlText = htmlText + "<td>";
        htmlText = htmlText + "<table>";
        htmlText = htmlText + "<tr><td colspan=\"2\">&nbsp;</td></tr>";


        htmlText = htmlText + "<tr><td style=\"width: 50%\"><strong>" + processingTypeLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td>" + processingTypeValue + "</td></tr>";

        htmlText = htmlText + "<tr><td style=\"width: 50%\"><strong>" + loopbackModeLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td>" + loopbackModeValue + "</td></tr>";

        htmlText = htmlText + "<tr><td style=\"width: 50%\"><strong>" + linkSpeedLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td>" + linkSpeedValue + "</td></tr>";

        htmlText = htmlText + "<tr><td style=\"width: 50%\"><strong>" + slowLinkThresholdLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td>" + slowLinkThresholdValue + "</td></tr>";

        htmlText = htmlText + "<tr><td style=\"width: 50%\"><strong>" + domainControllerNameLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td>" + domainControllerNameValue +"</td></tr>";

        htmlText = htmlText + "<tr><td style=\"width: 50%\"><strong>" + domainControllerIpLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td>" + domainControllerIpValue +"</td></tr>";

        htmlText = htmlText + "<tr><td style=\"width: 50%\"><strong>" + processingTriggerLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td>" + processingTriggerValue + "</td></tr>";

        htmlText = htmlText + "</table></td></tr>";
        htmlText = htmlText + "<tr ><td ><table>";


        htmlText = htmlText + "<tr><td><span class=\"he1\" >" + extensionsProcessedLabelNodeText +"</span></td></tr>";
        htmlText = htmlText + "<tr><td><table class=\"tblspecialfmt\" >";
        htmlText = htmlText + "<tr><td class=\"tblfirstcolfmt\" style=\"width: 50%;background-color:#FEF7D6;\"><strong>" + extensionNameLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td class=\"tblsecondcolfmt\" style=\"background-color:#FEF7D6;\" ><strong>" + timeTakenLabelNodeText + "</strong></td></tr>";

        for (var idx in cseNameArray)
        {
            htmlText = htmlText + "<tr><td style=\"width: 50%\">" + cseNameArray[idx] + "</td>";                   
            htmlText = htmlText + "<td>" + cseElapsedTimeArray[idx] + "</td></tr>";
        }

        if (totalPolicyProcessingTime != null)
        {
            htmlText = htmlText + "<tr><td class=\"tblfirstcolfmt\" style=\"width: 50%\" >" + totalProcessingTimeLabelNodeText +":</td>";
            htmlText = htmlText + "<td class=\"tblsecondcolfmt\">" + totalPolicyProcessingTime + "</td></tr>";
        }
        htmlText = htmlText + "</table></td></tr></table></td></tr></table></body></html>";

        if(windowsArray[strWindowId])
        {
            delete windowsArray[strWindowId];
        }
         
        // IE specific method for showing the popup.
        if(navigator.userAgent.indexOf("MSIE") > 0 && window.location.toString().indexOf("file:") === -1)
        {
            strDiagArgs = "dialogHeight=360px;dialogWidth=630px;status=no;scroll=yes;resizable=yes;minimize=yes;maximize=yes;";

            var vModeless = window.showModelessDialog("about:blank", window, strDiagArgs);
            vModeless.document.write(htmlText);
            vModeless.document.close();
            vModeless.location.reload(false);
            windowsArray[strWindowId] = vModeless;                      
        }
        else
        {
            strDiagArgs = "height=360px, width=630px, status=no, toolbar=no, scrollbars=yes, resizable=yes";
        
            windowsArray[strWindowId] = window.open("", "" , strDiagArgs);
            windowsArray[strWindowId].document.write(htmlText);
            windowsArray[strWindowId].focus();
        }
    }

    xmlDocumentRoot = null;
}
</script>
</head>

<body onload="window_onload();" onclick="document_onclick();" onkeypress="document_onkeypress(event);" onunload="cleanUp();">

<!-- HTML resources -->
<div style="display:none;">
        <div id="explainText_windowTitle">Group Policy Management</div>
        <div id="explainText_windowStyles">
        
                            body  { font-size:68%;font-family:MS Shell Dlg; margin:0px,0px,0px,0px; border: 1px solid #666666; background:#F6F6F6; width:100%; word-break:normal; word-wrap:break-word; }

                            .head { font-weight:bold; font-size:160%; font-family:MS Shell Dlg; width:100%; color:#6587DC; background:#E3EAF9; border:1px solid #5582D2; padding-left:8px; height:24px; }

                            .path { margin-left: 10px; margin-top: 10px; margin-bottom:5px;width:100%; }

                            .info { padding-left:10px;width:100%; }

                            table { font-size:100%; width:100%; border:1px solid #999999; }

                            th    { border-bottom:1px solid #999999; text-align:left; padding-left:10px; height:24px; }

                            td    { background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; }

                            .btn  { width:100%; text-align:right; margin-top:16px; }

                            .hdr  { font-weight:bold; border:1px solid #999999; text-align:left; padding-top: 4px; padding-left:10px; height:24px; margin-bottom:-1px; width:100%; }

                            .bdy  { width:100%; height:182px; display:block; overflow:scroll; z-index:2; background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; border:1px solid #999999; }

                            button { width:6.9em; height:2.1em; font-size:100%; font-family:MS Shell Dlg; margin-right:15px; }

                            @media print {

                                .bdy { display:block; overflow:visible; }

                                button { display:none; }

                                .head { color:#000000; background:#FFFFFF; border:1px solid #000000; }

                            }

                
        </div>
        <div id="explainText_settingPathLabel">Setting Path:</div>
        <div id="explainText_explainTextLabel">Explanation</div>
        <div id="explainText_printButton">
        <button name="Print" onClick="window.print()" accesskey="P"><u>P</u>rint</button>

        </div>
        <div id="explainText_closeButton">
        <button name="Close" onClick="window.close()" accesskey="C"><u>C</u>lose</button>
                
        </div>
        <div id="explainText_noExplainTextAvailable">No explanation is available for this setting.</div>
        <div id="explainText_supportedLabel">Supported On:</div>
        <div id="explainText_noSupportedTextAvailable">Not available</div>
</div><table class="title" >
<tr><td colspan="2" class="gponame">Local Policy DoD Windows 10 STIG Comp v3r4</td></tr>
<tr>
    <td id="dtstamp">Data collected on: 4/3/2025 10:39:37 AM</td>
    <td><div id="objshowhide" tabindex="0" onclick="objshowhide_onClick();return false;"></div></td>
</tr>
</table>

<div class="gposummary">
<div class="he0_expanded"><span class="sectionTitle" tabindex="0">General</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he1"><span class="sectionTitle" tabindex="0">Details</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info" >
<tr><td scope="row">Domain</td><td>security.local</td></tr>
<tr><td scope="row">Owner</td><td>SECURITY\Domain Admins</td></tr>
<tr><td scope="row">Created</td><td>4/2/2025 11:35:12 AM</td></tr>
<tr><td scope="row">Modified</td><td>4/2/2025 11:35:34 AM</td></tr>
<tr><td scope="row">User Revisions</td><td>1 (AD), 1 (SYSVOL)</td></tr>
<tr><td scope="row">Computer Revisions</td><td>1 (AD), 1 (SYSVOL)</td></tr>
<tr><td scope="row">Unique ID</td><td>{2930D0AE-C89D-4158-8430-09C4064086C8}</td></tr>
<tr><td scope="row">GPO Status</td><td>User settings disabled</td></tr>
</table></div></div>
<div class="filler"></div>
<div class="he1"><span class="sectionTitle" tabindex="0">Links</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" ><tr><th scope="col">Location</th><th scope="col">Enforced</th><th scope="col">Link Status</th><th scope="col">Path</th></tr>
    <tr><td colspan="4">None</td></tr>
    </table>
    <br/>This list only includes links in the domain of the GPO.</div></div>
<div class="filler"></div>
<div class="he1"><span class="sectionTitle" tabindex="0">Security Filtering</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><b>The settings in this GPO can only apply to the following groups, users, and computers:</b></div>
<div class="he4i">
<table class="info" ><tr><th scope="col">Name</th></tr><tr><td>NT AUTHORITY\Authenticated Users</td></tr></table>
</div>
</div>
<div class="filler"></div>

<div class="filler"></div>
<div class="he1"><span class="sectionTitle" tabindex="0">Delegation</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><b>These groups and users have the specified permission for this GPO</b></div>
<div class="he4i">
<table class="info3" >
<tr><th scope="col">Name</th><th scope="col">Allowed Permissions</th><th scope="col">Inherited</th></tr>
<tr><td>NT AUTHORITY\Authenticated Users</td><td>Read (from Security Filtering)</td><td>No</td></tr>
<tr><td>NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</td><td>Read</td><td>No</td></tr>
<tr><td>NT AUTHORITY\SYSTEM</td><td>Edit settings, delete, modify security</td><td>No</td></tr>
<tr><td>SECURITY\Domain Admins</td><td>Edit settings, delete, modify security</td><td>No</td></tr>
<tr><td>SECURITY\Enterprise Admins</td><td>Edit settings, delete, modify security</td><td>No</td></tr>
</table>

</div></div></div>
<div class="filler"></div>
</div>
<div class="he0_expanded"><span class="sectionTitle" tabindex="0">Computer Configuration (Enabled)</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he1h_expanded"><span class="sectionTitle" tabindex="0">Policies</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he1_expanded"><span class="sectionTitle" tabindex="0">Windows Settings</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he2"><span class="sectionTitle" tabindex="0">Security Settings</span><a class="expando" href="#"></a></div>
        <div class="container"><div class="he3"><span class="sectionTitle" tabindex="0">Account Policies/Password Policy</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Enforce password history</td><td>24 passwords remembered</td></tr>
<tr><td>Maximum password age</td><td>60 days</td></tr>
<tr><td>Minimum password age</td><td>1 days</td></tr>
<tr><td>Minimum password length</td><td>14 characters</td></tr>
<tr><td>Password must meet complexity requirements</td><td>Enabled</td></tr>
<tr><td>Store passwords using reversible encryption</td><td>Disabled</td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Account Policies/Account Lockout Policy</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Account lockout duration</td><td>15 minutes</td></tr>
<tr><td>Account lockout threshold</td><td>3 invalid logon attempts</td></tr>
<tr><td>Reset account lockout counter after</td><td>15 minutes</td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Local Policies/User Rights Assignment</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Access Credential Manager as a trusted caller</td><td></td></tr>
<tr><td>Access this computer from the network</td><td>BUILTIN\Remote Desktop Users, BUILTIN\Administrators</td></tr>
<tr><td>Act as part of the operating system</td><td></td></tr>
<tr><td>Allow log on locally</td><td>BUILTIN\Users, BUILTIN\Administrators</td></tr>
<tr><td>Back up files and directories</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Change the system time</td><td>NT SERVICE\autotimesvc, NT AUTHORITY\LOCAL SERVICE, BUILTIN\Administrators</td></tr>
<tr><td>Create a pagefile</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Create a token object</td><td></td></tr>
<tr><td>Create global objects</td><td>NT AUTHORITY\SERVICE, NT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\LOCAL SERVICE, BUILTIN\Administrators</td></tr>
<tr><td>Create permanent shared objects</td><td></td></tr>
<tr><td>Create symbolic links</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Debug programs</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Deny access to this computer from the network</td><td>BUILTIN\Guests</td></tr>
<tr><td>Deny log on as a batch job</td><td></td></tr>
<tr><td>Deny log on as a service</td><td></td></tr>
<tr><td>Deny log on locally</td><td>BUILTIN\Guests</td></tr>
<tr><td>Deny log on through Terminal Services</td><td>BUILTIN\Guests</td></tr>
<tr><td>Enable computer and user accounts to be trusted for delegation</td><td></td></tr>
<tr><td>Force shutdown from a remote system</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Impersonate a client after authentication</td><td>NT AUTHORITY\SERVICE, NT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\LOCAL SERVICE, BUILTIN\Administrators</td></tr>
<tr><td>Load and unload device drivers</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Lock pages in memory</td><td></td></tr>
<tr><td>Manage auditing and security log</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Modify firmware environment values</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Perform volume maintenance tasks</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Profile single process</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Restore files and directories</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Take ownership of files or other objects</td><td>BUILTIN\Administrators</td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Local Policies/Security Options</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4h"><span class="sectionTitle" tabindex="0">Accounts</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Accounts: Administrator account status</td><td>Disabled</td></tr>
<tr><td>Accounts: Guest account status</td><td>Disabled</td></tr>
<tr><td>Accounts: Limit local account use of blank passwords to console logon only</td><td>Enabled</td></tr>
<tr><td>Accounts: Rename administrator account</td><td>&quot;X_Admin&quot;</td></tr>
<tr><td>Accounts: Rename guest account</td><td>&quot;Visitor&quot;</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">Domain Member</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Domain member: Digitally encrypt or sign secure channel data (always)</td><td>Enabled</td></tr>
<tr><td>Domain member: Digitally encrypt secure channel data (when possible)</td><td>Enabled</td></tr>
<tr><td>Domain member: Digitally sign secure channel data (when possible)</td><td>Enabled</td></tr>
<tr><td>Domain member: Disable machine account password changes</td><td>Disabled</td></tr>
<tr><td>Domain member: Maximum machine account password age</td><td>30 days</td></tr>
<tr><td>Domain member: Require strong (Windows 2000 or later) session key</td><td>Enabled</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">Interactive Logon</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Interactive logon: Message text for users attempting to log on</td><td>You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only., By using this IS (which includes any device attached to this IS), you consent to the following conditions:, -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations., -At any time, the USG may inspect and seize data stored on this IS., -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose., -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy., -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.</td></tr>
<tr><td>Interactive logon: Message title for users attempting to log on</td><td>&quot;US Department of Defense Warning Statement&quot;</td></tr>
<tr><td>Interactive logon: Smart card removal behavior</td><td>Lock Workstation</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">Microsoft Network Client</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Microsoft network client: Digitally sign communications (always)</td><td>Enabled</td></tr>
<tr><td>Microsoft network client: Send unencrypted password to third-party SMB servers</td><td>Disabled</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">Microsoft Network Server</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Microsoft network server: Digitally sign communications (always)</td><td>Enabled</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">Network Access</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Network access: Allow anonymous SID/Name translation</td><td>Disabled</td></tr>
<tr><td>Network access: Do not allow anonymous enumeration of SAM accounts</td><td>Enabled</td></tr>
<tr><td>Network access: Do not allow anonymous enumeration of SAM accounts and shares</td><td>Enabled</td></tr>
<tr><td>Network access: Let Everyone permissions apply to anonymous users</td><td>Disabled</td></tr>
<tr><td>Network access: Restrict anonymous access to Named Pipes and Shares</td><td>Enabled</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">Network Security</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Network security: Do not store LAN Manager hash value on next password change</td><td>Enabled</td></tr>
<tr><td>Network security: LAN Manager authentication level</td><td>Send NTLMv2 response only. Refuse LM &amp; NTLM</td></tr>
<tr><td>Network security: LDAP client signing requirements</td><td>Negotiate signing</td></tr>
<tr><td>Network security: Minimum session security for NTLM SSP based (including secure RPC) clients</td><td>Enabled</td></tr>
<tr><td colspan="2"><table class="subtable" ><tr><td>Require NTLMv2 session security</td><td>Enabled</td></tr>
<tr><td>Require 128-bit encryption</td><td>Enabled</td></tr>
</table></td></tr><tr><td>Network security: Minimum session security for NTLM SSP based (including secure RPC) servers</td><td>Enabled</td></tr>
<tr><td colspan="2"><table class="subtable" ><tr><td>Require NTLMv2 session security</td><td>Enabled</td></tr>
<tr><td>Require 128-bit encryption</td><td>Enabled</td></tr>
</table></td></tr></table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">System Cryptography</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing</td><td>Enabled</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">System Objects</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)</td><td>Enabled</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">User Account Control</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>User Account Control: Admin Approval Mode for the Built-in Administrator account</td><td>Enabled</td></tr>
<tr><td>User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode</td><td>Prompt for consent on the secure desktop</td></tr>
<tr><td>User Account Control: Behavior of the elevation prompt for standard users</td><td>Automatically deny elevation requests</td></tr>
<tr><td>User Account Control: Detect application installations and prompt for elevation</td><td>Enabled</td></tr>
<tr><td>User Account Control: Only elevate UIAccess applications that are installed in secure locations</td><td>Enabled</td></tr>
<tr><td>User Account Control: Run all administrators in Admin Approval Mode</td><td>Enabled</td></tr>
<tr><td>User Account Control: Virtualize file and registry write failures to per-user locations</td><td>Enabled</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">Other</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings</td><td>Enabled</td></tr>
<tr><td>Interactive logon: Machine inactivity limit</td><td>900 seconds</td></tr>
<tr><td>Network access: Restrict clients allowed to make remote calls to SAM</td><td>&quot;O:BAG:BAD:(A;;RC;;;BA)&quot;</td></tr>
<tr><td>Network security: Allow LocalSystem NULL session fallback</td><td>Disabled</td></tr>
<tr><td>Network security: Allow PKU2U authentication requests to this computer to use online identities.

</td><td>Disabled</td></tr>
<tr><td>Network security: Configure encryption types allowed for Kerberos</td><td>Enabled</td></tr>
<tr><td colspan="2"><table class="subtable" ><tr><td>DES_CBC_CRC</td><td>Disabled</td></tr>
<tr><td>DES_CBC_MD5</td><td>Disabled</td></tr>
<tr><td>RC4_HMAC_MD5</td><td>Disabled</td></tr>
<tr><td>AES128_HMAC_SHA1</td><td>Enabled</td></tr>
<tr><td>AES256_HMAC_SHA1</td><td>Enabled</td></tr>
<tr><td>Future encryption types</td><td>Enabled</td></tr>
</table></td></tr></table>
</div></div></div><div class="he3"><span class="sectionTitle" tabindex="0">System Services</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4h"><span class="sectionTitle" tabindex="0">Secondary Logon (Startup Mode: Disabled)</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><b>Permissions</b><br/>No permissions specified</div><div class="he4i"><b>Auditing</b><br/>No auditing specified</div></div></div><div class="he3"><span class="sectionTitle" tabindex="0">Advanced Audit Configuration</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4"><span class="sectionTitle" tabindex="0">Account Logon</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit Credential Validation</td><td>Success, Failure</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Account Management</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit Security Group Management</td><td>Success</td></tr>
<tr><td>Audit User Account Management</td><td>Success, Failure</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Detailed Tracking</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit PNP Activity</td><td>Success</td></tr>
<tr><td>Audit Process Creation</td><td>Success, Failure</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Logon/Logoff</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit Account Lockout</td><td>Failure</td></tr>
<tr><td>Audit Group Membership</td><td>Success</td></tr>
<tr><td>Audit Logoff</td><td>Success</td></tr>
<tr><td>Audit Logon</td><td>Success, Failure</td></tr>
<tr><td>Audit Other Logon/Logoff Events</td><td>Success, Failure</td></tr>
<tr><td>Audit Special Logon</td><td>Success</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Object Access</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit Detailed File Share</td><td>Failure</td></tr>
<tr><td>Audit File Share</td><td>Success, Failure</td></tr>
<tr><td>Audit Other Object Access Events</td><td>Success, Failure</td></tr>
<tr><td>Audit Removable Storage</td><td>Success, Failure</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Policy Change</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit Audit Policy Change</td><td>Success</td></tr>
<tr><td>Audit Authentication Policy Change</td><td>Success</td></tr>
<tr><td>Audit Authorization Policy Change</td><td>Success</td></tr>
<tr><td>Audit MPSSVC Rule-Level Policy Change</td><td>Success, Failure</td></tr>
<tr><td>Audit Other Policy Change Events</td><td>Failure</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Privilege Use</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit Sensitive Privilege Use</td><td>Success, Failure</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">System</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit IPsec Driver</td><td>Failure</td></tr>
<tr><td>Audit Other System Events</td><td>Success, Failure</td></tr>
<tr><td>Audit Security State Change</td><td>Success</td></tr>
<tr><td>Audit Security System Extension</td><td>Success</td></tr>
<tr><td>Audit System Integrity</td><td>Success, Failure</td></tr>
</table>
</div></div></div></div></div><div class="filler"></div>
<div class="he1"><span class="sectionTitle" tabindex="0">Administrative Templates</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i">Policy definitions (ADMX files) retrieved from the local computer.</div><div class="he3"><span class="sectionTitle" tabindex="0">Control Panel/Personalization</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Prevent enabling lock screen camera" gpmc_settingPath="Computer Configuration/Administrative Templates/Control Panel/Personalization" gpmc_settingDescription="Disables the lock screen camera toggle switch in PC Settings and prevents a camera from being invoked on the lock screen.&lt;br/&gt;&lt;br/&gt;By default, users can enable invocation of an available camera on the lock screen.&lt;br/&gt;&lt;br/&gt;If you enable this setting, users will no longer be able to enable or disable lock screen camera access in PC Settings, and the camera cannot be invoked on the lock screen." gpmc_supported="At least Windows Server 2012 R2, Windows 8.1 or Windows RT 8.1">Prevent enabling lock screen camera</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Prevent enabling lock screen slide show" gpmc_settingPath="Computer Configuration/Administrative Templates/Control Panel/Personalization" gpmc_settingDescription="Disables the lock screen slide show settings in PC Settings and prevents a slide show from playing on the lock screen.&lt;br/&gt;&lt;br/&gt;By default, users can enable a slide show that will run after they lock the machine.&lt;br/&gt;&lt;br/&gt;If you enable this setting, users will no longer be able to modify slide show settings in PC Settings, and no slide show will ever start." gpmc_supported="At least Windows Server 2012 R2, Windows 8.1 or Windows RT 8.1">Prevent enabling lock screen slide show</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">MS Security Guide</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Apply UAC restrictions to local accounts on network logons" gpmc_settingPath="Computer Configuration/Administrative Templates/MS Security Guide" gpmc_settingDescription="This setting controls whether local accounts can be used for remote administration via network logon (e.g., NET USE, connecting to C$, etc.). Local accounts are at high risk for credential theft when the same account and password is configured on multiple systems.  Enabling this policy significantly reduces that risk.&lt;br/&gt;&lt;br/&gt;Enabled (recommended): Applies UAC token-filtering to local accounts on network logons. Membership in powerful group such as Administrators is disabled and powerful privileges are removed from the resulting access token. This configures the LocalAccountTokenFilterPolicy registry value to 0. This is the default behavior for Windows.&lt;br/&gt;&lt;br/&gt;Disabled: Allows local accounts to have full administrative rights when authenticating via network logon, by configuring the LocalAccountTokenFilterPolicy registry value to 1.&lt;br/&gt;&lt;br/&gt;For more information about local accounts and credential theft, see &amp;quot;Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques&amp;quot;: http://www.microsoft.com/en-us/download/details.aspx?id=36036.&lt;br/&gt;&lt;br/&gt;For more information about LocalAccountTokenFilterPolicy, see http://support.microsoft.com/kb/951016.&lt;br/&gt;      " gpmc_supported="At least Windows Vista">Apply UAC restrictions to local accounts on network logons</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Configure SMB v1 client driver" gpmc_settingPath="Computer Configuration/Administrative Templates/MS Security Guide" gpmc_settingDescription="Configures the SMB v1 client driver&amp;#39;s start type.&lt;br/&gt;&lt;br/&gt;To disable client-side processing of the SMBv1 protocol, select the &amp;quot;Enabled&amp;quot; radio button, then select &amp;quot;Disable driver&amp;quot; from the dropdown.&lt;br/&gt;WARNING: DO NOT SELECT THE &amp;quot;DISABLED&amp;quot; RADIO BUTTON UNDER ANY CIRCUMSTANCES!&lt;br/&gt;&lt;br/&gt;For Windows 7 and Servers 2008, 2008R2, and 2012, you must also configure the &amp;quot;Configure SMB v1 client (extra setting needed for pre-Win8.1/2012R2)&amp;quot; setting.&lt;br/&gt;&lt;br/&gt;To restore default SMBv1 client-side behavior, select &amp;quot;Enabled&amp;quot; and choose the correct default from the dropdown:&lt;br/&gt;* &amp;quot;Manual start&amp;quot; for Windows 7 and Windows Servers 2008, 2008R2, and 2012;&lt;br/&gt;* &amp;quot;Automatic start&amp;quot; for Windows 8.1 and Windows Server 2012R2 and newer.&lt;br/&gt;&lt;br/&gt;Changes to this setting require a reboot to take effect.&lt;br/&gt;&lt;br/&gt;For more information, see https://support.microsoft.com/kb/2696547 &lt;br/&gt;      " gpmc_supported="At least Windows Server 2008 R2 or Windows 7">Configure SMB v1 client driver</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Configure MrxSmb10 driver</td><td>Disable driver (recommended)</td></tr>
</table></td></tr><tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Configure SMB v1 server" gpmc_settingPath="Computer Configuration/Administrative Templates/MS Security Guide" gpmc_settingDescription="Disabling this setting disables server-side processing of the SMBv1 protocol. (Recommended.)&lt;br/&gt;&lt;br/&gt;Enabling this setting enables server-side processing of the SMBv1 protocol. (Default.)&lt;br/&gt;&lt;br/&gt;Changes to this setting require a reboot to take effect.&lt;br/&gt;&lt;br/&gt;For more information, see https://support.microsoft.com/kb/2696547&lt;br/&gt;      " gpmc_supported="At least Windows Server 2008 R2 or Windows 7">Configure SMB v1 server</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Enable Structured Exception Handling Overwrite Protection (SEHOP)" gpmc_settingPath="Computer Configuration/Administrative Templates/MS Security Guide" gpmc_settingDescription="If this setting is enabled, SEHOP is enforced. For more information, see https://support.microsoft.com/en-us/help/956607/how-to-enable-structured-exception-handling-overwrite-protection-sehop-in-windows-operating-systems.&lt;br/&gt;&lt;br/&gt;If this setting is disabled or not configured, SEHOP is not enforced for 32-bit processes.&lt;br/&gt;" gpmc_supported="At least Windows Vista">Enable Structured Exception Handling Overwrite Protection (SEHOP)</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Remove &amp;quot;Run As Different User&amp;quot; from context menus" gpmc_settingPath="Computer Configuration/Administrative Templates/MS Security Guide" gpmc_settingDescription="This setting controls whether &amp;quot;Run As Different User&amp;quot; appears on the Shift+RightClick context menu for .bat, .cmd, .exe, and .msc files.&lt;br/&gt;&lt;br/&gt;Enabled (recommended): Keeps &amp;quot;Run As Different User&amp;quot; from appearing in the context menu when the user holds Shift while right-clicking on a .bat, .cmd, .exe, or .msc file in Explorer.&lt;br/&gt;&lt;br/&gt;Disabled: Restores the Windows default behavior for &amp;quot;Run As Different User.&amp;quot;&lt;br/&gt;      " gpmc_supported="At least Windows Vista">Remove &quot;Run As Different User&quot; from context menus</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="WDigest Authentication (disabling may require KB2871997)" gpmc_settingPath="Computer Configuration/Administrative Templates/MS Security Guide" gpmc_settingDescription="When WDigest authentication is enabled, Lsass.exe retains a copy of the user&amp;#39;s plaintext password in memory, where it can be at risk of theft. Microsoft recommends disabling WDigest authentication unless it is needed.&lt;br/&gt;&lt;br/&gt;If this setting is not configured, WDigest authentication is disabled in Windows 8.1 and in Windows Server 2012 R2; it is enabled by default in earlier versions of Windows and Windows Server.&lt;br/&gt;&lt;br/&gt;Update KB2871997 must first be installed to disable WDigest authentication using this setting in Windows 7, Windows 8, Windows Server 2008 R2 and Windows Server 2012.&lt;br/&gt;&lt;br/&gt;Enabled: Enables WDigest authentication.&lt;br/&gt;&lt;br/&gt;Disabled (recommended): Disables WDigest authentication. For this setting to work on Windows 7, Windows 8, Windows Server 2008 R2 or Windows Server 2012, KB2871997 must first be installed.&lt;br/&gt;&lt;br/&gt;For more information, see http://support.microsoft.com/kb/2871997 and http://blogs.technet.com/b/srd/archive/2014/06/05/an-overview-of-kb2871997.aspx .&lt;br/&gt;      " gpmc_supported="At least Windows Server 2008 R2 or Windows 7">WDigest Authentication (disabling may require KB2871997)</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">MSS (Legacy)</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)" gpmc_settingPath="Computer Configuration/Administrative Templates/MSS (Legacy)" gpmc_settingDescription="MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)" gpmc_supported="At least Windows Vista">MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>DisableIPSourceRoutingIPv6</td><td>Highest protection, source routing is completely disabled</td></tr>
</table></td></tr><tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)" gpmc_settingPath="Computer Configuration/Administrative Templates/MSS (Legacy)" gpmc_settingDescription="MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)" gpmc_supported="At least Windows Vista">MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>DisableIPSourceRouting</td><td>Highest protection, source routing is completely disabled</td></tr>
</table></td></tr><tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes" gpmc_settingPath="Computer Configuration/Administrative Templates/MSS (Legacy)" gpmc_settingDescription="MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes" gpmc_supported="At least Windows Vista">MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers" gpmc_settingPath="Computer Configuration/Administrative Templates/MSS (Legacy)" gpmc_settingDescription="MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers" gpmc_supported="At least Windows Vista">MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Network/Lanman Workstation</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Enable insecure guest logons" gpmc_settingPath="Computer Configuration/Administrative Templates/Network/Lanman Workstation" gpmc_settingDescription="This policy setting determines if the SMB client will allow insecure guest logons to an SMB server.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting or if you do not configure this policy setting, the SMB client will allow insecure guest logons.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, the SMB client will reject insecure guest logons.&lt;br/&gt;&lt;br/&gt;Insecure guest logons are used by file servers to allow unauthenticated access to shared folders. While uncommon in an enterprise environment, insecure guest logons are frequently used by consumer Network Attached Storage (NAS) appliances acting as file servers. Windows file servers require authentication and do not use insecure guest logons by default. Since insecure guest logons are unauthenticated, important security features such as SMB Signing and SMB Encryption are disabled. As a result, clients that allow insecure guest logons are vulnerable to a variety of man-in-the-middle attacks that can result in data loss, data corruption, and exposure to malware. Additionally, any data written to a file server using an insecure guest logon is potentially accessible to anyone on the network. Microsoft recommends disabling insecure guest logons and configuring file servers to require authenticated access.&amp;quot;&lt;br/&gt;      " gpmc_supported="At least Windows Server 2016, Windows 10">Enable insecure guest logons</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Network/Network Connections</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Prohibit use of Internet Connection Sharing on your DNS domain network" gpmc_settingPath="Computer Configuration/Administrative Templates/Network/Network Connections" gpmc_settingDescription="Determines whether administrators can enable and configure the Internet Connection Sharing (ICS) feature of an Internet connection and if the ICS service can run on the computer.&lt;br/&gt;&lt;br/&gt;ICS lets administrators configure their system as an Internet gateway for a small network and provides network services, such as name resolution and addressing through DHCP, to the local private network.&lt;br/&gt;&lt;br/&gt;If you enable this setting, ICS cannot be enabled or configured by administrators, and the ICS service cannot run on the computer. The Advanced tab in the Properties dialog box for a LAN or remote access connection is removed. The Internet Connection Sharing page is removed from the New Connection Wizard. The Network Setup Wizard is disabled.&lt;br/&gt;&lt;br/&gt;If you disable this setting or do not configure it and have two or more connections, administrators can enable ICS. The Advanced tab in the properties dialog box for a LAN or remote access connection is available. In addition, the user is presented with the option to enable Internet Connection Sharing in the Network Setup Wizard and Make New Connection Wizard. (The Network Setup Wizard is available only in Windows XP Professional.)&lt;br/&gt;&lt;br/&gt;By default, ICS is disabled when you create a remote access connection, but administrators can use the Advanced tab to enable it. When running the New Connection Wizard or Network Setup Wizard, administrators can choose to enable ICS.&lt;br/&gt;&lt;br/&gt;Note: Internet Connection Sharing is only available when two or more network connections are present.&lt;br/&gt;&lt;br/&gt;Note: When the &amp;quot;Prohibit access to properties of a LAN connection,&amp;quot; &amp;quot;Ability to change properties of an all user remote access connection,&amp;quot; or &amp;quot;Prohibit changing properties of a private remote access connection&amp;quot; settings are set to deny access to the Connection Properties dialog box, the Advanced tab for the connection is blocked.&lt;br/&gt;&lt;br/&gt;Note: Nonadministrators are already prohibited from configuring Internet Connection Sharing, regardless of this setting.&lt;br/&gt;&lt;br/&gt;Note: Disabling this setting does not prevent Wireless Hosted Networking from using the ICS service for DHCP services. To prevent the ICS service from running, on the Network Permissions tab in the network&amp;#39;s policy properties, select the &amp;quot;Don&amp;#39;t use hosted networks&amp;quot; check box." gpmc_supported="Microsoft Windows Server 2003, Windows XP, and Windows 2000 Service Pack 1 operating systems only">Prohibit use of Internet Connection Sharing on your DNS domain network</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Network/SSL Configuration Settings</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="ECC Curve Order" gpmc_settingPath="Computer Configuration/Administrative Templates/Network/SSL Configuration Settings" gpmc_settingDescription="This policy setting determines the priority order of ECC curves used with ECDHE cipher suites.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, ECC curves are prioritized in the order specified.(Enter one Curve name per line)&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the default ECC curve order is used.&lt;br/&gt;&lt;br/&gt;Default Curve Order&lt;br/&gt;============&lt;br/&gt;curve25519&lt;br/&gt;NistP256&lt;br/&gt;NistP384&lt;br/&gt;&lt;br/&gt;To See all the curves supported on the system, Use the following command:&lt;br/&gt;&lt;br/&gt;CertUtil.exe -DisplayEccCurve&lt;br/&gt;&lt;br/&gt;      " gpmc_supported="At least Windows Server 2016, Windows 10">ECC Curve Order</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td colspan="2">Type the ECC curve names in the preferred order (one curve name per line)</td></tr><tr><td>ECC Curve Order:</td><td>NistP384<br/>NistP256</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Network/Windows Connection Manager</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Minimize the number of simultaneous connections to the Internet or a Windows Domain" gpmc_settingPath="Computer Configuration/Administrative Templates/Network/Windows Connection Manager" gpmc_settingDescription="&lt;br/&gt;        This policy setting determines if a computer can have multiple connections to the internet or to a Windows domain. If multiple connections are allowed, it then determines how network traffic will be routed.&lt;br/&gt;&lt;br/&gt;        If this policy setting is set to 0, a computer can have simultaneous connections to the internet, to a Windows domain, or to both. Internet traffic can be routed over any connection - including a cellular connection and any metered network. This was previously the Disabled state for this policy setting. This option was first available in Windows 8.&lt;br/&gt;&lt;br/&gt;        If this policy setting is set to 1, any new automatic internet connection is blocked when the computer has at least one active internet connection to a preferred type of network. Here&amp;#39;s the order of preference (from most preferred to least preferred): Ethernet, WLAN, then cellular. Ethernet is always preferred when connected. Users can still manually connect to any network. This was previously the Enabled state for this policy setting. This option was first available in Windows 8.&lt;br/&gt;&lt;br/&gt;        If this policy setting is set to 2, the behavior is similar to 1. However, if a cellular data connection is available, it will always stay connected for services that require a cellular connection. When the user is connected to a WLAN or Ethernet connection, no internet traffic will be routed over the cellular connection. This option was first available in Windows 10 (Version 1703).&lt;br/&gt;&lt;br/&gt;        If this policy setting is set to 3, the behavior is similar to 2. However, if there&amp;#39;s an Ethernet connection, Windows won&amp;#39;t allow users to connect to a WLAN manually. A WLAN can only be connected (automatically or manually) when there&amp;#39;s no Ethernet connection.&lt;br/&gt;&lt;br/&gt;        This policy setting is related to the &amp;quot;Enable Windows to soft-disconnect a computer from a network&amp;quot; policy setting.&lt;br/&gt;      " gpmc_supported="At least Windows Server 2012, Windows 8 or Windows RT">Minimize the number of simultaneous connections to the Internet or a Windows Domain</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Minimize Policy Options</td><td>3 = Prevent Wi-Fi when on Ethernet</td></tr>
</table></td></tr><tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Prohibit connection to non-domain networks when connected to domain authenticated network" gpmc_settingPath="Computer Configuration/Administrative Templates/Network/Windows Connection Manager" gpmc_settingDescription="This policy setting prevents computers from connecting to both a domain based network and a non-domain based network at the same time.&lt;br/&gt;&lt;br/&gt;If this policy setting is enabled, the computer responds to automatic and manual network connection attempts based on the following circumstances:&lt;br/&gt;&lt;br/&gt;Automatic connection attempts&lt;br/&gt;- When the computer is already connected to a domain based network, all automatic connection attempts to non-domain networks are blocked.&lt;br/&gt;- When the computer is already connected to a non-domain based network, automatic connection attempts to domain based networks are blocked.&lt;br/&gt;&lt;br/&gt;Manual connection attempts&lt;br/&gt;- When the computer is already connected to either a non-domain based network or a domain based network over media other than Ethernet, and a user attempts to create a manual connection to an additional network in violation of this policy setting, the existing network connection is disconnected and the manual connection is allowed.&lt;br/&gt;- When the computer is already connected to either a non-domain based network or a domain based network over Ethernet, and a user attempts to create a manual connection to an additional network in violation of this policy setting, the existing Ethernet connection is maintained and the manual connection attempt is blocked.&lt;br/&gt;&lt;br/&gt;If this policy setting is not configured or is disabled, computers are allowed to connect simultaneously to both domain and non-domain networks.&lt;br/&gt;      " gpmc_supported="At least Windows Server 2012, Windows 8 or Windows RT">Prohibit connection to non-domain networks when connected to domain authenticated network</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Network/WLAN Service/WLAN Settings</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services" gpmc_settingPath="Computer Configuration/Administrative Templates/Network/WLAN Service/WLAN Settings" gpmc_settingDescription="This policy setting determines whether users can enable the following WLAN settings: &amp;quot;Connect to suggested open hotspots,&amp;quot; &amp;quot;Connect to networks shared by my contacts,&amp;quot; and &amp;quot;Enable paid services&amp;quot;.&lt;br/&gt;&lt;br/&gt;&amp;quot;Connect to suggested open hotspots&amp;quot; enables Windows to automatically connect users to open hotspots it knows about by crowdsourcing networks that other people using Windows have connected to.&lt;br/&gt;&lt;br/&gt;&amp;quot;Connect to networks shared by my contacts&amp;quot; enables Windows to automatically connect to networks that the user&amp;#39;s contacts have shared with them, and enables users on this device to share networks with their contacts.&lt;br/&gt;&lt;br/&gt;&amp;quot;Enable paid services&amp;quot; enables Windows to temporarily connect to open hotspots to determine if paid services are available.&lt;br/&gt;&lt;br/&gt;If this policy setting is disabled, both &amp;quot;Connect to suggested open hotspots,&amp;quot; &amp;quot;Connect to networks shared by my contacts,&amp;quot; and &amp;quot;Enable paid services&amp;quot; will be turned off and users on this device will be prevented from enabling them.&lt;br/&gt;&lt;br/&gt;If this policy setting is not configured or is enabled, users can choose to enable or disable either &amp;quot;Connect to suggested open hotspots&amp;quot;  or &amp;quot;Connect to networks shared by my contacts&amp;quot;.&lt;br/&gt;      " gpmc_supported="At least Windows 10">Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Audit Process Creation</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Include command line in process creation events" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Audit Process Creation" gpmc_settingDescription="This policy setting determines what information is logged in security audit events when a new process has been created.&lt;br/&gt;&lt;br/&gt;This setting only applies when the Audit Process Creation policy is enabled. If you enable this policy setting the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, &amp;quot;a new process has been created,&amp;quot; on the workstations and servers on which this policy setting is applied.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the process&amp;#39;s command line information will not be included in Audit Process Creation events.&lt;br/&gt;&lt;br/&gt;Default: Not configured&lt;br/&gt;&lt;br/&gt;Note: When this policy setting is enabled, any user with access to read the security events will be able to read the command line arguments for any successfully created process. Command line arguments can contain sensitive or private information such as passwords or user data.&lt;br/&gt;      " gpmc_supported="At least Windows Server 2012 R2, Windows 8.1 or Windows RT 8.1">Include command line in process creation events</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Credentials Delegation</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Remote host allows delegation of non-exportable credentials" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Credentials Delegation" gpmc_settingDescription="Remote host allows delegation of non-exportable credentials&lt;br/&gt;&lt;br/&gt;When using credential delegation, devices provide an exportable version of credentials to the remote host. This exposes users to the risk of credential theft from attackers on the remote host.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the host supports Restricted Admin or Remote Credential Guard mode.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, Restricted Administration and Remote Credential Guard mode are not supported. User will always need to pass their credentials to the host." gpmc_supported="At least Windows Server 2016, Windows 10 Version 1703">Remote host allows delegation of non-exportable credentials</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Device Guard</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn On Virtualization Based Security" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Device Guard" gpmc_settingDescription="Specifies whether Virtualization Based Security is enabled.&lt;br/&gt;&lt;br/&gt;Virtualization Based Security uses the Windows Hypervisor to provide support for security services. Virtualization Based Security requires Secure Boot, and can optionally be enabled with the use of DMA Protections. DMA protections require hardware support and will only be enabled on correctly configured devices.&lt;br/&gt;&lt;br/&gt;Virtualization Based Protection of Code Integrity&lt;br/&gt;&lt;br/&gt;This setting enables virtualization based protection of Kernel Mode Code Integrity. When this is enabled, kernel mode memory protections are enforced and the Code Integrity validation path is protected by the Virtualization Based Security feature.&lt;br/&gt;&lt;br/&gt;The &amp;quot;Disabled&amp;quot; option turns off Virtualization Based Protection of Code Integrity remotely if it was previously turned on with the &amp;quot;Enabled without lock&amp;quot; option.&lt;br/&gt; &lt;br/&gt;The &amp;quot;Enabled with UEFI lock&amp;quot; option ensures that Virtualization Based Protection of Code Integrity cannot be disabled remotely. In order to disable the feature, you must set the Group Policy to &amp;quot;Disabled&amp;quot; as well as remove the security functionality from each computer, with a physically present user, in order to clear configuration persisted in UEFI.&lt;br/&gt; &lt;br/&gt;The &amp;quot;Enabled without lock&amp;quot; option allows Virtualization Based Protection of Code Integrity to be disabled remotely by using Group Policy. &lt;br/&gt;&lt;br/&gt;The &amp;quot;Not Configured&amp;quot; option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified.&lt;br/&gt;&lt;br/&gt;The &amp;quot;Require UEFI Memory Attributes Table&amp;quot; option will only enable Virtualization Based Protection of Code Integrity on devices with UEFI firmware support for the Memory Attributes Table. Devices without the UEFI Memory Attributes Table may have firmware that is incompatible with Virtualization Based Protection of Code Integrity which in some cases can lead to crashes or data loss or incompatibility with certain plug-in cards. If not setting this option the targeted devices should be tested to ensure compatibility.&lt;br/&gt;&lt;br/&gt;Warning: All drivers on the system must be compatible with this feature or the system may crash. Ensure that this policy setting is only deployed to computers which are known to be compatible. &lt;br/&gt;&lt;br/&gt;Credential Guard&lt;br/&gt;&lt;br/&gt;This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials.&lt;br/&gt;&lt;br/&gt;The &amp;quot;Disabled&amp;quot; option turns off Credential Guard remotely if it was previously turned on with the &amp;quot;Enabled without lock&amp;quot; option.&lt;br/&gt;&lt;br/&gt;The &amp;quot;Enabled with UEFI lock&amp;quot; option ensures that Credential Guard cannot be disabled remotely. In order to disable the feature, you must set the Group Policy to &amp;quot;Disabled&amp;quot; as well as remove the security functionality from each computer, with a physically present user, in order to clear configuration persisted in UEFI.&lt;br/&gt;&lt;br/&gt;The &amp;quot;Enabled without lock&amp;quot; option allows Credential Guard to be disabled remotely by using Group Policy. The devices that use this setting must be running at least Windows 10 (Version 1511).&lt;br/&gt;&lt;br/&gt;The &amp;quot;Not Configured&amp;quot; option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified.&lt;br/&gt;      &lt;br/&gt;Secure Launch&lt;br/&gt;&lt;br/&gt;This setting sets the configuration of Secure Launch to secure the boot chain.&lt;br/&gt;&lt;br/&gt;The &amp;quot;Not Configured&amp;quot; setting is the default, and allows configuration of the feature by Administrative users.&lt;br/&gt;&lt;br/&gt;The &amp;quot;Enabled&amp;quot; option turns on Secure Launch on supported hardware.&lt;br/&gt;&lt;br/&gt;The &amp;quot;Disabled&amp;quot; option turns off Secure Launch, regardless of hardware support.&lt;br/&gt;      " gpmc_supported="At least Windows Server 2016, Windows 10">Turn On Virtualization Based Security</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Select Platform Security Level:</td><td>Secure Boot</td></tr>
<tr><td>Virtualization Based Protection of Code Integrity:</td><td>Enabled with UEFI lock</td></tr>
<tr><td>Require UEFI Memory Attributes Table</td><td>Disabled</td></tr>
<tr><td>Credential Guard Configuration:</td><td>Enabled with UEFI lock</td></tr>
<tr><td>Secure Launch Configuration:</td><td>Not Configured</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Early Launch Antimalware</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Boot-Start Driver Initialization Policy" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Early Launch Antimalware" gpmc_settingDescription="This policy setting allows you to specify which boot-start drivers are initialized based on a classification determined by an Early Launch Antimalware boot-start driver. The Early Launch Antimalware boot-start driver can return the following classifications for each boot-start driver:&lt;br/&gt;-  Good: The driver has been signed and has not been tampered with.&lt;br/&gt;-  Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized.&lt;br/&gt;-  Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver.&lt;br/&gt;-  Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot-start driver.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting you will be able to choose which boot-start drivers to initialize the next time the computer is started.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the boot start drivers determined to be Good, Unknown or Bad but Boot Critical are initialized and the initialization of drivers determined to be Bad is skipped.&lt;br/&gt;&lt;br/&gt;If your malware detection application does not include an Early Launch Antimalware boot-start driver or if your Early Launch Antimalware boot-start driver has been disabled, this setting has no effect and all boot-start drivers are initialized.&lt;br/&gt;      " gpmc_supported="At least Windows Server 2012, Windows 8 or Windows RT">Boot-Start Driver Initialization Policy</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Choose the boot-start drivers that can be initialized:</td><td>Good, unknown and bad but critical</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Group Policy</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Configure registry policy processing" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Group Policy" gpmc_settingDescription="This policy setting determines when registry policies are updated.&lt;br/&gt;&lt;br/&gt;This policy setting affects all policies in the Administrative Templates folder and any other policies that store values in the registry. It overrides customized settings that the program implementing a registry policy set when it was installed.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.&lt;br/&gt;&lt;br/&gt;The &amp;quot;Do not apply during periodic background processing&amp;quot; option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.&lt;br/&gt;&lt;br/&gt;The &amp;quot;Process even if the Group Policy objects have not changed&amp;quot; option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it." gpmc_supported="At least Windows 2000">Configure registry policy processing</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Do not apply during periodic background processing</td><td>Disabled</td></tr>
<tr><td>Process even if the Group Policy objects have not changed</td><td>Enabled</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Internet Communication Management/Internet Communication settings</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn off downloading of print drivers over HTTP" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings" gpmc_settingDescription="This policy setting specifies whether to allow this client to download print driver packages over HTTP.&lt;br/&gt;&lt;br/&gt;To set up HTTP printing, non-inbox drivers need to be downloaded over HTTP.&lt;br/&gt;&lt;br/&gt;Note: This policy setting does not prevent the client from printing to printers on the Intranet or the Internet over HTTP.  It only prohibits downloading drivers that are not already installed locally.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, print drivers cannot be downloaded over HTTP.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, users can download print drivers over HTTP." gpmc_supported="At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2">Turn off downloading of print drivers over HTTP</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn off Internet download for Web publishing and online ordering wizards" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings" gpmc_settingDescription="This policy setting specifies whether Windows should download a list of providers for the web publishing and online ordering wizards.&lt;br/&gt;&lt;br/&gt;These wizards allow users to select from a list of companies that provide services such as online storage and photographic printing. By default, Windows displays providers downloaded from a Windows website in addition to providers specified in the registry.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, Windows does not download providers, and only the service providers that are cached in the local registry are displayed.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, a list of providers are downloaded when the user uses the web publishing or online ordering wizards.&lt;br/&gt;&lt;br/&gt;See the documentation for the web publishing and online ordering wizards for more information, including details on specifying service providers in the registry." gpmc_supported="At least Windows Server 2003 operating systems or Windows XP Professional with SP2">Turn off Internet download for Web publishing and online ordering wizards</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn off printing over HTTP" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings" gpmc_settingDescription="This policy setting specifies whether to allow printing over HTTP from this client.&lt;br/&gt;&lt;br/&gt;Printing over HTTP allows a client to print to printers on the intranet as well as the Internet.&lt;br/&gt;&lt;br/&gt;Note: This policy setting affects the client side of Internet printing only. It does not prevent this computer from acting as an Internet Printing server and making its shared printers available via HTTP.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, it prevents this client from printing to Internet printers over HTTP.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, users can choose to print to Internet printers over HTTP.&lt;br/&gt;&lt;br/&gt;Also, see the &amp;quot;Web-based printing&amp;quot; policy setting in Computer Configuration/Administrative Templates/Printers." gpmc_supported="At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2">Turn off printing over HTTP</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Kernel DMA Protection</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Enumeration policy for external devices incompatible with Kernel DMA Protection" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Kernel DMA Protection" gpmc_settingDescription="Enumeration policy for external DMA-capable devices incompatible with DMA remapping. This policy only takes effect when Kernel DMA Protection is enabled and supported by the system. Note: this policy does not apply to 1394, PCMCIA or ExpressCard devices." gpmc_supported="At least Windows Server 2016, Windows 10">Enumeration policy for external devices incompatible with Kernel DMA Protection</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Enumeration policy</td><td>Block all</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/LAPS</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Password Settings" gpmc_settingPath="Computer Configuration/Administrative Templates/System/LAPS" gpmc_settingDescription="Configures password parameters&lt;br/&gt;&lt;br/&gt;Password complexity: which characters are used when generating a new password&lt;br/&gt;  Default: Large letters + small letters + numbers + special characters&lt;br/&gt;&lt;br/&gt;Password length&lt;br/&gt;  Minimum: 8 characters&lt;br/&gt;  Maximum: 64 characters&lt;br/&gt;  Default: 14 characters&lt;br/&gt;&lt;br/&gt;Password age in days&lt;br/&gt;  Minimum: 1 day (7 days when backup directory is configured to be Azure AD)&lt;br/&gt;  Maximum: 365 days&lt;br/&gt;  Default: 30 days&lt;br/&gt;&lt;br/&gt;See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.&lt;br/&gt;      " gpmc_supported="At least Microsoft Windows 10 or later">Password Settings</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Password Complexity</td><td>Large letters + small letters + numbers + specials</td></tr>
<tr><td>Password Length</td><td>14</td></tr>
<tr><td>Password Age (Days)</td><td>60</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Logon</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Do not display network selection UI" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Logon" gpmc_settingDescription="This policy setting allows you to control whether anyone can interact with available networks UI on the logon screen.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the PC&amp;#39;s network connectivity state cannot be changed without signing into Windows.&lt;br/&gt;&lt;br/&gt;If you disable or don&amp;#39;t configure this policy setting, any user can disconnect the PC from the network or can connect the PC to other available networks without signing into Windows." gpmc_supported="At least Windows Server 2012, Windows 8 or Windows RT">Do not display network selection UI</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn on convenience PIN sign-in" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Logon" gpmc_settingDescription="This policy setting allows you to control whether a domain user can sign in using a convenience PIN.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, a domain user can set up and sign in with a convenience PIN.&lt;br/&gt;&lt;br/&gt;If you disable or don&amp;#39;t configure this policy setting, a domain user can&amp;#39;t set up and use a convenience PIN.&lt;br/&gt;&lt;br/&gt;Note: The user&amp;#39;s domain password will be cached in the system vault when using this feature.&lt;br/&gt;&lt;br/&gt;To configure Windows Hello for Business, use the Administrative Template policies under Windows Hello for Business." gpmc_supported="At least Windows Server 2012, Windows 8 or Windows RT">Turn on convenience PIN sign-in</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/PIN Complexity</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Minimum PIN length" gpmc_settingPath="Computer Configuration/Administrative Templates/System/PIN Complexity" gpmc_settingDescription="Minimum PIN length configures the minimum number of characters required for the PIN.  The lowest number you can configure for this policy setting is 4.  The largest number you can configure must be less than the number configured in the Maximum PIN length policy setting or the number 127, whichever is the lowest.&lt;br/&gt;&lt;br/&gt;If you configure this policy setting, the PIN length must be greater than or equal to this number.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the PIN length must be greater than or equal to 4.&lt;br/&gt;&lt;br/&gt;NOTE: If the above specified conditions for the minimum PIN length are not met, default values will be used for both the maximum and minimum PIN lengths.&lt;br/&gt;        " gpmc_supported="At least Windows 10">Minimum PIN length</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Minimum PIN length</td><td>6</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Power Management/Sleep Settings</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Require a password when a computer wakes (on battery)" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Power Management/Sleep Settings" gpmc_settingDescription="This policy setting specifies whether or not the user is prompted for a password when the system resumes from sleep.&lt;br/&gt;&lt;br/&gt;If you enable or do not configure this policy setting, the user is prompted for a password when the system resumes from sleep.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, the user is not prompted for a password when the system resumes from sleep." gpmc_supported="At least Windows Vista">Require a password when a computer wakes (on battery)</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Require a password when a computer wakes (plugged in)" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Power Management/Sleep Settings" gpmc_settingDescription="This policy setting specifies whether or not the user is prompted for a password when the system resumes from sleep.&lt;br/&gt;&lt;br/&gt;If you enable or do not configure this policy setting, the user is prompted for a password when the system resumes from sleep.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, the user is not prompted for a password when the system resumes from sleep." gpmc_supported="At least Windows Vista">Require a password when a computer wakes (plugged in)</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Remote Assistance</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Configure Solicited Remote Assistance" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Remote Assistance" gpmc_settingDescription="This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, users on this computer can use email or file transfer to ask someone for help. Also, users can use instant messaging programs to allow connections to this computer, and you can configure additional Remote Assistance settings.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, users on this computer cannot use email or file transfer to ask someone for help. Also, users cannot use instant messaging programs to allow connections to this computer.&lt;br/&gt;&lt;br/&gt;If you do not configure this policy setting, users can turn on or turn off Solicited (Ask for) Remote Assistance themselves in System Properties in Control Panel. Users can also configure Remote Assistance settings.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, you have two ways to allow helpers to provide Remote Assistance: &amp;quot;Allow helpers to only view the computer&amp;quot; or &amp;quot;Allow helpers to remotely control the computer.&amp;quot;&lt;br/&gt;&lt;br/&gt;The &amp;quot;Maximum ticket time&amp;quot; policy setting sets a limit on the amount of time that a Remote Assistance invitation created by using email or file transfer can remain open.&lt;br/&gt;&lt;br/&gt;The &amp;quot;Select the method for sending email invitations&amp;quot; setting specifies which email standard to use to send Remote Assistance invitations. Depending on your email program, you can use either the Mailto standard (the invitation recipient connects through an Internet link) or the SMAPI (Simple MAPI) standard (the invitation is attached to your email message). This policy setting is not available in Windows Vista since SMAPI is the only method supported.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting you should also enable appropriate firewall exceptions to allow Remote Assistance communications." gpmc_supported="At least Windows Server 2003 operating systems or Windows XP Professional">Configure Solicited Remote Assistance</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Remote Procedure Call</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Restrict Unauthenticated RPC clients" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Remote Procedure Call" gpmc_settingDescription="This policy setting controls how the RPC server runtime handles unauthenticated RPC clients connecting to RPC servers.&lt;br/&gt;&lt;br/&gt;This policy setting impacts all RPC applications.  In a domain environment this policy setting should be used with caution as it can impact a wide range of functionality including group policy processing itself.  Reverting a change to this policy setting can require manual intervention on each affected machine.  This policy setting should never be applied to a domain controller.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, the RPC server runtime uses the value of &amp;quot;Authenticated&amp;quot; on Windows Client, and the value of &amp;quot;None&amp;quot; on Windows Server versions that support this policy setting. &lt;br/&gt;&lt;br/&gt;If you do not configure this policy setting, it remains disabled.  The RPC server runtime will behave as though it was enabled with the value of &amp;quot;Authenticated&amp;quot; used for Windows Client and the value of &amp;quot;None&amp;quot; used for Server SKUs that support this policy setting. &lt;br/&gt;&lt;br/&gt;If you enable this policy setting, it directs the RPC server runtime to restrict unauthenticated RPC clients connecting to RPC servers running on a machine. A client will be considered an authenticated client if it uses a named pipe to communicate with the server or if it uses RPC Security. RPC Interfaces that have specifically requested to be accessible by unauthenticated clients may be exempt from this restriction, depending on the selected value for this policy setting.&lt;br/&gt;&lt;br/&gt;--  &amp;quot;None&amp;quot; allows all RPC clients to connect to RPC Servers running on the machine on which the policy setting is applied.&lt;br/&gt;&lt;br/&gt;--  &amp;quot;Authenticated&amp;quot; allows only authenticated RPC Clients (per the definition above) to connect to RPC Servers running on the machine on which the policy setting is applied. Exemptions are granted to interfaces that have requested them.&lt;br/&gt;&lt;br/&gt;--  &amp;quot;Authenticated without exceptions&amp;quot; allows only authenticated RPC Clients (per the definition above) to connect to RPC Servers running on the machine on which the policy setting is applied.  No exceptions are allowed.&lt;br/&gt;&lt;br/&gt;Note: This policy setting will not be applied until the system is rebooted." gpmc_supported="At least Windows XP Professional with SP2">Restrict Unauthenticated RPC clients</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>RPC Runtime Unauthenticated Client Restriction to Apply:</td><td>Authenticated</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/App Privacy</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Let Windows apps activate with voice while the system is locked" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/App Privacy" gpmc_settingDescription="&lt;br/&gt;This policy setting specifies whether Windows apps can be activated by voice while the system is locked.&lt;br/&gt;&lt;br/&gt;If you choose the &amp;quot;User is in control&amp;quot; option, employees in your organization can decide whether users can interact with applications using speech while the system is locked by using Settings &amp;gt; Privacy on the device.&lt;br/&gt;&lt;br/&gt;If you choose the &amp;quot;Force Allow&amp;quot; option, users can interact with applications using speech while the system is locked and employees in your organization cannot change it.&lt;br/&gt;&lt;br/&gt;If you choose the &amp;quot;Force Deny&amp;quot; option, users cannot interact with applications using speech while the system is locked and employees in your organization cannot change it.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, employees in your organization can decide whether users can interact with applications using speech while the system is locked by using Settings &amp;gt; Privacy on the device.&lt;br/&gt;&lt;br/&gt;This policy is applied to Windows apps and Cortana. It takes precedence of the “Allow Cortana above lock” policy. This policy is applicable only when “Allow voice activation” policy is configured to allow applications to be activated with voice.&lt;br/&gt;      " gpmc_supported="At least Windows Server 2016, Windows 10">Let Windows apps activate with voice while the system is locked</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Default for all apps:</td><td>Force Deny</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/App runtime</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow Microsoft accounts to be optional" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/App runtime" gpmc_settingDescription="This policy setting lets you control whether Microsoft accounts are optional for Windows Store apps that require an account to sign in. This policy only affects Windows Store apps that support it.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, Windows Store apps that typically require a Microsoft account to sign in will allow users to sign in with an enterprise account instead.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, users will need to sign in with a Microsoft account." gpmc_supported="At least Windows Server 2012 R2, Windows 8.1 or Windows RT 8.1">Allow Microsoft accounts to be optional</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Application Compatibility</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn off Inventory Collector" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Application Compatibility" gpmc_settingDescription="This policy setting controls the state of the Inventory Collector.      &lt;br/&gt;&lt;br/&gt;The Inventory Collector inventories applications, files, devices, and drivers on the system and sends the information to Microsoft.  This information is used to help diagnose compatibility problems.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the Inventory Collector will be turned off and data will not be sent to Microsoft. Collection of installation data through the Program Compatibility Assistant is also disabled.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the Inventory Collector will be turned on.&lt;br/&gt;&lt;br/&gt;Note: This policy setting has no effect if the Customer Experience Improvement Program is turned off. The Inventory Collector will be off." gpmc_supported="At least Windows Server 2008 R2 or Windows 7">Turn off Inventory Collector</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/AutoPlay Policies</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Disallow Autoplay for non-volume devices" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/AutoPlay Policies" gpmc_settingDescription="This policy setting disallows AutoPlay for MTP devices like cameras or phones.&lt;br/&gt;&lt;br/&gt;          If you enable this policy setting, AutoPlay is not allowed for MTP devices like cameras or phones.&lt;br/&gt;&lt;br/&gt;          If you disable or do not configure this policy setting, AutoPlay is enabled for non-volume devices." gpmc_supported="At least Windows Server 2008 R2 or Windows 7">Disallow Autoplay for non-volume devices</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Set the default behavior for AutoRun" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/AutoPlay Policies" gpmc_settingDescription="This policy setting sets the default behavior for Autorun commands.&lt;br/&gt;&lt;br/&gt;          Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines.&lt;br/&gt;&lt;br/&gt;          Prior to Windows Vista, when media containing an autorun command is inserted, the system will automatically execute the program without user intervention.&lt;br/&gt;&lt;br/&gt;          This creates a major security concern as code may be executed without user&amp;#39;s knowledge. The default behavior starting with Windows Vista is to prompt the user whether autorun command is to be run. The autorun command is represented as a handler in the Autoplay dialog.&lt;br/&gt;&lt;br/&gt;          If you enable this policy setting, an Administrator can change the default Windows Vista or later behavior for autorun to:&lt;br/&gt;&lt;br/&gt;          a) Completely disable autorun commands, or&lt;br/&gt;          b) Revert back to pre-Windows Vista behavior of automatically executing the autorun command.&lt;br/&gt;&lt;br/&gt;          If you disable or not configure this policy setting, Windows Vista or later will prompt the user whether autorun command is to be run." gpmc_supported="At least Windows Vista">Set the default behavior for AutoRun</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Default AutoRun Behavior</td><td>Do not execute any autorun commands</td></tr>
</table></td></tr><tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn off Autoplay" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/AutoPlay Policies" gpmc_settingDescription="This policy setting allows you to turn off the Autoplay feature.&lt;br/&gt;&lt;br/&gt;          Autoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs and the music on audio media start immediately.&lt;br/&gt;&lt;br/&gt;          Prior to Windows XP SP2, Autoplay is disabled by default on removable drives, such as the floppy disk drive (but not the CD-ROM drive), and on network drives.&lt;br/&gt;&lt;br/&gt;          Starting with Windows XP SP2, Autoplay is enabled for removable drives as well, including Zip drives and some USB mass storage devices.&lt;br/&gt;&lt;br/&gt;          If you enable this policy setting, Autoplay is disabled on CD-ROM and removable media drives, or disabled on all drives.&lt;br/&gt;&lt;br/&gt;          This policy setting disables Autoplay on additional types of drives. You cannot use this setting to enable Autoplay on drives on which it is disabled by default.&lt;br/&gt;&lt;br/&gt;          If you disable or do not configure this policy setting, AutoPlay is enabled.&lt;br/&gt;&lt;br/&gt;          Note: This policy setting appears in both the Computer Configuration and User Configuration folders. If the policy settings conflict, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration." gpmc_supported="At least Windows 2000">Turn off Autoplay</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Turn off Autoplay on:</td><td>All drives</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Biometrics/Facial Features</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Configure enhanced anti-spoofing" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Biometrics/Facial Features" gpmc_settingDescription="This policy setting determines whether enhanced anti-spoofing is required for Windows Hello face authentication.&lt;br/&gt;&lt;br/&gt;If you enable this setting, Windows requires all users on managed devices to use enhanced anti-spoofing for Windows Hello face authentication. This disables Windows Hello face authentication on devices that do not support enhanced anti-spoofing.&lt;br/&gt;&lt;br/&gt;If you disable or don&amp;#39;t configure this setting, Windows doesn&amp;#39;t require enhanced anti-spoofing for Windows Hello face authentication.&lt;br/&gt;&lt;br/&gt;Note that enhanced anti-spoofing for Windows Hello face authentication is not required on unmanaged devices.&lt;br/&gt;" gpmc_supported="At least Windows Server 2016 or Windows 10">Configure enhanced anti-spoofing</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/BitLocker Drive Encryption/Operating System Drives</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Configure minimum PIN length for startup" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/BitLocker Drive Encryption/Operating System Drives" gpmc_settingDescription="&lt;br/&gt;          This policy setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits.&lt;br/&gt;&lt;br/&gt;          If you enable this policy setting, you can require a minimum number of digits to be used when setting the startup PIN.&lt;br/&gt;&lt;br/&gt;          If you disable or do not configure this policy setting, users can configure a startup PIN of any length between 6 and 20 digits.&lt;br/&gt;&lt;br/&gt;          NOTE: If minimum PIN length is set below 6 digits, Windows will attempt to update the TPM 2.0 lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset.&lt;br/&gt;&lt;br/&gt;      " gpmc_supported="At least Windows Server 2008 R2 or Windows 7">Configure minimum PIN length for startup</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Minimum characters:</td><td>6</td></tr>
</table></td></tr><tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Require additional authentication at startup" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/BitLocker Drive Encryption/Operating System Drives" gpmc_settingDescription="This policy setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). This policy setting is applied when you turn on BitLocker.&lt;br/&gt;&lt;br/&gt;Note: Only one of the additional authentication options can be required at startup, otherwise a policy error occurs.&lt;br/&gt;&lt;br/&gt;If you want to use BitLocker on a computer without a TPM, select the &amp;quot;Allow BitLocker without a compatible TPM&amp;quot; check box. In this mode either a password or a USB drive is required for start-up. When using a startup key, the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable or if you have forgotten the password then you will need to use one of the BitLocker recovery options to access the drive.&lt;br/&gt;&lt;br/&gt;On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 6-digit to 20-digit personal identification number (PIN), or both.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, users can configure advanced startup options in the BitLocker setup wizard.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, users can configure only basic options on computers with a TPM.&lt;br/&gt;&lt;br/&gt;Note: If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard.&lt;br/&gt;&lt;br/&gt;" gpmc_supported="At least Windows Server 2008 R2 or Windows 7">Require additional authentication at startup</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive)</td><td>Enabled</td></tr>
<tr><td colspan="2">Settings for computers with a TPM:</td></tr><tr><td>Configure TPM startup:</td><td>Allow TPM</td></tr>
<tr><td>Configure TPM startup PIN:</td><td>Require startup PIN with TPM</td></tr>
<tr><td>Configure TPM startup key:</td><td>Allow startup key with TPM</td></tr>
<tr><td>Configure TPM startup key and PIN:</td><td>Allow startup key and PIN with TPM</td></tr>
<tr><td colspan="2"></td></tr></table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Cloud Content</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn off Microsoft consumer experiences" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Cloud Content" gpmc_settingDescription="This policy setting turns off experiences that help consumers make the most of their devices and Microsoft account.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, users will no longer see personalized recommendations from Microsoft and notifications about their Microsoft account.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, users may see suggestions from Microsoft and notifications about their Microsoft account.&lt;br/&gt;&lt;br/&gt;Note: This setting only applies to Enterprise and Education SKUs." gpmc_supported="At least Windows 10">Turn off Microsoft consumer experiences</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Credential User Interface</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Enumerate administrator accounts on elevation" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Credential User Interface" gpmc_settingDescription="This policy setting controls whether administrator accounts are displayed when a user attempts to elevate a running application. By default, administrator accounts are not displayed when the user attempts to elevate a running application.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, all local administrator accounts on the PC will be displayed so the user can choose one and enter the correct password.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, users will always be required to type a user name and password to elevate." gpmc_supported="At least Windows Vista">Enumerate administrator accounts on elevation</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Data Collection and Preview Builds</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow Telemetry" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Data Collection and Preview Builds" gpmc_settingDescription="By configuring this setting in Windows 10, end users will not be able to opt into a higher level of telemetry collection than the level you have set for your organization.  This limitation applies only to the Windows operating system and apps included with Windows, and does not apply to third-party apps running on Windows 10.&lt;br/&gt;&lt;br/&gt;Diagnostic data is categorized into four levels, as follows:&lt;br/&gt;  - 0 (Security). Information that&amp;#39;s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.&lt;br/&gt;  - 1 (Required). Basic device info, including: quality-related data, app compatibility, and data from the Security level.&lt;br/&gt;  - 2 (Enhanced). Additional insights, including: how Windows, Windows Server, System Center, and apps are used, how they perform, advanced reliability data, and data from both the Required and the Security levels.&lt;br/&gt;  - 3 (Optional). All data necessary to identify and help to fix problems, plus data from the Security, Required, and Enhanced levels.&lt;br/&gt;&lt;br/&gt;Options available to users in the Settings app are changed by configuring this setting, and even if not set, may be impacted by other group policy settings.  Note that if this policy is configured to allow a telemetry setting of Security or Basic, end users will be unable to select a higher level.&lt;br/&gt;      " gpmc_supported="At least Windows Server 2016, Windows 10">Allow Telemetry</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td></td><td>2 - Enhanced</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Delivery Optimization</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Download Mode" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Delivery Optimization" gpmc_settingDescription="Specifies the download method that Delivery Optimization can use in downloads of Windows Updates, Apps and App updates.&lt;br/&gt;&lt;br/&gt;The following list shows the supported values:&lt;br/&gt;&lt;br/&gt;0 = HTTP only, no peering.&lt;br/&gt;&lt;br/&gt;1 = HTTP blended with peering behind the same NAT.&lt;br/&gt;&lt;br/&gt;2 = HTTP blended with peering across a private group. Peering occurs on devices in the same Active Directory Site (if exist) or the same domain by default. When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2.&lt;br/&gt;&lt;br/&gt;3 = HTTP blended with Internet Peering.&lt;br/&gt;&lt;br/&gt;99 = Simple download mode with no peering. Delivery Optimization downloads using HTTP only and does not attempt to contact the Delivery Optimization cloud services.&lt;br/&gt;&lt;br/&gt;100 = Bypass mode. Do not use Delivery Optimization and use BITS instead." gpmc_supported="At least Windows Server 2016, Windows 10">Download Mode</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Download Mode:</td><td>LAN (1)</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Event Log Service/Application</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Specify the maximum log file size (KB)" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Event Log Service/Application" gpmc_settingDescription="This policy setting specifies the maximum size of the log file in kilobytes.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes), in kilobyte increments.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 1 megabyte." gpmc_supported="At least Windows Vista">Specify the maximum log file size (KB)</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Maximum Log Size (KB)</td><td>32768</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Event Log Service/Security</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Specify the maximum log file size (KB)" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Event Log Service/Security" gpmc_settingDescription="This policy setting specifies the maximum size of the log file in kilobytes.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, you can configure the maximum log file size to be between 20 megabytes (20480 kilobytes) and 2 terabytes (2147483647 kilobytes), in kilobyte increments.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 20 megabytes." gpmc_supported="At least Windows Vista">Specify the maximum log file size (KB)</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Maximum Log Size (KB)</td><td>1024000</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Event Log Service/System</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Specify the maximum log file size (KB)" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Event Log Service/System" gpmc_settingDescription="This policy setting specifies the maximum size of the log file in kilobytes.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes), in kilobyte increments.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 1 megabyte." gpmc_supported="At least Windows Vista">Specify the maximum log file size (KB)</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Maximum Log Size (KB)</td><td>32768</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/File Explorer</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn off Data Execution Prevention for Explorer" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/File Explorer" gpmc_settingDescription="Disabling data execution prevention can allow certain legacy plug-in applications to function without terminating Explorer." gpmc_supported="At least Windows Server 2008 R2 or Windows 7">Turn off Data Execution Prevention for Explorer</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn off heap termination on corruption" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/File Explorer" gpmc_settingDescription="Disabling heap termination on corruption can allow certain legacy plug-in applications to function without terminating Explorer immediately, although Explorer may still terminate unexpectedly later." gpmc_supported="At least Windows Vista">Turn off heap termination on corruption</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn off shell protocol protected mode" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/File Explorer" gpmc_settingDescription="This policy setting allows you to configure the amount of functionality that the shell protocol can have. When using the full functionality of this protocol, applications can open folders and launch files. The protected mode reduces the functionality of this protocol allowing applications to only open a limited set of folders. Applications are not able to open files with this protocol when it is in the protected mode. It is recommended to leave this protocol in the protected mode to increase the security of Windows.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting the protocol is fully enabled, allowing the opening of folders and files.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders.&lt;br/&gt;&lt;br/&gt;If you do not configure this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders." gpmc_supported="At least Windows XP Professional with SP2">Turn off shell protocol protected mode</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Internet Explorer</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Disable Internet Explorer 11 as a standalone browser" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Internet Explorer" gpmc_settingDescription="This policy lets you restrict launching of Internet Explorer as a standalone browser.&lt;br/&gt;&lt;br/&gt;If you enable this policy, it:&lt;br/&gt;- Prevents Internet Explorer 11 from launching as a standalone browser.&lt;br/&gt;- Restricts Internet Explorer&amp;#39;s usage to Microsoft Edge&amp;#39;s native &amp;#39;Internet Explorer mode&amp;#39;.&lt;br/&gt;- Redirects all attempts at launching Internet Explorer 11 to Microsoft Edge Stable Channel browser.&lt;br/&gt;- Overrides any other policies that redirect to Internet Explorer 11.&lt;br/&gt;&lt;br/&gt;If you disable, or don’t configure this policy, all sites are opened using the current active browser settings. Note: Microsoft Edge Stable Channel must be installed for this policy to take effect." gpmc_supported="At least Internet Explorer 11.0 on Windows 10">Disable Internet Explorer 11 as a standalone browser</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Notify that Internet Explorer 11 browser is disabled</td><td>Never</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Microsoft Edge</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Configure Password Manager" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Microsoft Edge" gpmc_settingDescription="This policy setting lets you decide whether employees can save their passwords locally, using Password Manager. By default, Password Manager is turned on.&lt;br/&gt;&lt;br/&gt;If you enable this setting, employees can use Password Manager to save their passwords locally.&lt;br/&gt;&lt;br/&gt;If you disable this setting, employees can&amp;#39;t use Password Manager to save their passwords locally.&lt;br/&gt;&lt;br/&gt;If you don&amp;#39;t configure this setting, employees can choose whether to use Password Manager to save their passwords locally." gpmc_supported="Microsoft Edge on Windows 10 or later">Configure Password Manager</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Prevent bypassing Windows Defender SmartScreen prompts for files" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Microsoft Edge" gpmc_settingDescription="This policy setting lets you decide whether employees can override the Windows Defender SmartScreen warnings about downloading unverified files.&lt;br/&gt;&lt;br/&gt;If you enable this setting, employees can&amp;#39;t ignore Windows Defender SmartScreen warnings and they are blocked from downloading the unverified files.&lt;br/&gt;&lt;br/&gt;If you disable or don&amp;#39;t configure this setting, employees can ignore Windows Defender SmartScreen warnings and continue the download process." gpmc_supported="Microsoft Edge on Windows 10, Version 1511 or later">Prevent bypassing Windows Defender SmartScreen prompts for files</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Prevent certificate error overrides" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Microsoft Edge" gpmc_settingDescription="Web security certificates are used to ensure a site your users go to is legitimate, and in some circumstances encrypts the data. With this policy, you can specify whether to prevent users from bypassing the security warning to sites that have SSL errors.&lt;br/&gt;&lt;br/&gt;If enabled, overriding certificate errors are not allowed.&lt;br/&gt;&lt;br/&gt;If disabled or not configured, overriding certificate errors are allowed." gpmc_supported="Microsoft Edge on Windows 10, Version 1809 or later">Prevent certificate error overrides</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Remote Desktop Services/Remote Desktop Connection Client</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Do not allow passwords to be saved" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection Client" gpmc_settingDescription="Controls whether passwords can be saved on this computer from Remote Desktop Connection.&lt;br/&gt;&lt;br/&gt;If you enable this setting the password saving checkbox in Remote Desktop Connection will be disabled and users will no longer be able to save passwords. When a user opens an RDP file using Remote Desktop Connection and saves his settings, any password that previously existed in the RDP file will be deleted.&lt;br/&gt;&lt;br/&gt;If you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection." gpmc_supported="At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2">Do not allow passwords to be saved</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Remote Desktop Services/Remote Desktop Session Host/Device and Resource Redirection</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Do not allow drive redirection" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Session Host/Device and Resource Redirection" gpmc_settingDescription="This policy setting specifies whether to prevent the mapping of client drives in a Remote Desktop Services session (drive redirection).&lt;br/&gt;&lt;br/&gt;By default, an RD Session Host server maps client drives automatically upon connection. Mapped drives appear in the session folder tree in File Explorer or Computer in the format &amp;lt;driveletter&amp;gt; on &amp;lt;computername&amp;gt;. You can use this policy setting to override this behavior.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, client drive redirection is not allowed in Remote Desktop Services sessions, and Clipboard file copy redirection is not allowed on computers running Windows Server 2003, Windows 8, and Windows XP.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, client drive redirection is always allowed. In addition, Clipboard file copy redirection is always allowed if Clipboard redirection is allowed.&lt;br/&gt;&lt;br/&gt;If you do not configure this policy setting, client drive redirection and Clipboard file copy redirection are not specified at the Group Policy level.&lt;br/&gt;" gpmc_supported="At least Windows Server 2003 operating systems or Windows XP Professional">Do not allow drive redirection</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Always prompt for password upon connection" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security" gpmc_settingDescription="This policy setting specifies whether Remote Desktop Services always prompts the client for a password upon connection.&lt;br/&gt;&lt;br/&gt;You can use this setting to enforce a password prompt for users logging on to Remote Desktop Services, even if they already provided the password in the Remote Desktop Connection client.&lt;br/&gt;&lt;br/&gt;By default, Remote Desktop Services allows users to automatically log on by entering a password in the Remote Desktop Connection client.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, users cannot automatically log on to Remote Desktop Services by supplying their passwords in the Remote Desktop Connection client. They are prompted for a password to log on.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, users can always log on to Remote Desktop Services automatically by supplying their passwords in the Remote Desktop Connection client.&lt;br/&gt;&lt;br/&gt;If you do not configure this policy setting, automatic logon is not specified at the Group Policy level.&lt;br/&gt;" gpmc_supported="At least Windows Server 2003 operating systems or Windows XP Professional">Always prompt for password upon connection</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Require secure RPC communication" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security" gpmc_settingDescription="Specifies whether a Remote Desktop Session Host server requires secure RPC communication with all clients or allows unsecured communication.&lt;br/&gt;&lt;br/&gt;You can use this setting to strengthen the security of RPC communication with clients by allowing only authenticated and encrypted requests.&lt;br/&gt;&lt;br/&gt;If the status is set to Enabled, Remote Desktop Services accepts requests from RPC clients that support secure requests, and does not allow unsecured communication with untrusted clients.&lt;br/&gt;&lt;br/&gt;If the status is set to Disabled, Remote Desktop Services always requests security for all RPC traffic. However, unsecured communication is allowed for RPC clients that do not respond to the request.&lt;br/&gt;&lt;br/&gt;If the status is set to Not Configured, unsecured communication is allowed.&lt;br/&gt;&lt;br/&gt;Note: The RPC interface is used for administering and configuring Remote Desktop Services." gpmc_supported="At least Windows Server 2003">Require secure RPC communication</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Set client connection encryption level" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security" gpmc_settingDescription="Specifies whether to require the use of a specific encryption level to secure communications between client computers and RD Session Host servers during Remote Desktop Protocol (RDP) connections. This policy only applies when you are using native RDP encryption. However, native RDP encryption (as opposed to SSL encryption) is not recommended. This policy does not apply to SSL encryption.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, all communications between clients and RD Session Host servers during remote connections must use the encryption method specified in this setting. By default, the encryption level is set to High. The following encryption methods are available:&lt;br/&gt;&lt;br/&gt;* High: The High setting encrypts data sent from the client to the server and from the server to the client by using strong 128-bit encryption. Use this encryption level in environments that contain only 128-bit clients (for example, clients that run Remote Desktop Connection). Clients that do not support this encryption level cannot connect to RD Session Host servers.&lt;br/&gt;&lt;br/&gt;* Client Compatible: The Client Compatible setting encrypts data sent between the client and the server at the maximum key strength supported by the client. Use this encryption level in environments that include clients that do not support 128-bit encryption.&lt;br/&gt;&lt;br/&gt;* Low: The Low setting encrypts only data sent from the client to the server by using 56-bit encryption.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this setting, the encryption level to be used for remote connections to RD Session Host servers is not enforced through Group Policy.&lt;br/&gt;&lt;br/&gt;Important&lt;br/&gt;&lt;br/&gt;FIPS compliance can be configured through the System cryptography. Use FIPS compliant algorithms for encryption, hashing, and signing settings in Group Policy (under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options.) The FIPS compliant setting encrypts and decrypts data sent from the client to the server and from the server to the client, with the Federal Information Processing Standard (FIPS) 140 encryption algorithms, by using Microsoft cryptographic modules. Use this encryption level when communications between clients and RD Session Host servers requires the highest level of encryption.&lt;br/&gt;" gpmc_supported="At least Windows Server 2003 operating systems or Windows XP Professional">Set client connection encryption level</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Encryption Level</td><td>High Level</td></tr>
<tr><td colspan="2">Choose the encryption level from the drop-down list.</td></tr></table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/RSS Feeds</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Prevent downloading of enclosures" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/RSS Feeds" gpmc_settingDescription="This policy setting prevents the user from having enclosures (file attachments) downloaded from a feed to the user&amp;#39;s computer.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the user cannot set the Feed Sync Engine to download an enclosure through the Feed property page. A developer cannot change the download setting through the Feed APIs.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the user can set the Feed Sync Engine to download an enclosure through the Feed property page. A developer can change the download setting through the Feed APIs." gpmc_supported="At least Internet Explorer 7.0">Prevent downloading of enclosures</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn on Basic feed authentication over HTTP" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/RSS Feeds" gpmc_settingDescription="This policy setting allows users to have their feeds authenticated through the Basic authentication scheme over an unencrypted HTTP connection.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the Windows RSS Platform authenticates feeds to servers by using the Basic authentication scheme in combination with a less secure HTTP connection.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the Windows RSS Platform does not authenticate feeds to servers by using the Basic authentication scheme in combination with a less secure HTTP connection.&lt;br/&gt;&lt;br/&gt;A developer cannot change this policy setting through the Feed APIs." gpmc_supported="At least Internet Explorer 8.0">Turn on Basic feed authentication over HTTP</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Search</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow indexing of encrypted files" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Search" gpmc_settingDescription="This policy setting allows encrypted items to be indexed. If you enable this policy setting, indexing  will attempt to decrypt and index the content (access restrictions will still apply). If you disable this policy setting, the search service components (including non-Microsoft components) are expected not to index encrypted items or encrypted stores. This policy setting is not configured by default. If you do not configure this policy setting, the local setting, configured through Control Panel, will be used. By default, the Control Panel setting is set to not index encrypted content.  &lt;br/&gt;&lt;br/&gt;When this setting is enabled or disabled, the index is rebuilt completely. &lt;br/&gt;&lt;br/&gt;Full volume encryption (such as BitLocker Drive Encryption or a non-Microsoft solution) must be used for the location of the index to maintain security for encrypted files." gpmc_supported="Microsoft Windows Vista, or any version of Windows with Windows Search 4.0 or later">Allow indexing of encrypted files</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Defender SmartScreen/Explorer</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Configure Windows Defender SmartScreen" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Defender SmartScreen/Explorer" gpmc_settingDescription="This policy allows you to turn Windows Defender SmartScreen on or off.  SmartScreen helps protect PCs by warning users before running potentially malicious programs downloaded from the Internet.  This warning is presented as an interstitial dialog shown before running an app that has been downloaded from the Internet and is unrecognized or known to be malicious.  No dialog is shown for apps that do not appear to be suspicious.&lt;br/&gt;&lt;br/&gt;Some information is sent to Microsoft about files and programs run on PCs with this feature enabled.&lt;br/&gt;&lt;br/&gt;If you enable this policy, SmartScreen will be turned on for all users.  Its behavior can be controlled by the following options:&lt;br/&gt;&lt;br/&gt;• Warn and prevent bypass&lt;br/&gt;• Warn&lt;br/&gt;&lt;br/&gt;If you enable this policy with the &amp;quot;Warn and prevent bypass&amp;quot; option, SmartScreen&amp;#39;s dialogs will not present the user with the option to disregard the warning and run the app.  SmartScreen will continue to show the warning on subsequent attempts to run the app.&lt;br/&gt;&lt;br/&gt;If you enable this policy with the &amp;quot;Warn&amp;quot; option, SmartScreen&amp;#39;s dialogs will warn the user that the app appears suspicious, but will permit the user to disregard the warning and run the app anyway.  SmartScreen will not warn the user again for that app if the user tells SmartScreen to run the app.&lt;br/&gt;&lt;br/&gt;If you disable this policy, SmartScreen will be turned off for all users.  Users will not be warned if they try to run suspicious apps from the Internet.&lt;br/&gt;&lt;br/&gt;If you do not configure this policy, SmartScreen will be enabled by default, but users may change their settings." gpmc_supported="At least Windows Server 2012, Windows 8 or Windows RT">Configure Windows Defender SmartScreen</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Pick one of the following settings:</td><td>Warn and prevent bypass</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Defender SmartScreen/Microsoft Edge</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Configure Windows Defender SmartScreen" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Defender SmartScreen/Microsoft Edge" gpmc_settingDescription="This policy setting lets you configure whether to turn on Windows Defender SmartScreen. Windows Defender SmartScreen provides warning messages to help protect your employees from potential phishing scams and malicious software. By default, Windows Defender SmartScreen is turned on.&lt;br/&gt;&lt;br/&gt;If you enable this setting, Windows Defender SmartScreen is turned on and employees can&amp;#39;t turn it off.&lt;br/&gt;&lt;br/&gt;If you disable this setting, Windows Defender SmartScreen is turned off and employees can&amp;#39;t turn it on.&lt;br/&gt;&lt;br/&gt;If you don&amp;#39;t configure this setting, employees can choose whether to use Windows Defender SmartScreen." gpmc_supported="Microsoft Edge on Windows 10 or later">Configure Windows Defender SmartScreen</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Prevent bypassing Windows Defender SmartScreen prompts for sites" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Defender SmartScreen/Microsoft Edge" gpmc_settingDescription="This policy setting lets you decide whether employees can override the Windows Defender SmartScreen warnings about potentially malicious websites.&lt;br/&gt;&lt;br/&gt;If you enable this setting, employees can&amp;#39;t ignore Windows Defender SmartScreen warnings and they are blocked from continuing to the site.&lt;br/&gt;&lt;br/&gt;If you disable or don&amp;#39;t configure this setting, employees can ignore Windows Defender SmartScreen warnings and continue to the site.&lt;br/&gt;    " gpmc_supported="Microsoft Edge on Windows 10, Version 1511 or later">Prevent bypassing Windows Defender SmartScreen prompts for sites</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Game Recording and Broadcasting</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Enables or disables Windows Game Recording and Broadcasting" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Game Recording and Broadcasting" gpmc_settingDescription="Windows Game Recording and Broadcasting.&lt;br/&gt;&lt;br/&gt;This setting enables or disables the Windows Game Recording and Broadcasting features. If you disable this setting, Windows Game Recording will not be allowed.&lt;br/&gt;If the setting is enabled or not configured, then Recording and Broadcasting (streaming) will be allowed.&lt;br/&gt; " gpmc_supported="At least Windows 10">Enables or disables Windows Game Recording and Broadcasting</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Hello for Business</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Use a hardware security device" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Hello for Business" gpmc_settingDescription="A Trusted Platform Module (TPM) provides additional security benefits over software because data protected by it cannot be used on other devices.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, Windows Hello for Business provisioning only occurs on devices with usable 1.2 or 2.0 TPMs. You can optionally exclude security devices, which prevents Windows Hello for Business provisioning from using those devices.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the TPM is still preferred, but all devices may provision Windows Hello for Business using software if the TPM is non-functional or unavailable.&lt;br/&gt;        " gpmc_supported="At least Windows 10">Use a hardware security device</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td colspan="2">Do not use the following security devices:</td></tr><tr><td>TPM 1.2</td><td>Disabled</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Ink Workspace</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow Windows Ink Workspace" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Ink Workspace" gpmc_settingDescription="Allow Windows Ink Workspace" gpmc_supported="At least Windows 10 Redstone">Allow Windows Ink Workspace</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Choose one of the following actions</td><td>&nbsp;</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Installer</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow user control over installs" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Installer" gpmc_settingDescription="This policy setting permits users to change installation options that typically are available only to system administrators.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, some of the security features of Windows Installer are bypassed. It permits installations to complete that otherwise would be halted due to a security violation.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the security features of Windows Installer prevent users from changing installation options typically reserved for system administrators, such as specifying the directory to which files are installed.&lt;br/&gt;&lt;br/&gt;If Windows Installer detects that an installation package has permitted the user to change a protected option, it stops the installation and displays a message. These security features operate only when the installation program is running in a privileged security context in which it has access to directories denied to the user.&lt;br/&gt;&lt;br/&gt;This policy setting is designed for less restrictive environments. It can be used to circumvent errors in an installation program that prevents software from being installed." gpmc_supported="At least Windows 2000">Allow user control over installs</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Always install with elevated privileges" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Installer" gpmc_settingDescription="This policy setting directs Windows Installer to use elevated permissions when it installs any program on the system.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, privileges are extended to all programs. These privileges are usually reserved for programs that have been assigned to the user (offered on the desktop), assigned to the computer (installed automatically), or made available in Add or Remove Programs in Control Panel. This profile setting lets users install programs that require access to directories that the user might not have permission to view or change, including directories on highly restricted computers.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the system applies the current user&amp;#39;s permissions when it installs programs that a system administrator does not distribute or offer.&lt;br/&gt;&lt;br/&gt;Note: This policy setting appears both in the Computer Configuration and User Configuration folders. To make this policy setting effective, you must enable it in both folders.&lt;br/&gt;&lt;br/&gt;Caution: Skilled users can take advantage of the permissions this policy setting grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this policy setting is not guaranteed to be secure." gpmc_supported="At least Windows 2000">Always install with elevated privileges</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Prevent Internet Explorer security prompt for Windows Installer scripts" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Installer" gpmc_settingDescription="This policy setting allows Web-based programs to install software on the computer without notifying the user.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, by default, when a script hosted by an Internet browser tries to install a program on the system, the system warns users and allows them to select or refuse the installation.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the warning is suppressed and allows the installation to proceed.&lt;br/&gt;&lt;br/&gt;This policy setting is designed for enterprises that use Web-based tools to distribute programs to their employees. However, because this policy setting can pose a security risk, it should be applied cautiously." gpmc_supported="At least Windows 2000">Prevent Internet Explorer security prompt for Windows Installer scripts</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Logon Options</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Sign-in and lock last interactive user automatically after a restart" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Logon Options" gpmc_settingDescription="This policy setting controls whether a device will automatically sign in and lock the last interactive user after the system restarts or after a shutdown and cold boot.&lt;br/&gt;&lt;br/&gt;This only occurs if the last interactive user didn’t sign out before the restart or shutdown.​&lt;br/&gt;&lt;br/&gt;If the device is joined to Active Directory or Azure Active Directory, this policy only applies to Windows Update restarts. Otherwise, this will apply to both Windows Update restarts and user-initiated restarts and shutdowns.​&lt;br/&gt;&lt;br/&gt;If you don’t configure this policy setting, it is enabled by default. When the policy is enabled, the user is automatically signed in and the session is automatically locked with all lock screen apps configured for that user after the device boots.​&lt;br/&gt;&lt;br/&gt;After enabling this policy, you can configure its settings through the ConfigAutomaticRestartSignOn policy, which configures the mode of automatically signing in and locking the last interactive user after a restart or cold boot​.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, the device does not configure automatic sign in. The user’s lock screen apps are not restarted after the system restarts." gpmc_supported="At least Windows 10 Version 1903">Sign-in and lock last interactive user automatically after a restart</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows PowerShell</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn on PowerShell Script Block Logging" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows PowerShell" gpmc_settingDescription="&lt;br/&gt;        This policy setting enables logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. If you enable this policy setting,&lt;br/&gt;        Windows PowerShell will log the processing of commands, script blocks, functions, and scripts - whether invoked interactively, or through automation.&lt;br/&gt;        &lt;br/&gt;        If you disable this policy setting, logging of PowerShell script input is disabled.&lt;br/&gt;        &lt;br/&gt;        If you enable the Script Block Invocation Logging, PowerShell additionally logs events when invocation of a command, script block, function, or script&lt;br/&gt;        starts or stops. Enabling Invocation Logging generates a high volume of event logs.&lt;br/&gt;        &lt;br/&gt;        Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.&lt;br/&gt;      " gpmc_supported="At least Microsoft Windows 7 or Windows Server 2008 family">Turn on PowerShell Script Block Logging</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Log script block invocation start / stop events:</td><td>Disabled</td></tr>
</table></td></tr><tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn on PowerShell Transcription" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows PowerShell" gpmc_settingDescription="&lt;br/&gt;        This policy setting lets you capture the input and output of Windows PowerShell commands into text-based transcripts.&lt;br/&gt;&lt;br/&gt;        If you enable this policy setting, Windows PowerShell will enable transcripting for Windows PowerShell, the Windows PowerShell ISE, and any other&lt;br/&gt;        applications that leverage the Windows PowerShell engine. By default, Windows PowerShell will record transcript output to each users&amp;#39; My Documents&lt;br/&gt;        directory, with a file name that includes &amp;#39;PowerShell_transcript&amp;#39;, along with the computer name and time started. Enabling this policy is equivalent&lt;br/&gt;        to calling the Start-Transcript cmdlet on each Windows PowerShell session.&lt;br/&gt;&lt;br/&gt;        If you disable this policy setting, transcripting of PowerShell-based applications is disabled by default, although transcripting can still be enabled&lt;br/&gt;        through the Start-Transcript cmdlet.&lt;br/&gt;        &lt;br/&gt;        If you use the OutputDirectory setting to enable transcript logging to a shared location, be sure to limit access to that directory to prevent users&lt;br/&gt;        from viewing the transcripts of other users or computers.&lt;br/&gt;&lt;br/&gt;        Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.&lt;br/&gt;      " gpmc_supported="At least Microsoft Windows 7 or Windows Server 2008 family">Turn on PowerShell Transcription</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame" >
<tr><td>Transcript output directory</td><td>C:\ProgramData\PS_Transcript</td></tr>
<tr><td>Include invocation headers:</td><td>Disabled</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Remote Management (WinRM)/WinRM Client</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow Basic authentication" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Remote Management (WinRM)/WinRM Client" gpmc_settingDescription="This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Basic authentication.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the WinRM client uses Basic authentication. If WinRM is configured to use HTTP transport, the user name and password are sent over the network as clear text.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the WinRM client does not use Basic authentication." gpmc_supported="At least Windows Vista">Allow Basic authentication</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow unencrypted traffic" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Remote Management (WinRM)/WinRM Client" gpmc_settingDescription="This policy setting allows you to manage whether the Windows Remote Management (WinRM) client sends and receives unencrypted messages over the network.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the WinRM client sends and receives unencrypted messages over the network.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the WinRM client sends or receives only encrypted messages over the network." gpmc_supported="At least Windows Vista">Allow unencrypted traffic</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Disallow Digest authentication" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Remote Management (WinRM)/WinRM Client" gpmc_settingDescription="This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Digest authentication.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the WinRM client does not use Digest authentication.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the WinRM client uses Digest authentication." gpmc_supported="At least Windows Vista">Disallow Digest authentication</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Remote Management (WinRM)/WinRM Service</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3" >
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow Basic authentication" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Remote Management (WinRM)/WinRM Service" gpmc_settingDescription="This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Basic authentication from a remote client.&lt;br/&gt;&lt;br/&gt;        If you enable this policy setting, the WinRM service accepts Basic authentication from a remote client.&lt;br/&gt;&lt;br/&gt;        If you disable or do not configure this policy setting, the WinRM service does not accept Basic authentication from a remote client." gpmc_supported="At least Windows Vista">Allow Basic authentication</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow unencrypted traffic" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Remote Management (WinRM)/WinRM Service" gpmc_settingDescription="This policy setting allows you to manage whether the Windows Remote Management (WinRM) service sends and receives unencrypted messages over the network.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the WinRM client sends and receives unencrypted messages over the network.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the WinRM client sends or receives only encrypted messages over the network." gpmc_supported="At least Windows Vista">Allow unencrypted traffic</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Disallow WinRM from storing RunAs credentials" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Remote Management (WinRM)/WinRM Service" gpmc_settingDescription="This policy setting allows you to manage whether the Windows Remote Management (WinRM) service will not allow RunAs credentials to be stored for any plug-ins.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the WinRM service will not allow the RunAsUser or RunAsPassword configuration values to be set for any plug-ins.  If a plug-in has already set the RunAsUser and RunAsPassword configuration values, the RunAsPassword configuration value will be erased from the credential store on this computer.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the WinRM service will allow the RunAsUser and RunAsPassword configuration values to be set for plug-ins and the RunAsPassword value will be stored securely.&lt;br/&gt;&lt;br/&gt;If you enable and then disable this policy setting,any values that were previously configured for RunAsPassword will need to be reset." gpmc_supported="At least Windows Vista">Disallow WinRM from storing RunAs credentials</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div></div></div></div>
<div class="filler"></div>
<div class="he0_expanded"><span class="sectionTitle" tabindex="0">User Configuration (Disabled)</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i">No settings defined.</div></div>
</body></html>