<html dir="ltr" xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" gpmc_reportInitialized="false">
<head>
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta http-equiv="Content-Type" content="text/html; charset=UTF-16" />
<title>C - MSFT Windows 11 24H2</title>
<!-- Styles -->
<style type="text/css">
                body    { background-color:#FFFFFF; border:1px solid #666666; color:#000000; font-size:68%; font-family:MS Shell Dlg; margin:0,0,10px,0; word-break:normal; word-wrap:break-word; }

                table   { font-size:100%; table-layout:fixed; width:100%; }

                td,th   { overflow:visible; text-align:left; vertical-align:top; white-space:normal; }

                .title  { background:#FFFFFF; border:none; color:#333333; display:inline-table; height:24px; margin:0px,0px,0px,0px; padding-top:0px; position:relative; table-layout:fixed; z-index:5; }

                .he0_expanded    { background-color:#FEF7D6; border:1px solid #BBBBBB; color:#3333CC; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:0px; margin-right:0px; padding-left:8px; padding-right:5em; padding-top:4px; position:relative; }

                .he1_expanded    { background-color:#A0BACB; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:20px; margin-right:0px; padding-left:8px; padding-right:5em; padding-top:4px; position:relative; }

                .he0h_expanded   { background-color: #FEF0D0; border: 1px solid #BBBBBB; color: #000000; cursor: hand; display: block; font-family: MS Shell Dlg; font-size: 100%; font-weight: bold; height: 2.25em; margin-bottom: -1px; margin-left: 5px; margin-right: 0px; padding-left: 8px; padding-right: 5em; padding-top: 4px; position: relative;  }
                .he1h_expanded   { background-color: #7197B3; border: 1px solid #BBBBBB; color: #000000; cursor: hand; display: block; font-family: MS Shell Dlg; font-size: 100%; font-weight: bold; height: 2.25em; margin-bottom: -1px; margin-left: 10px; margin-right: 0px; padding-left: 8px; padding-right: 5em; padding-top: 4px; position: relative; }

                .he1    { background-color:#A0BACB; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:20px; margin-right:0px; padding-left:8px; padding-right:5em; padding-top:4px; position:relative; }

                .he2    { background-color:#C0D2DE; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:30px; margin-right:0px; padding-left:8px; padding-right:5em; padding-top:4px; position:relative; }

                .he3    { background-color:#D9E3EA; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:40px; margin-right:0px; padding-left:11px; padding-right:5em; padding-top:4px; position:relative; }

                .he4    { background-color:#E8E8E8; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:50px; margin-right:0px; padding-left:11px; padding-right:5em; padding-top:4px; position:relative; }

                .he4h   { background-color:#E8E8E8; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:55px; margin-right:0px; padding-left:11px; padding-right:5em; padding-top:4px; position:relative; }

                .he4i   { background-color:#F9F9F9; border:1px solid #BBBBBB; color:#000000; display:block; font-family:MS Shell Dlg; font-size:100%; margin-bottom:-1px; margin-left:55px; margin-right:0px; padding-bottom:5px; padding-left:21px; padding-top:4px; position:relative; }

                .he2i   { background-color:#F9F9F9; border:1px solid #BBBBBB; color:#000000; display:block; font-family:MS Shell Dlg; font-size:100%; margin-bottom:-1px; margin-left:35px; margin-right:0px; padding-bottom:5px; padding-left:21px; padding-top:4px; position:relative;}
                .he5    { background-color:#E8E8E8; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:60px; margin-right:0px; padding-left:11px; padding-right:5em; padding-top:4px; position:relative; }

                .he5h   { background-color:#E8E8E8; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; padding-left:11px; padding-right:5em; padding-top:4px; margin-bottom:-1px; margin-left:65px; margin-right:0px; position:relative; }

                .he5i   { background-color:#F9F9F9; border:1px solid #BBBBBB; color:#000000; display:block; font-family:MS Shell Dlg; font-size:100%; margin-bottom:-1px; margin-left:65px; margin-right:0px; padding-left:21px; padding-bottom:5px; padding-top: 4px; position:relative; }

                div .expando { color:#000000; text-decoration:none; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:normal; position:absolute; right:10px; text-decoration:underline; z-index: 0; }

                .he0 .expando { font-size:100%; }

                .info, .info3, .info4, .disalign  { line-height:1.6em; padding:0px,0px,0px,0px; margin:0px,0px,0px,0px; }

                .disalign TD                      { padding-bottom:5px; padding-right:10px; }

                .info TD                          { padding-right:10px; width:50%; }

                .info3 TD                         { padding-right:10px; width:33%; }

                .info4 TD, .info4 TH              { padding-right:10px; width:25%; }

                .info TH, .info3 TH, .info4 TH, .disalign TH { border-bottom:1px solid #CCCCCC; padding-right:10px; }

                .subtable, .subtable3             { border:1px solid #CCCCCC; margin-left:0px; background:#FFFFFF; margin-bottom:10px; }

                .subtable TD, .subtable3 TD       { padding-left:10px; padding-right:5px; padding-top:3px; padding-bottom:3px; line-height:1.1em; }

                .subtable TH, .subtable3 TH       { border-bottom:1px solid #CCCCCC; font-weight:normal; padding-left:10px; line-height:1.6em;  }

                .subtable .footnote               { border-top:1px solid #CCCCCC; }

                .subtable3 .footnote, .subtable .footnote { border-top:1px solid #CCCCCC; }

                .subtable_frame     { background:#D9E3EA; border:1px solid #CCCCCC; margin-bottom:10px; margin-left:15px; }

                .subtable_frame TD  { line-height:1.1em; padding-bottom:3px; padding-left:10px; padding-right:15px; padding-top:3px; }

                .subtable_frame TH  { border-bottom:1px solid #CCCCCC; font-weight:normal; padding-left:10px; line-height:1.6em; }

                .subtableInnerHead { border-bottom:1px solid #CCCCCC; border-top:1px solid #CCCCCC; }

                .explainlink            { color:#0000FF; text-decoration:none; cursor:hand; }

                .explainlink:hover      { color:#0000FF; text-decoration:underline; }

                .spacer { background:transparent; border:1px solid #BBBBBB; color:#FFFFFF; display:block; font-family:MS Shell Dlg; font-size:100%; height:10px; margin-bottom:-1px; margin-left:43px; margin-right:0px; padding-top: 4px; position:relative; }

                .filler { background:transparent; border:none; color:#FFFFFF; display:block; font:100% MS Shell Dlg; line-height:8px; margin-bottom:-1px; margin-left:53px; margin-right:0px; padding-top:4px; position:relative; }

                .container { display:block; position:relative; }

                .rsopheader { background-color:#A0BACB; border-bottom:1px solid black; color:#333333; font-family:MS Shell Dlg; font-size:130%; font-weight:bold; padding-bottom:5px; text-align:center; }

                .rsopname { color:#333333; font-family:MS Shell Dlg; font-size:130%; font-weight:bold; padding-left:11px; }

                .gponame{ color:#333333; font-family:MS Shell Dlg; font-size:130%; font-weight:bold; padding-left:11px; }

                .gpotype{ color:#333333; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; padding-left:11px; }

                #uri    { color:#333333; font-family:MS Shell Dlg; font-size:100%; padding-left:11px; }

                #dtstamp{ color:#333333; font-family:MS Shell Dlg; font-size:100%; padding-left:11px; text-align:left; width:30%; }

                #objshowhide { color:#000000; cursor:hand; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; margin-right:0px; padding-right:10px; text-align:right; text-decoration:underline; z-index:2; word-wrap:normal; }

                #gposummary { display:block; }

                #gpoinformation { display:block; }

                @media print {

                    #objshowhide{ display:none; }

                    body    { color:#000000; border:1px solid #000000; }

                    .title  { color:#000000; border:1px solid #000000; }

                    .he0_expanded    { color:#000000; border:1px solid #000000; }

                    .he1h_expanded   { color:#000000; border:1px solid #000000; }

                    .he1_expanded    { color:#000000; border:1px solid #000000; }

                    .he1    { color:#000000; border:1px solid #000000; }

                    .he2    { color:#000000; background:#EEEEEE; border:1px solid #000000; }

                    .he3    { color:#000000; border:1px solid #000000; }

                    .he4    { color:#000000; border:1px solid #000000; }

                    .he4h   { color:#000000; border:1px solid #000000; }

                    .he4i   { color:#000000; border:1px solid #000000; }

                    .he5    { color:#000000; border:1px solid #000000; }

                    .he5h   { color:#000000; border:1px solid #000000; }

                    .he5i   { color:#000000; border:1px solid #000000; }

                    }

</style>
<!-- Scripts -->
<script type="text/javascript" language="javascript">
<!--
/*
String "strShowHide(0/1)"
0 = Hide all mode.
1 = Show all mode.
*/

var windowsArray = new Array();
var strShowHide = 1;

//Localized strings

var strShow = "show";
var strHide = "hide";
var strShowAll = "show all";
var strHideAll = "hide all";
var strShown = "shown";
var strHidden = "hidden";
var strExpandoNumPixelsFromEdge = "10px";


function IsSectionHeader(obj) {
    return (obj.className === "he0_expanded") || (obj.className === "he0h_expanded") || (obj.className === "he1h_expanded") || (obj.className === "he1_expanded") || (obj.className === "he1") || (obj.className === "he2") || (obj.className === "he3") || (obj.className === "he4") || (obj.className === "he4h") || (obj.className === "he5") || (obj.className === "he5h");
}

function IsSectionExpandedByDefault(objHeader) {
    if (objHeader === null) {
        return false;
    } else {
        return (objHeader.className.slice(objHeader.className.lastIndexOf("_")) === "_expanded");
    }
}

function SetSectionState(objHeader, strState) {
    var i = 0;
    var j;
    var all = objHeader.parentElement.ownerDocument.all;

    if (all === null) {
        return;
    }

    for (j = 0; j < all.length; j++) {
        if (all[j] === objHeader) {
            break;
        }
        i = i + 1;
    }

    for (j = i; j < all.length; j++) {
        if (all[i].className === "container") {
            break;
        }
        i = i + 1;
    }

    var objContainer = all[i];

    if (strState === "toggle") {
        if (objContainer.style.display === "none") {
            SetSectionState(objHeader, "show");
        }
        else {
            SetSectionState(objHeader, "hide");
        }
    }
    else {
        var objExpando = objHeader.children[1];

        if (strState === "show") {
            objContainer.style.display = "block";
            objExpando.innerText = strHide;
        }
        else if (strState === "hide") {
            objContainer.style.display = "none";
            objExpando.innerText = strShow;
        }
    }
}

function ShowSection(objHeader) {
    SetSectionState(objHeader, "show");
}

function HideSection(objHeader) {
    SetSectionState(objHeader, "hide");
}

function ToggleSection(objHeader) {
    SetSectionState(objHeader, "toggle");
}

/*================================================================================
' link at the top of the page to collapse/expand all collapsable elements
'================================================================================
*/
function objshowhide_onClick() {
    var obji;
    var objBody = document.body.getElementsByTagName("*");

    if (objBody === null) {
        return;
    }
    
    switch (strShowHide) {
        case 0:
            strShowHide = 1;
            window.objshowhide.innerText = strShowAll;
            for (obji = 0; obji < objBody.length; obji++) {
                if (objBody[obji].className !== 'undefined' && IsSectionHeader(objBody[obji])) {
                    HideSection(objBody[obji]);
                }
            }
            break;
        case 1:
            strShowHide = 0;
            window.objshowhide.innerText = strHideAll;
            for (obji = 0; obji < objBody.length; obji++) {
                if (objBody[obji].className !== 'undefined' && IsSectionHeader(objBody[obji])) {
                    ShowSection(objBody[obji]);
                }
            }
            break;
    }
}

/*================================================================================
' onload collapse all except the first two levels of headers (he0, he1)
'================================================================================*/
function window_onload() {
    // Only initialize once.  The UI may reinsert a report into the webbrowser control,
    // firing onLoad multiple times.
    if (document.documentElement.getAttribute("gpmc_reportInitialized").toUpperCase() !== "TRUE") {
        // Set text direction
        fDetDir(document.dir.toUpperCase());

        // Initialize sections to default expanded/collapsed state.
        var objBody = document.body.getElementsByTagName("*");

        if (objBody === null) {
            return;
        }

        for (var obji = 0; obji < objBody.length; obji++) {
            if (IsSectionHeader(objBody[obji])) {
                if (IsSectionExpandedByDefault(objBody[obji])) {
                    ShowSection(objBody[obji]);
                }
                else {
                    HideSection(objBody[obji]);
                }
            }
        }

        objshowhide.innerText = strShowAll;

        document.documentElement.setAttribute("gpmc_reportInitialized", "true");
    }
}

/*'================================================================================
' When direction (LTR/RTL) changes, change adjust for readability
'================================================================================
*/
function document_onPropertyChange() {
    if (window.event.propertyName === "dir") {
        fDetDir(document.dir.toUpperCase());
    }
}

function fDetDir(strDir) {
    var colRules;
    var nug;
    var i;
    var strClass;

    switch (strDir.toUpperCase()) {
        case "LTR":
            colRules = document.styleSheets[0].cssRules;
            if (colRules !== null && colRules !== undefined ) {            
                for (i = 0; i < colRules.length - 1; i++) {
                    nug = colRules[i];
                    strClass = nug.selectorText;
                    if (nug.style.textAlign === "right") {
                        nug.style.textAlign = "left";
                    }
                    switch (strClass) {
                        case "div .expando":
                            nug.style.Left = "";
                            nug.style.Right = strExpandoNumPixelsFromEdge;
                            break;
                        case "#objshowhide":
                            nug.style.textAlign = "right";
                            break;
                    }
                }
            }
            break;
        case "RTL":
            colRules = document.styleSheets[0].cssRules;
            if (colRules !== null && colRules !== undefined ) {            
                for (i = 0; i < colRules.length - 1; i++) {
                    nug = colRules[i];
                    strClass = nug.selectorText;
                    if (nug.style.textAlign === "left") {
                        nug.style.textAlign = "right";
                    }
                    switch (strClass) {
                        case "div .expando":
                            nug.style.Left = strExpandoNumPixelsFromEdge;
                            nug.style.Right = "";
                            break;
                        case "#objshowhide":
                            nug.style.textAlign = "left";
                            break;
                    }
                }
            }
            break;
    }
}

/*'================================================================================
'When printing reports, if a given section is expanded, let's says "shown" (instead of "hide" in the UI).
'================================================================================
*/
function window_onbeforeprint() {
    var obji;
    for (obji in document.all) {
        if (document.all.hasOwnProperty(obji)) {
            if (obji.className === "expando") {
                if (obji.innerText === strHide) {
                    obji.innerText = strShown;
                }
                if (obji.innerText === strShow) {
                    obji.innerText = strHidden;
                }
            }
        }
    }
}

/*================================================================================
'If a section is collapsed, change to "hidden" in the printout (instead of "show").
'================================================================================
*/
function window_onafterprint() {
    var obji;
    for (obji in document.all) {
        if (document.all.hasOwnProperty(obji)) {
            if (obji.className === "expando") {
                if (obji.innerText === strShown) {
                    obji.innerText = strHide;
                }
                if (obji.innerText === strHidden) {
                    obji.innerText = strShow;
                }
            }
        }
    }
}

/*================================================================================
' Adding keypress support for accessibility
'================================================================================
*/
function document_onkeypress(event) {
    var chCode = ('charCode' in event) ? event.charCode : event.keyCode;

    //space bar (32) or carriage return (13) or line feed (10)
    if (chCode == "32" || chCode == "13" || chCode == "10") {
        if (event.srcElement.className === "expando") {
            document_onclick();
            event.returnValue = false;
        }
        if (event.srcElement.className === "sectionTitle") {
            document_onclick();
            event.returnValue = false;
        }
        if (event.srcElement.id === "objshowhide") {
            objshowhide_onClick();
            event.returnValue = false;
        }
    }
}

/*================================================================================
' When user clicks anywhere in the document body, determine if user is clicking
' on a header element.
'================================================================================
*/
function document_onclick() {
    var strsrc = window.event.srcElement;

    while (strsrc.className === "sectionTitle" || strsrc.className === "expando") {
        strsrc = strsrc.parentElement;
    }

    // Only handle clicks on headers.
    if (!IsSectionHeader(strsrc)) {
        return;
    }

    ToggleSection(strsrc);

    window.event.returnValue = false;
}

function ToggleState(e) {
    var objParentDisplayItem;
    var objDisplayItem;
    var i;

    if (e.innerText === strShow) {
        e.innerText = strHide;
        objParentDisplayItem = e.parentNode;
        objDisplayItem = objParentDisplayItem.childNodes;
        for (i = 0; i < objDisplayItem.length; i++) {
            if (objDisplayItem[i].id === "showItem") {
                objDisplayItem[i].style.display = "Block";
            }
        }
    }
    else {
        e.innerText = strShow;
        objParentDisplayItem = e.parentNode;
        objDisplayItem = objParentDisplayItem.childNodes;
        for (i = 0; i < objDisplayItem.length; i++) {
            if (objDisplayItem[i].id === "showItem") {
                objDisplayItem[i].style.display = "None";
            }
        }
    }
}

function traverseToURL(url) {
    if (url != null) {
        var urlInitialSubstr = url.substring(0, 4).toLowerCase();
        if (urlInitialSubstr === "http") {
            window.open(url, "_blank");
        }
    }
}

function getExplainWindowTitle() {
    return document.getElementById("explainText_windowTitle").innerHTML;
}

function getExplainWindowStyles() {
    return document.getElementById("explainText_windowStyles").innerHTML;
}

function getExplainWindowSettingPathLabel() {
    return document.getElementById("explainText_settingPathLabel").innerHTML;
}

function getExplainWindowExplainTextLabel() {
    return document.getElementById("explainText_explainTextLabel").innerHTML;
}

function getExplainWindowPrintButton() {
    return document.getElementById("explainText_printButton").innerHTML;
}

function getExplainWindowCloseButton() {
    return document.getElementById("explainText_closeButton").innerHTML;
}

function getNoExplainTextAvailable() {
    return document.getElementById("explainText_noExplainTextAvailable").innerHTML;
}

function getExplainWindowSupportedLabel() {
    return document.getElementById("explainText_supportedLabel").innerHTML;
}

function getNoSupportedTextAvailable() {
    return document.getElementById("explainText_noSupportedTextAvailable").innerHTML;
}

function showExplainText(srcElement)
{
    var strDiagArgs;

    var strSettingName = srcElement.getAttribute("gpmc_settingName");
    var strSettingPath = srcElement.getAttribute("gpmc_settingPath");
    var strSettingDescription = srcElement.getAttribute("gpmc_settingDescription");

    if (strSettingDescription === "")
    {
        strSettingDescription = getNoExplainTextAvailable();
    }

    var strSupported = srcElement.getAttribute("gpmc_supported");

    if (strSupported === "")
    {
        strSupported = getNoSupportedTextAvailable();
    }

    var strHtml = "<html dir=" + document.dir +  ">\n";
    strHtml += "<head>\n";
    strHtml += "<title>" + getExplainWindowTitle() + "</title>\n";
    strHtml += "<style type='text/css'>\n" + getExplainWindowStyles() + "</style>\n";
    strHtml += "</head>\n";
    strHtml += "<body>\n";
    strHtml += "<div class='head'>" + strSettingName +"</div>\n";
    strHtml += "<div class='path'><b>" + getExplainWindowSettingPathLabel() + "</b><br/>" + strSettingPath +"</div>\n";
    strHtml += "<div class='path'><b>" + getExplainWindowSupportedLabel() + "</b><br/>" + strSupported +"</div>\n";
    strHtml += "<div class='info'>\n";
    strHtml += "<div class='hdr'>" + getExplainWindowExplainTextLabel() + "</div>\n";
    strHtml += "<div class='bdy'>" + strSettingDescription + "</div>\n";
    strHtml += "<div class='btn'>";
    strHtml += getExplainWindowPrintButton();
    strHtml += getExplainWindowCloseButton();
    strHtml += "</div></body></html>";

    // IE specific method for showing the popup.
    if(navigator.userAgent.indexOf("MSIE") > 0 && window.location.toString().indexOf("file:") === -1)
    {
        strDiagArgs = "dialogHeight=360px;dialogWidth=630px;status=no;scroll=yes;resizable=yes;minimize=yes;maximize=yes;";

        var vModeless = window.showModelessDialog("about:blank", window, strDiagArgs);
        vModeless.document.write(strHtml);
        vModeless.document.close();
        vModeless.location.reload(false);
                        
        window.event.returnValue = false;
    }
    else
    {
        strDiagArgs = "height=360px, width=630px, status=no, toolbar=no, scrollbars=yes, resizable=yes ";
        
        var expWin = window.open("", "expWin", strDiagArgs);
        expWin.document.write("");
        expWin.document.close();
        expWin.document.write(strHtml);
        expWin.document.close();
        expWin.focus();
    }
    
    return false;
}

function showEvents(srcElement,bVerbose,bInformational,bWarning,bError)
{
    var strWindowId = "EventDetails_" + srcElement.getAttribute("eventLogActivityId");
    if((windowsArray[strWindowId]) && (windowsArray[strWindowId].closed === false)) {
        windowsArray[strWindowId].focus();
    } else {
        var eventIdLabelNode, eventTimeLabelNode, eventDescriptionLabelNode, eventDetailsLabelNode, eventXmlLabelNode, gpEventsTitleNode;
        var eventIdLabelNodeText, eventTimeLabelNodeText, eventDescriptionLabelNodeText, eventXmlLabelNodeText, gpEventsTitleNodeText, eventDetailsLabelNodeText;
        var singlePassEventsDetailsNode, eventRecordArray;
        var dataNotFoundWarningLabelNode, dataNotFoundWarningLabelNodeText;
        var mainSection;
        var attributeValue;
        var singlePassEventsDetails;
        var singlePassEventsDetailsChildren;
        var node;
        var children;
        var xmlDocumentRoot;
        var xmlDocument;
        var serializer;
        var itemSub;
        var doc;

        if (window.XMLSerializer) 
        {
           serializer = new XMLSerializer();
        }

        if (window.DOMParser) 
        {
           // This browser appears to support DOMParser
           parser = new DOMParser();

           doc = document.getElementById("data-island").textContent;
           xmlDocumentRoot = parser.parseFromString(doc, "application/xml");
           xmlDocument = xmlDocumentRoot.documentElement;
           itemSub = 1;
        } 
        else 
        { 
           // Internet Explorer, create a new XML document using ActiveX 
           // and use loadXML as a DOM parser. 
           try 
           {
              doc = document.getElementById("data-island");

              xmlDocumentRoot = new ActiveXObject("Msxml2.DOMDocument.6.0"); 
              xmlDocumentRoot.async = false; 
              xmlDocumentRoot.loadXML(doc.innerHTML);
              xmlDocument = xmlDocumentRoot.documentElement;
              itemSub = 0;
           } 
           catch(e) 
           {
              // Not supported.
           }
        }

        if (xmlDocument != null) {
            mainSection = xmlDocument.getElementsByTagName("MainSection")[0].childNodes;

            if (mainSection != null) {
                for (children = 0; children < mainSection.length; children++) {
                    node = mainSection[children];
                    if (node.nodeType === 1 && node.nodeName === 'Label') {
                        attributeValue = node.getAttribute("Name");
                        if (attributeValue != null) {
                            if (attributeValue === 'ComponentStatus_EventId') {
                                eventIdLabelNode = node.childNodes[1];
                            }
                            if (attributeValue === 'ComponentStatus_EventTime') {
                                eventTimeLabelNode = node.childNodes[1];
                            }
                            if (attributeValue === 'ComponentStatus_EventDescription') {
                                eventDescriptionLabelNode = node.childNodes[1];
                            }
                            if (attributeValue === 'ComponentStatus_EventXml') {
                                eventXmlLabelNode = node.childNodes[1];
                            }
                            if (attributeValue === 'ComponentStatus_EventDetails') {
                                eventDetailsLabelNode = node.childNodes[1];
                            }
                            if (attributeValue === 'ComponentStatus_GPEvents') {
                                gpEventsTitleNode = node.childNodes[1];
                            }
                            if (attributeValue === 'Warning_DataNotFound') {
                                dataNotFoundWarningLabelNode = node.childNodes[1];
                            }
                        }
                    }
                }
            }

            singlePassEventsDetails = xmlDocument.getElementsByTagName("SinglePassEventsDetails");
            if (singlePassEventsDetails != null) {
                for (singlePassEventsDetailsChildren = 0; singlePassEventsDetailsChildren < singlePassEventsDetails.length; singlePassEventsDetailsChildren++) {
                    node = singlePassEventsDetails[singlePassEventsDetailsChildren];
                    attributeValue = node.getAttribute("ActivityId");
                    if (attributeValue === srcElement.getAttribute("eventLogActivityId")) {
                        singlePassEventsDetailsNode = node;
                    }
                }
            }
        }
        
        eventIdLabelNodeText = null;
        if (eventIdLabelNode != null) {
            if (eventIdLabelNode.childNodes.length > 0) {
                eventIdLabelNodeText = eventIdLabelNode.childNodes[0].nodeValue;
            }
        }
        if (eventIdLabelNodeText == null) {
            eventIdLabelNodeText = "Event ID";
        }

        eventTimeLabelNodeText = null;
        if (eventTimeLabelNode != null) {
            if (eventTimeLabelNode.firstChild.childNodes.length > 0) {
                eventTimeLabelNodeText = eventTimeLabelNode.childNodes[0].nodeValue;
            }
        }
        if (eventTimeLabelNodeText == null) {
            eventTimeLabelNodeText = "Event Time";
        }

        eventDescriptionLabelNodeText = null;
        if (eventDescriptionLabelNode != null) {
            if (eventDescriptionLabelNode.childNodes.length > 0) {
                eventDescriptionLabelNodeText = eventDescriptionLabelNode.childNodes[0].nodeValue;
            }
        }
        if (eventDescriptionLabelNodeText == null) {
            eventDescriptionLabelNodeText = "Event Description";
        }

        eventXmlLabelNodeText = null;
        if (eventXmlLabelNode != null) {
            if (eventXmlLabelNode.childNodes.length > 0) {
                eventXmlLabelNodeText = eventXmlLabelNode.childNodes[0].nodeValue;
            }
        }
        if (eventXmlLabelNodeText == null) {
            eventXmlLabelNodeText = "Event XML";
        }

        gpEventsTitleNodeText = null;
        if (gpEventsTitleNode != null) {
            if (gpEventsTitleNode.childNodes.length > 0) {
                gpEventsTitleNodeText = gpEventsTitleNode.childNodes[0].nodeValue;
            }
        }
        if (gpEventsTitleNodeText == null) {
            gpEventsTitleNodeText = "Group Policy Events";
        }

        eventDetailsLabelNodeText = null;
        if (eventDetailsLabelNode != null) {
            if (eventDetailsLabelNode.childNodes.length > 0) {
                eventDetailsLabelNodeText = eventDetailsLabelNode.childNodes[0].nodeValue;
            }
        }
        if (eventDetailsLabelNodeText == null) {
            eventDetailsLabelNodeText = "Event Details";
        }

        dataNotFoundWarningLabelNodeText = null;
        if (dataNotFoundWarningLabelNode != null) {
            if (dataNotFoundWarningLabelNode.childNodes.length > 0) {
                dataNotFoundWarningLabelNodeText = dataNotFoundWarningLabelNode.childNodes[0].nodeValue;
            }
        }
        if (dataNotFoundWarningLabelNodeText == null) {
            dataNotFoundWarningLabelNodeText = "Data Not Found";
        }
                
        if(singlePassEventsDetailsNode != null)
        {
            eventRecordArray = singlePassEventsDetailsNode.getElementsByTagName("EventRecord");
        }
        
        var htmlText = "<html dir=" + document.dir +  ">";
        htmlText = htmlText + "<head>";
        htmlText = htmlText + "<meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\" />";
        htmlText = htmlText + "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-16\" />";
        htmlText = htmlText + "<title>" + gpEventsTitleNodeText + "</title>";
        htmlText = htmlText + "</head><style type=\"text/css\">";
        htmlText = htmlText + "body    { background-color:#FFFFFF; color:#000000; font-size:68%; font-family:MS Shell Dlg; margin:0,0,10px,0; word-break:normal; word-wrap:break-word; }";
        htmlText = htmlText + "table   { font-size:100%; table-layout:fixed; width:100%; }";
        htmlText = htmlText + "td,th   { overflow:visible; text-align:left; vertical-align:top; white-space:normal; }";
        htmlText = htmlText + ".he1    { text-align: center; vertical-align: middle; background-color:#C0D2DE; border:1px solid #BBBBBB; color:#000000; cursor:hand; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:4em; position:relative; }";
        htmlText = htmlText + ".centerTxt { text-align: center; }";
        htmlText = htmlText + ".txtFormat1 { text-align: left; vertical-align:top; white-space:pre-line; }";
        htmlText = htmlText + "</style>";
      
        htmlText = htmlText + "<script> function toggle(e) {";
        htmlText = htmlText + "if (e.style.display === \"none\"){ e.style.display = \"\"; }";
        htmlText = htmlText + "else { e.style.display = \"none\"; }";
        htmlText = htmlText + "}</";
        htmlText = htmlText + "script";
        htmlText = htmlText + ">";
      
        htmlText = htmlText + "<body><table border=1><tr>";
        htmlText = htmlText + "<th class=\"he1\"><strong>" + eventIdLabelNodeText + "</strong></th>";
        htmlText = htmlText + "<th class=\"he1\"><strong>" + eventTimeLabelNodeText + "</strong></th>";
        htmlText = htmlText + "<th class=\"he1\"><strong>" + eventDescriptionLabelNodeText + "</strong></th>";
        htmlText = htmlText + "<th class=\"he1\"><strong>" + eventDetailsLabelNodeText + "</strong></th>";

        htmlText = htmlText + "</tr>";
        var i;
        var eventId;
        var eventTime;
        var eventDescription;
        var eventXml;
        var eventType;
        var displayEvent;
        var eventXmlId;
        var displayBgColor;

        if(eventRecordArray != null && eventRecordArray.length > 0)
        {
            for (i=0; i < eventRecordArray.length; i++)
            {
                displayEvent = false;
                var eventIdElements = eventRecordArray[i].getElementsByTagName("EventId");        
                if((eventIdElements != null) && (eventIdElements.length > 0) && (eventIdElements[0].firstChild != null))
                {
                    eventId =  eventIdElements[0].firstChild.nodeValue;
                }
                else
                {
                    eventId =  dataNotFoundWarningLabelNodeText;
                }
                var eventTimeElements = eventRecordArray[i].getElementsByTagName("EventTime");
                if((eventTimeElements != null) && (eventTimeElements.length > 0) && (eventTimeElements[0].firstChild != null))
                {
                    eventTime = eventTimeElements[0].firstChild.nodeValue;
                }
                else
                {
                    eventTime = dataNotFoundWarningLabelNodeText;
                }
                var eventDescriptionElements = eventRecordArray[i].getElementsByTagName("EventDescription");
                if((eventDescriptionElements != null) && (eventDescriptionElements.length > 0) && (eventDescriptionElements[0].firstChild != null))
                {
                        eventDescription = eventDescriptionElements[0].firstChild.nodeValue;
                }
                else
                {
                    eventDescription = dataNotFoundWarningLabelNodeText;
                }
                var eventXmlElements = eventRecordArray[i].getElementsByTagName("EventXml");
                if((eventXmlElements != null) && (eventXmlElements.length > 0) && (eventXmlElements[0].firstChild != null))
                {
                    if (window.XMLSerializer) 
                    {
                       var xml = serializer.serializeToString(eventXmlElements[0].firstChild);
                       eventXml = xml;
                    } 
                    else 
                    {
                       if (typeof eventXmlElements[0].firstChild.xml != "undefined") 
                       {
                          eventXml = eventXmlElements[0].firstChild.xml;
                       }
                    }
                }
                else
                {
                    eventXml = dataNotFoundWarningLabelNodeText;
                }
                var eventLevelElements = eventRecordArray[i].getElementsByTagName("EventLevel");
                if((eventLevelElements != null) && (eventLevelElements.length > 0) && (eventLevelElements[0].firstChild != null))
                {
                    eventType = eventLevelElements[0].firstChild.nodeValue;
                }
                else
                {
                    eventType = 5;
                }
                
                if((bVerbose === true)&&(eventType == 5))
                {
                    displayEvent = true;
                }
                else if((bInformational === true)&&(eventType == 4))
                {
                    displayEvent = true;
                }
                else if((bWarning === true)&&(eventType == 3))
                {
                    displayEvent = true;
                }
                else if((bError === true)&&((eventType == 1)||(eventType == 2)))
                {
                    displayEvent = true;
                }
                
                if (displayEvent === true)
                {
                    eventXmlId = "EventXml" + (i+"");
                    htmlText = htmlText + "<tr>";
                    htmlText = htmlText + "<td class=\"centerTxt\" style=\"background:" + displayBgColor +"\">" + eventId + "</td>";
                    htmlText = htmlText + "<td class=\"centerTxt\" style=\"background:" + displayBgColor +"\">" + eventTime + "</td>";
                    htmlText = htmlText + "<td class=\"txtFormat1\" style=\"background:" + displayBgColor +"\">" + eventDescription + "</td>";
                    htmlText = htmlText + "<td style=\"background:" + displayBgColor +"\"><span style=\"color:blue; cursor:hand\" onclick=\"toggle(" + eventXmlId +");\" onKeyPress=\"toggle(" + eventXmlId + ");\" tabIndex=1 >";
                    htmlText = htmlText + eventXmlLabelNodeText + "</span><br/>";
                    htmlText = htmlText + "<span style=\"display:none\" id=" + eventXmlId +">";
                    htmlText = htmlText + eventXml + "</span>";
                    htmlText = htmlText + "</td>";
                    htmlText = htmlText + "</tr>";
                }
            }
        }
        htmlText = htmlText + "</table></body></html>";

        if(windowsArray[strWindowId])
        {
            delete windowsArray[strWindowId];
        }
        
        // IE specific method for showing the popup.
        if(navigator.userAgent.indexOf("MSIE") > 0 && window.location.toString().indexOf("file:") === -1)
        {
            var strDiagArgs = "dialogHeight=360px;dialogWidth=630px;status=no;scroll=yes;resizable=yes;minimize=yes;maximize=yes;";

            var vModeless = window.showModelessDialog("about:blank", window, strDiagArgs);
            vModeless.document.write(htmlText);
            vModeless.document.close();
            vModeless.location.reload(false);
            windowsArray[strWindowId] = vModeless;            
        }
        else
        {
            var strDiagArgs = "height=360px, width=630px, status=no, toolbar=no, scrollbars=yes, resizable=yes";
        
            windowsArray[strWindowId] = window.open("", "", strDiagArgs);
            windowsArray[strWindowId].document.write(htmlText);
            windowsArray[strWindowId].focus();
        } 
    }

    xmlDocumentRoot = null;
}

function cleanUp() {
    var windowsArray = this.windowsArray;
    for (var currentWindow in windowsArray) {
        if (windowsArray.hasOwnProperty(currentWindow)) {
            windowsArray[currentWindow].close();
        }
    }
}

function getMessageText(messageNode) {
    if (messageNode != null) {
        if (messageNode.firstChild != null) {
            if (messageNode.firstChild.nodeType === 3) {
                for (var i = 0; i < messageNode.childNodes.length; i++) 
                {
                    var curNode = messageNode.childNodes[i];
                    if(curNode.nodeType === 1){
                        return curNode.childNodes[0].nodeValue;
                    }
                }
            } else {
                return messageNode.firstChild.childNodes[0].nodeValue;
            }
        }
    }
    return null;
}

function showComponentProcessingDetails(srcElement) {
    var strWindowId = "ProcessingDetails_" + srcElement.getAttribute("eventLogActivityId");
    if ((windowsArray[strWindowId]) && (windowsArray[strWindowId].closed === false)) {
        windowsArray[strWindowId].focus();
    } else {
        var doc;
        var parser;
        var xmlDocumentRoot;
        var xmlDocument;

        var extensionsProcessedLabelNode, slowLinkThresholdLabelNode, linkSpeedLabelNode, extensionsProcessedTimeTakenNode;
        var domainControllerIpLabelNode, domainControllerNameLabelNode, processingTypeLabelNode, loopbackModeLabelNode;
        var processingTriggerLabelNode, extensionNameLabelNode, timeTakenLabelNode;
        var dataNotFoundWarningLabelNode;
        var singlePassEventsDetailsNode, totalProcessingTimeLabelNode, refreshMessageLabelNode;
        var processingDetailsUserTitleNode, processingDetailsComputerTitleNode;
        var policySectionNode;
        var policyEventsDetailsNode, detailsLabelNode;

        var extensionsProcessedLabelNodeText, slowLinkThresholdLabelNodeText, linkSpeedLabelNodeText, extensionsProcessedTimeTakenNodeText;
        var domainControllerIpLabelNodeText, domainControllerNameLabelNodeText, processingTypeLabelNodeText, loopbackModeLabelNodeText;
        var processingTriggerLabelNodeText, extensionNameLabelNodeText, timeTakenLabelNodeText;
        var dataNotFoundWarningLabelNodeText, totalProcessingTimeLabelNodeText, refreshMessageLabelNodeText;
        var processingDetailsUserTitleNodeText, processingDetailsComputerTitleNodeText;
        var detailsLabelNodeText;

        var slowLinkThresholdValue, linkSpeedValue, domainControllerIpValue, domainControllerNameValue;
        var processingTypeValue, loopbackModeValue, processingTriggerValue, totalPolicyProcessingTime, extensionProcessingTimeArray;
        var cseNameArray = new Array();
        var cseElapsedTimeArray = new Array();
        var policyApplicationFinishedTime;

        var isComputerProcessing;
        var strDiagArgs;
        var mainSection;
        var attributeValue;
        var singlePassEventsDetails;
        var singlePassEventsDetailsChildren;
        var node;
        var children;
        var itemSub;

        if (window.DOMParser) 
        {
           // This browser appears to support DOMParser
           parser = new DOMParser();
           doc = document.getElementById("data-island").textContent;

           xmlDocumentRoot = parser.parseFromString(doc, "application/xml");

           xmlDocument = xmlDocumentRoot.documentElement;

           itemSub = 1;
        } 
        else 
        { 
           // Internet Explorer, create a new XML document using ActiveX 
           // and use loadXML as a DOM parser. 
           try 
           {
              doc = document.getElementById("data-island");

              xmlDocumentRoot = new ActiveXObject("Msxml2.DOMDocument.6.0"); 
              xmlDocumentRoot.async = false; 
              xmlDocumentRoot.loadXML(doc.innerHTML);
              xmlDocument = xmlDocumentRoot.documentElement;
              itemSub = 0;
           } 
           catch(e) 
           {
              // Not supported.
           }
        }

        if (xmlDocument != null) {
            mainSection = xmlDocument.getElementsByTagName("MainSection")[0].childNodes;

            if (mainSection != null) {
                for (children = 0; children < mainSection.length; children++) {
                    node = mainSection[children];
                    if (node.nodeType === 1 && node.nodeName === 'Label') {
                        attributeValue = node.getAttribute("Name")
                        if (attributeValue != null) {
                            if (attributeValue === 'ComponentStatus_ExtensionsProcessed') {
                                extensionsProcessedLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_SlowLinkThreshold') {
                                slowLinkThresholdLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_LinkSpeed') {
                                linkSpeedLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_TimeTaken') {
                                extensionsProcessedTimeTakenNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_DomainControllerIP') {
                                domainControllerIpLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_DomainControllerName') {
                                domainControllerNameLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_ProcessingTrigger') {
                                processingTriggerLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_ExtensionName') {
                                extensionNameLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_TimeTaken') {
                                timeTakenLabelNode = node;
                            }
                            if (attributeValue === 'Warning_DataNotFound') {
                                dataNotFoundWarningLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_TotalProcessingTime') {
                                totalProcessingTimeLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_RefreshMessage') {
                                refreshMessageLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_UserProcessingDetails') {
                                processingDetailsUserTitleNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_ComputerProcessingDetails') {
                                detailsLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_ProcessingType') {
                                processingTypeLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_LoopbackMode') {
                                loopbackModeLabelNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_UserProcessingDetails') {
                                processingDetailsUserTitleNode = node;
                            }
                            if (attributeValue === 'ComponentStatus_ComputerProcessingDetails') {
                                processingDetailsComputerTitleNode = node;
                            }
                        }
                    }
                }
            }

            singlePassEventsDetails = xmlDocument.getElementsByTagName("SinglePassEventsDetails");
            if (singlePassEventsDetails != null) {
                for (singlePassEventsDetailsChildren = 0; singlePassEventsDetailsChildren < singlePassEventsDetails.length; singlePassEventsDetailsChildren++) {
                    node = singlePassEventsDetails[singlePassEventsDetailsChildren];
                    if (node.getAttribute("ActivityId") === srcElement.getAttribute("eventLogActivityId")) {
                        singlePassEventsDetailsNode = node;
                    }
                }
            }

            if (singlePassEventsDetailsNode) {
                policyEventsDetailsNode = singlePassEventsDetailsNode.parentNode;
                if (policyEventsDetailsNode) {
                    policySectionNode = policyEventsDetailsNode.parentNode;
                    if (policySectionNode) {
                        if (policySectionNode.nodeName === 'UserPolicySection') {
                            isComputerProcessing = false;
                        }
                        if (policySectionNode.nodeName === 'ComputerPolicySection') {
                            isComputerProcessing = true;
                        }
                    }
                }
            }
        }

        
        extensionsProcessedLabelNodeText = getMessageText(extensionsProcessedLabelNode);
        slowLinkThresholdLabelNodeText = getMessageText(slowLinkThresholdLabelNode);
        linkSpeedLabelNodeText = getMessageText(linkSpeedLabelNode);
        domainControllerIpLabelNodeText = getMessageText(domainControllerIpLabelNode);
        domainControllerNameLabelNodeText = getMessageText(domainControllerNameLabelNode);
        processingTypeLabelNodeText = getMessageText(processingTypeLabelNode);
        loopbackModeLabelNodeText = getMessageText(loopbackModeLabelNode);
        processingTriggerLabelNodeText = getMessageText(processingTriggerLabelNode);
        extensionNameLabelNodeText = getMessageText(extensionNameLabelNode);
        timeTakenLabelNodeText = getMessageText(timeTakenLabelNode);
        processingDetailsUserTitleNodeText = getMessageText(processingDetailsUserTitleNode);
        processingDetailsComputerTitleNodeText = getMessageText(processingDetailsComputerTitleNode);
        dataNotFoundWarningLabelNodeText = getMessageText(dataNotFoundWarningLabelNode);
        totalProcessingTimeLabelNodeText = getMessageText(totalProcessingTimeLabelNode);
        refreshMessageLabelNodeText = getMessageText(refreshMessageLabelNode);
        detailsLabelNodeText = getMessageText(detailsLabelNode);
     

        slowLinkThresholdValue = null;
        linkSpeedValue = null;
        domainControllerIpValue = null;
        domainControllerNameValue = null;
        processingTypeValue = null;
        loopbackModeValue = null;
        processingTriggerValue = null;

        if (singlePassEventsDetailsNode != null) {
            slowLinkThresholdValue = singlePassEventsDetailsNode.getAttribute("SlowLinkThresholdInKbps");
            linkSpeedValue = singlePassEventsDetailsNode.getAttribute("LinkSpeedInKbps");
            domainControllerIpValue = singlePassEventsDetailsNode.getAttribute("DomainControllerIPAddress");
            domainControllerNameValue = singlePassEventsDetailsNode.getAttribute("DomainControllerName");
            processingTypeValue = singlePassEventsDetailsNode.getAttribute("ProcessingAppMode");
            loopbackModeValue = singlePassEventsDetailsNode.getAttribute("PolicyProcessingMode");
            processingTriggerValue = singlePassEventsDetailsNode.getAttribute("ProcessingTrigger");
            totalPolicyProcessingTime = singlePassEventsDetailsNode.getAttribute("PolicyElapsedTime");
            extensionProcessingTimeArray = singlePassEventsDetailsNode.getElementsByTagName("ExtensionProcessingTime");
        }
        if (slowLinkThresholdValue == null) {
            slowLinkThresholdValue = dataNotFoundWarningLabelNodeText;
        }
        if (linkSpeedValue == null) {
            linkSpeedValue = dataNotFoundWarningLabelNodeText;
        }
        if (domainControllerIpValue == null) {
            domainControllerIpValue = dataNotFoundWarningLabelNodeText;
        }
        else {
            domainControllerIpValue = domainControllerIpValue.replace(/^\\\\/, "");
        }
        if (domainControllerNameValue == null) {
            domainControllerNameValue = dataNotFoundWarningLabelNodeText;
        }
        else {
            domainControllerNameValue = domainControllerNameValue.replace(/^\\\\/, "");
        }
        if (processingTypeValue == null) {
            processingTypeValue = dataNotFoundWarningLabelNodeText;
        }
        if (loopbackModeValue == null) {
            loopbackModeValue = dataNotFoundWarningLabelNodeText;
        }
        if (processingTriggerValue == null) {
            processingTriggerValue = dataNotFoundWarningLabelNodeText;
        }

        if (extensionProcessingTimeArray != null && extensionProcessingTimeArray.length > 0) {
            var cseName;
            var cseElapsedTime;
            var cseProcessedTime;
            var cseId;
            var i;
            var index = 0;
            for (i = 0; i < extensionProcessingTimeArray.length; i++) {
                var cseNameElements = extensionProcessingTimeArray[i].getElementsByTagName("ExtensionName");
                var cseElapsedTimeElements = extensionProcessingTimeArray[i].getElementsByTagName("ElapsedTime");
                var cseProcessedTimeElements = extensionProcessingTimeArray[i].getElementsByTagName("ProcessedTime");
                var cseIdElements = extensionProcessingTimeArray[i].getElementsByTagName("ExtensionGuid");
                if ((cseNameElements.length > 0) && (cseElapsedTimeElements.length > 0) && (cseProcessedTimeElements.length > 0) && (cseIdElements.length > 0)) {
                    if ((cseNameElements[0].firstChild != null) && (cseElapsedTimeElements[0].firstChild != null) && (cseProcessedTimeElements[0].firstChild != null) && (cseIdElements[0].firstChild != null)) {
                        cseName = cseNameElements[0].firstChild.nodeValue;
                        cseElapsedTime = cseElapsedTimeElements[0].firstChild.nodeValue;
                        cseProcessedTime = cseProcessedTimeElements[0].firstChild.nodeValue;
                        cseId = cseIdElements[0].firstChild.nodeValue;
                        if ((cseName != null) && (cseElapsedTime != null) && (cseProcessedTime != null) && (cseId != null)) {
                            cseNameArray[index] = cseName;
                            cseElapsedTimeArray[index] = cseElapsedTime;
                            index = index + 1;
                            if (cseId === '{00000000-0000-0000-0000-000000000000}') {
                                policyApplicationFinishedTime = cseProcessedTime;
                            }
                        }
                    }
                }
            }
        }
          
        var htmlText = "<html dir=" + document.dir +  ">";
        htmlText = htmlText + "<head>";
        htmlText = htmlText + "<meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\" />";
        htmlText = htmlText + "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-16\" />";
        if(isComputerProcessing != null)
        {
            if(isComputerProcessing === true)
            {
                htmlText = htmlText + "<title>" + processingDetailsComputerTitleNodeText + "</title>";
            }
            else
            {
                htmlText = htmlText + "<title>" + processingDetailsUserTitleNodeText + "</title>";
            }
        }
        

        htmlText = htmlText + "</head><style type=\"text/css\">";
        htmlText = htmlText + "body    { background-color:#FFFFFF; color:#000000; font-size:68%; font-family:MS Shell Dlg; margin:0,0,10px,0; word-break:normal; word-wrap:break-word; }";
        htmlText = htmlText + "table   { font-size:100%; table-layout:fixed; width:100%; }";
        htmlText = htmlText + "td,th   { overflow:visible; text-align:left; vertical-align:top; white-space:normal; }";
        htmlText = htmlText + ".he0    { background-color:#FEF7D6; border:1px solid #BBBBBB; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2.25em; margin-bottom:-1px; margin-left:0px; margin-right:0px; padding-left:8px; padding-right:5em; padding-top:4px; position:relative; width:100%; }";
        htmlText = htmlText + ".he1    { color:#000000; display:block; font-family:MS Shell Dlg; font-size:100%; font-weight:bold; height:2em;margin-left: 5 px; margin-top: 5 px; position:relative; width:100%; }";
        htmlText = htmlText + ".tblspecialfmt { border:1px solid black;border-collapse:collapse; }";
        htmlText = htmlText + ".tblfirstcolfmt { border-left-width: 1px;border-top-width: 1px;border-bottom-width: 1px;border-right-width: 0px;border-style: solid; border-color: black; }";
        htmlText = htmlText + ".tblsecondcolfmt { border-left-width: 0px;border-top-width: 1px;border-bottom-width: 1px;border-right-width: 1px;border-style: solid; border-color: black; }";
        htmlText = htmlText + "</style>";
        htmlText = htmlText + "<body>";
        htmlText = htmlText + "<span class=\"he1\">" + refreshMessageLabelNodeText + " " + policyApplicationFinishedTime + "</span>" ;
        htmlText = htmlText + "<div class=\"he0\">" + detailsLabelNodeText + "</div>"
        htmltext = htmlText + "<table><tr>";

        htmlText = htmlText + "<td>";
        htmlText = htmlText + "<table>";
        htmlText = htmlText + "<tr><td colspan=\"2\">&nbsp;</td></tr>";


        htmlText = htmlText + "<tr><td style=\"width: 50%\"><strong>" + processingTypeLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td>" + processingTypeValue + "</td></tr>";

        htmlText = htmlText + "<tr><td style=\"width: 50%\"><strong>" + loopbackModeLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td>" + loopbackModeValue + "</td></tr>";

        htmlText = htmlText + "<tr><td style=\"width: 50%\"><strong>" + linkSpeedLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td>" + linkSpeedValue + "</td></tr>";

        htmlText = htmlText + "<tr><td style=\"width: 50%\"><strong>" + slowLinkThresholdLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td>" + slowLinkThresholdValue + "</td></tr>";

        htmlText = htmlText + "<tr><td style=\"width: 50%\"><strong>" + domainControllerNameLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td>" + domainControllerNameValue +"</td></tr>";

        htmlText = htmlText + "<tr><td style=\"width: 50%\"><strong>" + domainControllerIpLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td>" + domainControllerIpValue +"</td></tr>";

        htmlText = htmlText + "<tr><td style=\"width: 50%\"><strong>" + processingTriggerLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td>" + processingTriggerValue + "</td></tr>";

        htmlText = htmlText + "</table></td></tr>";
        htmlText = htmlText + "<tr ><td ><table>";


        htmlText = htmlText + "<tr><td><span class=\"he1\" >" + extensionsProcessedLabelNodeText +"</span></td></tr>";
        htmlText = htmlText + "<tr><td><table class=\"tblspecialfmt\" >";
        htmlText = htmlText + "<tr><td class=\"tblfirstcolfmt\" style=\"width: 50%;background-color:#FEF7D6;\"><strong>" + extensionNameLabelNodeText + "</strong></td>";
        htmlText = htmlText + "<td class=\"tblsecondcolfmt\" style=\"background-color:#FEF7D6;\" ><strong>" + timeTakenLabelNodeText + "</strong></td></tr>";

        for (var idx in cseNameArray)
        {
            htmlText = htmlText + "<tr><td style=\"width: 50%\">" + cseNameArray[idx] + "</td>";                   
            htmlText = htmlText + "<td>" + cseElapsedTimeArray[idx] + "</td></tr>";
        }

        if (totalPolicyProcessingTime != null)
        {
            htmlText = htmlText + "<tr><td class=\"tblfirstcolfmt\" style=\"width: 50%\" >" + totalProcessingTimeLabelNodeText +":</td>";
            htmlText = htmlText + "<td class=\"tblsecondcolfmt\">" + totalPolicyProcessingTime + "</td></tr>";
        }
        htmlText = htmlText + "</table></td></tr></table></td></tr></table></body></html>";

        if(windowsArray[strWindowId])
        {
            delete windowsArray[strWindowId];
        }
         
        // IE specific method for showing the popup.
        if(navigator.userAgent.indexOf("MSIE") > 0 && window.location.toString().indexOf("file:") === -1)
        {
            strDiagArgs = "dialogHeight=360px;dialogWidth=630px;status=no;scroll=yes;resizable=yes;minimize=yes;maximize=yes;";

            var vModeless = window.showModelessDialog("about:blank", window, strDiagArgs);
            vModeless.document.write(htmlText);
            vModeless.document.close();
            vModeless.location.reload(false);
            windowsArray[strWindowId] = vModeless;                      
        }
        else
        {
            strDiagArgs = "height=360px, width=630px, status=no, toolbar=no, scrollbars=yes, resizable=yes";
        
            windowsArray[strWindowId] = window.open("", "" , strDiagArgs);
            windowsArray[strWindowId].document.write(htmlText);
            windowsArray[strWindowId].focus();
        }
    }

    xmlDocumentRoot = null;
}
-->
</script>
</head>

<body onload="window_onload();" onclick="document_onclick();" onkeypress="document_onkeypress(event);" onunload="cleanUp();">

<!-- HTML resources -->
<div style="display:none;">
        <div id="explainText_windowTitle">Group Policy Management</div>
        <div id="explainText_windowStyles">
        
                            body  { font-size:68%;font-family:MS Shell Dlg; margin:0px,0px,0px,0px; border: 1px solid #666666; background:#F6F6F6; width:100%; word-break:normal; word-wrap:break-word; }

                            .head { font-weight:bold; font-size:160%; font-family:MS Shell Dlg; width:100%; color:#6587DC; background:#E3EAF9; border:1px solid #5582D2; padding-left:8px; height:24px; }

                            .path { margin-left: 10px; margin-top: 10px; margin-bottom:5px;width:100%; }

                            .info { padding-left:10px;width:100%; }

                            table { font-size:100%; width:100%; border:1px solid #999999; }

                            th    { border-bottom:1px solid #999999; text-align:left; padding-left:10px; height:24px; }

                            td    { background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; }

                            .btn  { width:100%; text-align:right; margin-top:16px; }

                            .hdr  { font-weight:bold; border:1px solid #999999; text-align:left; padding-top: 4px; padding-left:10px; height:24px; margin-bottom:-1px; width:100%; }

                            .bdy  { width:100%; height:182px; display:block; overflow:scroll; z-index:2; background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; border:1px solid #999999; }

                            button { width:6.9em; height:2.1em; font-size:100%; font-family:MS Shell Dlg; margin-right:15px; }

                            @media print {

                                .bdy { display:block; overflow:visible; }

                                button { display:none; }

                                .head { color:#000000; background:#FFFFFF; border:1px solid #000000; }

                            }

                
        </div>
        <div id="explainText_settingPathLabel">Setting Path:</div>
        <div id="explainText_explainTextLabel">Explanation</div>
        <div id="explainText_printButton">
        <button name="Print" onClick="window.print()" accesskey="P"><u>P</u>rint</button>

        </div>
        <div id="explainText_closeButton">
        <button name="Close" onClick="window.close()" accesskey="C"><u>C</u>lose</button>
                
        </div>
        <div id="explainText_noExplainTextAvailable">No explanation is available for this setting.</div>
        <div id="explainText_supportedLabel">Supported On:</div>
        <div id="explainText_noSupportedTextAvailable">Not available</div>
</div><table class="title">
<tr><td colspan="2" class="gponame">C - MSFT Windows 11 24H2</td></tr>
<tr>
    <td id="dtstamp">Data collected on: 2/26/2025 10:04:56 PM</td>
    <td><div id="objshowhide" tabindex="0" onclick="objshowhide_onClick();return false;"></div></td>
</tr>
</table>

<div class="gposummary">
<div class="he0_expanded"><span class="sectionTitle" tabindex="0">General</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he1"><span class="sectionTitle" tabindex="0">Details</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info">
<tr><td scope="row">Domain</td><td>go.euc</td></tr>
<tr><td scope="row">Owner</td><td>GO\Domain Admins</td></tr>
<tr><td scope="row">Created</td><td>2/19/2025 4:54:52 PM</td></tr>
<tr><td scope="row">Modified</td><td>2/19/2025 4:55:56 PM</td></tr>
<tr><td scope="row">User Revisions</td><td>1 (AD), 1 (SYSVOL)</td></tr>
<tr><td scope="row">Computer Revisions</td><td>1 (AD), 1 (SYSVOL)</td></tr>
<tr><td scope="row">Unique ID</td><td>{C16E41E5-3986-4E50-990F-E73A24AB7053}</td></tr>
<tr><td scope="row">GPO Status</td><td>User settings disabled</td></tr>
</table></div></div>
<div class="filler"></div>
<div class="he1"><span class="sectionTitle" tabindex="0">Links</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3"><tr><th scope="col">Location</th><th scope="col">Enforced</th><th scope="col">Link Status</th><th scope="col">Path</th></tr>
    <tr><td colspan="4">None</td></tr>
    </table>
    <br />This list only includes links in the domain of the GPO.</div></div>
<div class="filler"></div>
<div class="he1"><span class="sectionTitle" tabindex="0">Security Filtering</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><b>The settings in this GPO can only apply to the following groups, users, and computers:</b></div>
<div class="he4i">
<table class="info"><tr><th scope="col">Name</th></tr><tr><td>NT AUTHORITY\Authenticated Users</td></tr></table>
</div>
</div>
<div class="filler"></div>

<div class="filler"></div>
<div class="he1"><span class="sectionTitle" tabindex="0">Delegation</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><b>These groups and users have the specified permission for this GPO</b></div>
<div class="he4i">
<table class="info3">
<tr><th scope="col">Name</th><th scope="col">Allowed Permissions</th><th scope="col">Inherited</th></tr>
<tr><td>GO\Domain Admins</td><td>Edit settings, delete, modify security</td><td>No</td></tr>
<tr><td>GO\Enterprise Admins</td><td>Edit settings, delete, modify security</td><td>No</td></tr>
<tr><td>NT AUTHORITY\Authenticated Users</td><td>Read (from Security Filtering)</td><td>No</td></tr>
<tr><td>NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</td><td>Read</td><td>No</td></tr>
<tr><td>NT AUTHORITY\SYSTEM</td><td>Edit settings, delete, modify security</td><td>No</td></tr>
</table>

</div></div></div>
<div class="filler"></div>
</div>
<div class="he0_expanded"><span class="sectionTitle" tabindex="0">Computer Configuration (Enabled)</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he1h_expanded"><span class="sectionTitle" tabindex="0">Policies</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he1_expanded"><span class="sectionTitle" tabindex="0">Windows Settings</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he2"><span class="sectionTitle" tabindex="0">Security Settings</span><a class="expando" href="#"></a></div>
        <div class="container"><div class="he3"><span class="sectionTitle" tabindex="0">Local Policies/User Rights Assignment</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Access Credential Manager as a trusted caller</td><td></td></tr>
<tr><td>Access this computer from the network</td><td>BUILTIN\Remote Desktop Users, BUILTIN\Administrators</td></tr>
<tr><td>Act as part of the operating system</td><td></td></tr>
<tr><td>Allow log on locally</td><td>BUILTIN\Users, BUILTIN\Administrators</td></tr>
<tr><td>Back up files and directories</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Create a pagefile</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Create a token object</td><td></td></tr>
<tr><td>Create global objects</td><td>NT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\LOCAL SERVICE, NT AUTHORITY\SERVICE, BUILTIN\Administrators</td></tr>
<tr><td>Create permanent shared objects</td><td></td></tr>
<tr><td>Debug programs</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Deny access to this computer from the network</td><td>NT AUTHORITY\Local account</td></tr>
<tr><td>Deny log on through Terminal Services</td><td>NT AUTHORITY\Local account</td></tr>
<tr><td>Enable computer and user accounts to be trusted for delegation</td><td></td></tr>
<tr><td>Force shutdown from a remote system</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Impersonate a client after authentication</td><td>NT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\LOCAL SERVICE, NT AUTHORITY\SERVICE, BUILTIN\Administrators</td></tr>
<tr><td>Load and unload device drivers</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Lock pages in memory</td><td></td></tr>
<tr><td>Manage auditing and security log</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Modify firmware environment values</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Perform volume maintenance tasks</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Profile single process</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Restore files and directories</td><td>BUILTIN\Administrators</td></tr>
<tr><td>Take ownership of files or other objects</td><td>BUILTIN\Administrators</td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Local Policies/Security Options</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4h"><span class="sectionTitle" tabindex="0">Accounts</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Accounts: Limit local account use of blank passwords to console logon only</td><td>Enabled</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">Domain Member</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Domain member: Disable machine account password changes</td><td>Disabled</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">Interactive Logon</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Interactive logon: Smart card removal behavior</td><td>Lock Workstation</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">Microsoft Network Client</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Microsoft network client: Digitally sign communications (always)</td><td>Enabled</td></tr>
<tr><td>Microsoft network client: Send unencrypted password to third-party SMB servers</td><td>Disabled</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">Network Access</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Network access: Allow anonymous SID/Name translation</td><td>Disabled</td></tr>
<tr><td>Network access: Do not allow anonymous enumeration of SAM accounts</td><td>Enabled</td></tr>
<tr><td>Network access: Do not allow anonymous enumeration of SAM accounts and shares</td><td>Enabled</td></tr>
<tr><td>Network access: Restrict anonymous access to Named Pipes and Shares</td><td>Enabled</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">Network Security</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Network security: Do not store LAN Manager hash value on next password change</td><td>Enabled</td></tr>
<tr><td>Network security: LAN Manager authentication level</td><td>Send NTLMv2 response only. Refuse LM &amp; NTLM</td></tr>
<tr><td>Network security: LDAP client signing requirements</td><td>Negotiate signing</td></tr>
<tr><td>Network security: Minimum session security for NTLM SSP based (including secure RPC) clients</td><td>Enabled</td></tr>
<tr><td colspan="2"><table class="subtable"><tr><td>Require NTLMv2 session security</td><td>Enabled</td></tr>
<tr><td>Require 128-bit encryption</td><td>Enabled</td></tr>
</table></td></tr><tr><td>Network security: Minimum session security for NTLM SSP based (including secure RPC) servers</td><td>Enabled</td></tr>
<tr><td colspan="2"><table class="subtable"><tr><td>Require NTLMv2 session security</td><td>Enabled</td></tr>
<tr><td>Require 128-bit encryption</td><td>Enabled</td></tr>
</table></td></tr></table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">System Objects</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)</td><td>Enabled</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">User Account Control</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>User Account Control: Admin Approval Mode for the Built-in Administrator account</td><td>Enabled</td></tr>
<tr><td>User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode</td><td>Prompt for consent on the secure desktop</td></tr>
<tr><td>User Account Control: Behavior of the elevation prompt for standard users</td><td>Automatically deny elevation requests</td></tr>
<tr><td>User Account Control: Detect application installations and prompt for elevation</td><td>Enabled</td></tr>
<tr><td>User Account Control: Only elevate UIAccess applications that are installed in secure locations</td><td>Enabled</td></tr>
<tr><td>User Account Control: Run all administrators in Admin Approval Mode</td><td>Enabled</td></tr>
<tr><td>User Account Control: Virtualize file and registry write failures to per-user locations</td><td>Enabled</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">Other</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings</td><td>Enabled</td></tr>
<tr><td>Domain member: Digitally encrypt or sign secure channel data (always)</td><td>Enabled</td></tr>
<tr><td>Domain member: Digitally encrypt secure channel data (when possible)</td><td>Enabled</td></tr>
<tr><td>Domain member: Digitally sign secure channel data (when possible)</td><td>Enabled</td></tr>
<tr><td>Domain member: Require strong (Windows 2000 or later) session key</td><td>Enabled</td></tr>
<tr><td>Interactive logon: Machine inactivity limit</td><td>900 seconds</td></tr>
<tr><td>Microsoft network server: Digitally sign communications (always)</td><td>Enabled</td></tr>
<tr><td>Network access: Restrict clients allowed to make remote calls to SAM</td><td>&quot;O:BAG:BAD:(A;;RC;;;BA)&quot;</td></tr>
<tr><td>Network security: Allow LocalSystem NULL session fallback</td><td>Disabled</td></tr>
</table>
</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">Registry Values</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorEnhancedAdmin</td><td>1</td></tr>
<tr><td>MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\TypeOfAdminApprovalMode</td><td>2</td></tr>
</table>
</div></div></div><div class="he3"><span class="sectionTitle" tabindex="0">System Services</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4h"><span class="sectionTitle" tabindex="0">XblAuthManager (Startup Mode: Disabled)</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><b>Permissions</b><br />No permissions specified</div><div class="he4i"><b>Auditing</b><br />No auditing specified</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">XblGameSave (Startup Mode: Disabled)</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><b>Permissions</b><br />No permissions specified</div><div class="he4i"><b>Auditing</b><br />No auditing specified</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">XboxGipSvc (Startup Mode: Disabled)</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><b>Permissions</b><br />No permissions specified</div><div class="he4i"><b>Auditing</b><br />No auditing specified</div></div><div class="he4h"><span class="sectionTitle" tabindex="0">XboxNetApiSvc (Startup Mode: Disabled)</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><b>Permissions</b><br />No permissions specified</div><div class="he4i"><b>Auditing</b><br />No auditing specified</div></div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Firewall with Advanced Security</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4"><span class="sectionTitle" tabindex="0">Global Settings</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Policy version</td><td>2.26</td></tr>
<tr><td>Disable stateful FTP</td><td>Not Configured</td></tr>
<tr><td>Disable stateful PPTP</td><td>Not Configured</td></tr>
<tr><td>IPsec exempt</td><td>Not Configured</td></tr>
<tr><td>IPsec through NAT</td><td>Not Configured</td></tr>
<tr><td>Preshared key encoding</td><td>Not Configured</td></tr>
<tr><td>SA idle time</td><td>Not Configured</td></tr>
<tr><td>Strong CRL check</td><td>Not Configured</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Domain Profile Settings</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Firewall state</td><td>On</td></tr>
<tr><td>Inbound connections</td><td>Block</td></tr>
<tr><td>Outbound connections</td><td>Allow</td></tr>
<tr><td>Apply local firewall rules</td><td>Not Configured</td></tr>
<tr><td>Apply local connection security rules</td><td>Not Configured</td></tr>
<tr><td>Display notifications</td><td>No</td></tr>
<tr><td>Allow unicast responses</td><td>Not Configured</td></tr>
<tr><td>Log dropped packets</td><td>Yes</td></tr>
<tr><td>Log successful connections</td><td>Yes</td></tr>
<tr><td>Log file path</td><td>Not Configured</td></tr>
<tr><td>Log file maximum size (KB)</td><td>16384</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Private Profile Settings</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Firewall state</td><td>On</td></tr>
<tr><td>Inbound connections</td><td>Block</td></tr>
<tr><td>Outbound connections</td><td>Allow</td></tr>
<tr><td>Apply local firewall rules</td><td>Not Configured</td></tr>
<tr><td>Apply local connection security rules</td><td>Not Configured</td></tr>
<tr><td>Display notifications</td><td>No</td></tr>
<tr><td>Allow unicast responses</td><td>Not Configured</td></tr>
<tr><td>Log dropped packets</td><td>Yes</td></tr>
<tr><td>Log successful connections</td><td>Yes</td></tr>
<tr><td>Log file path</td><td>Not Configured</td></tr>
<tr><td>Log file maximum size (KB)</td><td>16384</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Public Profile Settings</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Firewall state</td><td>On</td></tr>
<tr><td>Inbound connections</td><td>Block</td></tr>
<tr><td>Outbound connections</td><td>Allow</td></tr>
<tr><td>Apply local firewall rules</td><td>No</td></tr>
<tr><td>Apply local connection security rules</td><td>No</td></tr>
<tr><td>Display notifications</td><td>No</td></tr>
<tr><td>Allow unicast responses</td><td>Not Configured</td></tr>
<tr><td>Log dropped packets</td><td>Yes</td></tr>
<tr><td>Log successful connections</td><td>Yes</td></tr>
<tr><td>Log file path</td><td>Not Configured</td></tr>
<tr><td>Log file maximum size (KB)</td><td>16384</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Connection Security Settings</span><a class="expando" href="#"></a></div>
    <div class="container">
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Advanced Audit Configuration</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4"><span class="sectionTitle" tabindex="0">Account Logon</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit Credential Validation</td><td>Success, Failure</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Account Management</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit Security Group Management</td><td>Success</td></tr>
<tr><td>Audit User Account Management</td><td>Success, Failure</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Detailed Tracking</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit PNP Activity</td><td>Success</td></tr>
<tr><td>Audit Process Creation</td><td>Success</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Logon/Logoff</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit Account Lockout</td><td>Failure</td></tr>
<tr><td>Audit Group Membership</td><td>Success</td></tr>
<tr><td>Audit Logon</td><td>Success, Failure</td></tr>
<tr><td>Audit Other Logon/Logoff Events</td><td>Success, Failure</td></tr>
<tr><td>Audit Special Logon</td><td>Success</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Object Access</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit Detailed File Share</td><td>Failure</td></tr>
<tr><td>Audit File Share</td><td>Success, Failure</td></tr>
<tr><td>Audit Other Object Access Events</td><td>Success, Failure</td></tr>
<tr><td>Audit Removable Storage</td><td>Success, Failure</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Policy Change</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit Audit Policy Change</td><td>Success</td></tr>
<tr><td>Audit Authentication Policy Change</td><td>Success</td></tr>
<tr><td>Audit MPSSVC Rule-Level Policy Change</td><td>Success, Failure</td></tr>
<tr><td>Audit Other Policy Change Events</td><td>Failure</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">Privilege Use</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit Sensitive Privilege Use</td><td>Success</td></tr>
</table>
</div></div><div class="he4"><span class="sectionTitle" tabindex="0">System</span><a class="expando" href="#"></a></div>
    <div class="container">
<div class="he4i"><table class="info">
<tr><th scope="col">Policy</th><th scope="col">Setting</th></tr>
<tr><td>Audit Other System Events</td><td>Success, Failure</td></tr>
<tr><td>Audit Security State Change</td><td>Success</td></tr>
<tr><td>Audit Security System Extension</td><td>Success</td></tr>
<tr><td>Audit System Integrity</td><td>Success, Failure</td></tr>
</table>
</div></div></div></div></div><div class="filler"></div>
<div class="he1"><span class="sectionTitle" tabindex="0">Administrative Templates</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i">Policy definitions (ADMX files) retrieved from the central store.</div><div class="he3"><span class="sectionTitle" tabindex="0">Control Panel/Personalization</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Prevent enabling lock screen camera" gpmc_settingPath="Computer Configuration/Administrative Templates/Control Panel/Personalization" gpmc_settingDescription="Disables the lock screen camera toggle switch in PC Settings and prevents a camera from being invoked on the lock screen.&lt;br/&gt;&lt;br/&gt;By default, users can enable invocation of an available camera on the lock screen.&lt;br/&gt;&lt;br/&gt;If you enable this setting, users will no longer be able to enable or disable lock screen camera access in PC Settings, and the camera cannot be invoked on the lock screen." gpmc_supported="At least Windows Server 2012 R2, Windows 8.1 or Windows RT 8.1">Prevent enabling lock screen camera</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Prevent enabling lock screen slide show" gpmc_settingPath="Computer Configuration/Administrative Templates/Control Panel/Personalization" gpmc_settingDescription="Disables the lock screen slide show settings in PC Settings and prevents a slide show from playing on the lock screen.&lt;br/&gt;&lt;br/&gt;By default, users can enable a slide show that will run after they lock the machine.&lt;br/&gt;&lt;br/&gt;If you enable this setting, users will no longer be able to modify slide show settings in PC Settings, and no slide show will ever start." gpmc_supported="At least Windows Server 2012 R2, Windows 8.1 or Windows RT 8.1">Prevent enabling lock screen slide show</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Network/DNS Client</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn off multicast name resolution" gpmc_settingPath="Computer Configuration/Administrative Templates/Network/DNS Client" gpmc_settingDescription="Specifies that link local multicast name resolution (LLMNR) is disabled on client computers.&lt;br/&gt;&lt;br/&gt;LLMNR is a secondary name resolution protocol. With LLMNR, queries are sent using multicast over a local network link on a single subnet from a client computer to another client computer on the same subnet that also has LLMNR enabled. LLMNR does not require a DNS server or DNS client configuration, and provides name resolution in scenarios in which conventional DNS name resolution is not possible.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, LLMNR will be disabled on all available network adapters on the client computer.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, or you do not configure this policy setting, LLMNR will be enabled on all available network adapters." gpmc_supported="At least Windows Vista">Turn off multicast name resolution</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Network/Lanman Workstation</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Enable insecure guest logons" gpmc_settingPath="Computer Configuration/Administrative Templates/Network/Lanman Workstation" gpmc_settingDescription="This policy setting determines if the SMB client will allow insecure guest logons to an SMB server.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting or if you do not configure this policy setting, the SMB client will allow insecure guest logons.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, the SMB client will reject insecure guest logons.&lt;br/&gt;&lt;br/&gt;Insecure guest logons are used by file servers to allow unauthenticated access to shared folders. While uncommon in an enterprise environment, insecure guest logons are frequently used by consumer Network Attached Storage (NAS) appliances acting as file servers. Windows file servers require authentication and do not use insecure guest logons by default. Since insecure guest logons are unauthenticated, important security features such as SMB Signing and SMB Encryption are disabled. As a result, clients that allow insecure guest logons are vulnerable to a variety of man-in-the-middle attacks that can result in data loss, data corruption, and exposure to malware. Additionally, any data written to a file server using an insecure guest logon is potentially accessible to anyone on the network. Microsoft recommends disabling insecure guest logons and configuring file servers to require authenticated access.&amp;quot;&lt;br/&gt;      " gpmc_supported="At least Windows Server 2016, Windows 10">Enable insecure guest logons</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Network/Network Connections</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Prohibit use of Internet Connection Sharing on your DNS domain network" gpmc_settingPath="Computer Configuration/Administrative Templates/Network/Network Connections" gpmc_settingDescription="Determines whether administrators can enable and configure the Internet Connection Sharing (ICS) feature of an Internet connection and if the ICS service can run on the computer.&lt;br/&gt;&lt;br/&gt;ICS lets administrators configure their system as an Internet gateway for a small network and provides network services, such as name resolution and addressing through DHCP, to the local private network.&lt;br/&gt;&lt;br/&gt;If you enable this setting, ICS cannot be enabled or configured by administrators, and the ICS service cannot run on the computer. The Advanced tab in the Properties dialog box for a LAN or remote access connection is removed. The Internet Connection Sharing page is removed from the New Connection Wizard. The Network Setup Wizard is disabled.&lt;br/&gt;&lt;br/&gt;If you disable this setting or do not configure it and have two or more connections, administrators can enable ICS. The Advanced tab in the properties dialog box for a LAN or remote access connection is available. In addition, the user is presented with the option to enable Internet Connection Sharing in the Network Setup Wizard and Make New Connection Wizard. (The Network Setup Wizard is available only in Windows XP Professional.)&lt;br/&gt;&lt;br/&gt;By default, ICS is disabled when you create a remote access connection, but administrators can use the Advanced tab to enable it. When running the New Connection Wizard or Network Setup Wizard, administrators can choose to enable ICS.&lt;br/&gt;&lt;br/&gt;Note: Internet Connection Sharing is only available when two or more network connections are present.&lt;br/&gt;&lt;br/&gt;Note: When the &amp;quot;Prohibit access to properties of a LAN connection,&amp;quot; &amp;quot;Ability to change properties of an all user remote access connection,&amp;quot; or &amp;quot;Prohibit changing properties of a private remote access connection&amp;quot; settings are set to deny access to the Connection Properties dialog box, the Advanced tab for the connection is blocked.&lt;br/&gt;&lt;br/&gt;Note: Nonadministrators are already prohibited from configuring Internet Connection Sharing, regardless of this setting.&lt;br/&gt;&lt;br/&gt;Note: Disabling this setting does not prevent Wireless Hosted Networking from using the ICS service for DHCP services. To prevent the ICS service from running, on the Network Permissions tab in the network&amp;#39;s policy properties, select the &amp;quot;Don&amp;#39;t use hosted networks&amp;quot; check box." gpmc_supported="At least Windows Server 2003 operating systems or Windows XP Professional">Prohibit use of Internet Connection Sharing on your DNS domain network</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Network/Network Connections/Windows Defender Firewall/Domain Profile</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Windows Defender Firewall: Allow logging" gpmc_settingPath="Computer Configuration/Administrative Templates/Network/Network Connections/Windows Defender Firewall/Domain Profile" gpmc_settingDescription="Allows Windows Defender Firewall to record information about the unsolicited incoming messages that it receives.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, Windows Defender Firewall writes the information to a log file. You must provide the name, location, and maximum size of the log file. The location can contain environment variables. You must also specify whether to record information about incoming messages that the firewall blocks (drops) and information about successful incoming and outgoing connections. Windows Defender Firewall does not provide an option to log successful incoming messages.&lt;br/&gt;&lt;br/&gt;If you are configuring the log file name, ensure that the Windows Defender Firewall service account has write permissions to the folder containing the log file. Default path for the log file is %systemroot%\system32\LogFiles\Firewall\pfirewall.log.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, Windows Defender Firewall does not record information in the log file. If you enable this policy setting, and Windows Defender Firewall creates the log file and adds information, then upon disabling this policy setting, Windows Defender Firewall leaves the log file intact.&lt;br/&gt;&lt;br/&gt;If you do not configure this policy setting, Windows Defender Firewall behaves as if the policy setting were disabled.&lt;br/&gt;&lt;br/&gt;" gpmc_supported="At least Windows XP Professional with SP2">Windows Defender Firewall: Allow logging</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>Log dropped packets</td><td>Enabled</td></tr>
<tr><td>Log successful connections</td><td>Enabled</td></tr>
<tr><td>Log file path and name:</td><td>&nbsp;</td></tr>
<tr><td>Size limit (KB):</td><td>16384</td></tr>
</table></td></tr><tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Windows Defender Firewall: Prohibit notifications" gpmc_settingPath="Computer Configuration/Administrative Templates/Network/Network Connections/Windows Defender Firewall/Domain Profile" gpmc_settingDescription="Prevents Windows Defender Firewall from displaying notifications to the user when a program requests that Windows Defender Firewall add the program to the program exceptions list.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, Windows Defender Firewall prevents the display of these notifications.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, Windows Defender Firewall allows the display of these notifications. In the Windows Defender Firewall component of Control Panel, the &amp;quot;Notify me when Windows Defender Firewall blocks a new program&amp;quot; check box is selected and administrators cannot clear it.&lt;br/&gt;&lt;br/&gt;If you do not configure this policy setting, Windows Defender Firewall behaves as if the policy setting were disabled, except that in the Windows Defender Firewall component of Control Panel, the &amp;quot;Notify me when Windows Defender Firewall blocks a new program&amp;quot; check box is selected by default, and administrators can change it." gpmc_supported="At least Windows XP Professional with SP2">Windows Defender Firewall: Prohibit notifications</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Windows Defender Firewall: Protect all network connections" gpmc_settingPath="Computer Configuration/Administrative Templates/Network/Network Connections/Windows Defender Firewall/Domain Profile" gpmc_settingDescription="Turns on Windows Defender Firewall.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, Windows Defender Firewall runs and ignores the &amp;quot;Computer Configuration\Administrative Templates\Network\Network Connections\Prohibit use of Internet Connection Firewall on your DNS domain network&amp;quot; policy setting.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, Windows Defender Firewall does not run. This is the only way to ensure that Windows Defender Firewall does not run and administrators who log on locally cannot start it.&lt;br/&gt;&lt;br/&gt;If you do not configure this policy setting, administrators can use the Windows Defender Firewall component in Control Panel to turn Windows Defender Firewall on or off, unless the &amp;quot;Prohibit use of Internet Connection Firewall on your DNS domain network&amp;quot; policy setting overrides." gpmc_supported="At least Windows XP Professional with SP2">Windows Defender Firewall: Protect all network connections</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Network/Network Provider</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Hardened UNC Paths" gpmc_settingPath="Computer Configuration/Administrative Templates/Network/Network Provider" gpmc_settingDescription="This policy setting configures secure access to UNC paths.&lt;br/&gt;&lt;br/&gt;If you enable this policy, Windows only allows access to the specified UNC paths after fulfilling additional security requirements.&lt;br/&gt;" gpmc_supported="At least Windows Vista">Hardened UNC Paths</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td colspan="2">Specify hardened network paths.
In the name field, type a fully-qualified UNC path for each network resource.
To secure all access to a share with a particular name, regardless of the server name, specify a server name of &#39;*&#39; (asterisk). For example, &quot;\\*\NETLOGON&quot;.
To secure all access to all shares hosted on a server, the share name portion of the UNC path may be omitted. For example, &quot;\\SERVER&quot;.

In the value field, specify one or more of the following options, separated by commas:
    &#39;RequireMutualAuthentication=1&#39;: Mutual authentication between the client and server is required to ensure the client connects to the correct server.
    &#39;RequireIntegrity=1&#39;: Communication between the client and server must employ an integrity mechanism to prevent data tampering.
    &#39;RequirePrivacy=1&#39;: Communication between the client and the server must be encrypted to prevent third parties from observing sensitive data.</td></tr><tr><td colspan="2"><table class="subtable">
<tr><th scope="col">Hardened UNC Paths:</th><th scope="col">&nbsp;</th></tr>
<tr><td>\\*\SYSVOL</td><td>RequireMutualAuthentication=1,RequireIntegrity=1</td></tr>
<tr><td>\\*\NETLOGON</td><td>RequireMutualAuthentication=1,RequireIntegrity=1</td></tr>
</table></td></tr><tr><td colspan="2"> </td></tr><tr><td colspan="2">You should require both Integrity and Mutual Authentication for any UNC paths that host executable programs, script files, or files that control security policies.

Consider hosting files that do not require Integrity or Privacy on separate shares from those that absolutely need such security for optimal performance.

For additional details on configuring Windows computers to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.</td></tr></table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Network/Windows Connection Manager</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Prohibit connection to non-domain networks when connected to domain authenticated network" gpmc_settingPath="Computer Configuration/Administrative Templates/Network/Windows Connection Manager" gpmc_settingDescription="This policy setting prevents computers from connecting to both a domain based network and a non-domain based network at the same time.&lt;br/&gt;&lt;br/&gt;If this policy setting is enabled, the computer responds to automatic and manual network connection attempts based on the following circumstances:&lt;br/&gt;&lt;br/&gt;Automatic connection attempts&lt;br/&gt;- When the computer is already connected to a domain based network, all automatic connection attempts to non-domain networks are blocked.&lt;br/&gt;- When the computer is already connected to a non-domain based network, automatic connection attempts to domain based networks are blocked.&lt;br/&gt;&lt;br/&gt;Manual connection attempts&lt;br/&gt;- When the computer is already connected to either a non-domain based network or a domain based network over media other than Ethernet, and a user attempts to create a manual connection to an additional network in violation of this policy setting, the existing network connection is disconnected and the manual connection is allowed.&lt;br/&gt;- When the computer is already connected to either a non-domain based network or a domain based network over Ethernet, and a user attempts to create a manual connection to an additional network in violation of this policy setting, the existing Ethernet connection is maintained and the manual connection attempt is blocked.&lt;br/&gt;&lt;br/&gt;If this policy setting is not configured or is disabled, computers are allowed to connect simultaneously to both domain and non-domain networks.&lt;br/&gt;      " gpmc_supported="At least Windows Server 2012, Windows 8 or Windows RT">Prohibit connection to non-domain networks when connected to domain authenticated network</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Network/WLAN Service/WLAN Settings</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services" gpmc_settingPath="Computer Configuration/Administrative Templates/Network/WLAN Service/WLAN Settings" gpmc_settingDescription="This policy setting determines whether users can enable the following WLAN settings: &amp;quot;Connect to suggested open hotspots,&amp;quot; &amp;quot;Connect to networks shared by my contacts,&amp;quot; and &amp;quot;Enable paid services&amp;quot;.&lt;br/&gt;&lt;br/&gt;&amp;quot;Connect to suggested open hotspots&amp;quot; enables Windows to automatically connect users to open hotspots it knows about by crowdsourcing networks that other people using Windows have connected to.&lt;br/&gt;&lt;br/&gt;&amp;quot;Connect to networks shared by my contacts&amp;quot; enables Windows to automatically connect to networks that the user&amp;#39;s contacts have shared with them, and enables users on this device to share networks with their contacts.&lt;br/&gt;&lt;br/&gt;&amp;quot;Enable paid services&amp;quot; enables Windows to temporarily connect to open hotspots to determine if paid services are available.&lt;br/&gt;&lt;br/&gt;If this policy setting is disabled, both &amp;quot;Connect to suggested open hotspots,&amp;quot; &amp;quot;Connect to networks shared by my contacts,&amp;quot; and &amp;quot;Enable paid services&amp;quot; will be turned off and users on this device will be prevented from enabling them.&lt;br/&gt;&lt;br/&gt;If this policy setting is not configured or is enabled, users can choose to enable or disable either &amp;quot;Connect to suggested open hotspots&amp;quot;  or &amp;quot;Connect to networks shared by my contacts&amp;quot;.&lt;br/&gt;      " gpmc_supported="At least Windows 10">Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Printers</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Configure Redirection Guard" gpmc_settingPath="Computer Configuration/Administrative Templates/Printers" gpmc_settingDescription="&lt;br/&gt;Determines whether Redirection Guard is enabled for the print spooler.&lt;br/&gt;&lt;br/&gt;You can enable this setting to configure the Redirection Guard policy being applied to spooler.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, Redirection Guard will default to being &amp;#39;enabled&amp;#39;.&lt;br/&gt;&lt;br/&gt;If you enable this setting you may select the following options:&lt;br/&gt;&lt;br/&gt;-- Enabled : Redirection Guard will prevent any file redirections from being followed&lt;br/&gt;&lt;br/&gt;-- Disabed : Redirection Guard will not be enabled and file redirections may be used within the spooler process&lt;br/&gt;&lt;br/&gt;-- Audit   : Redirection Guard will log events as though it were enabled but will not actually prevent file redirections from being used within the spooler.&lt;br/&gt;      " gpmc_supported="At least Windows Server 2008 R2 or Windows 7">Configure Redirection Guard</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td colspan="2">Configure options for Redirection Guard</td></tr><tr><td>Redirection Guard Options</td><td>Redirection Guard Enabled</td></tr>
</table></td></tr><tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Limits print driver installation to Administrators" gpmc_settingPath="Computer Configuration/Administrative Templates/Printers" gpmc_settingDescription="&lt;br/&gt;Determines whether users that aren&amp;#39;t Administrators can install print drivers on this computer.&lt;br/&gt;&lt;br/&gt;By default, users that aren&amp;#39;t Administrators can&amp;#39;t install print drivers on this computer.&lt;br/&gt;&lt;br/&gt;If you enable this setting or do not configure it, the system will limit installation of print drivers to Adminstrators of this computer.&lt;br/&gt;&lt;br/&gt;If you disable this setting, the system won&amp;#39;t limit installation of print drivers to this computer.&lt;br/&gt;        " gpmc_supported="At least Windows Server 2008 R2 or Windows 7">Limits print driver installation to Administrators</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Credentials Delegation</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Encryption Oracle Remediation" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Credentials Delegation" gpmc_settingDescription="Encryption Oracle Remediation&lt;br/&gt;&lt;br/&gt;This policy setting applies to applications using the CredSSP component (for example: Remote Desktop Connection).&lt;br/&gt;&lt;br/&gt;Some versions of the CredSSP protocol are vulnerable to an encryption oracle attack against the client.  This policy controls compatibility with vulnerable clients and servers.  This policy allows you to set the level of protection desired for the encryption oracle vulnerability.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, CredSSP version support will be selected based on the following options:&lt;br/&gt;&lt;br/&gt;Force Updated Clients: Client applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. Note: this setting should not be deployed until all remote hosts support the newest version.&lt;br/&gt;&lt;br/&gt;Mitigated: Client applications which use CredSSP will not be able to fall back to the insecure version but services using CredSSP will accept unpatched clients. See the link below for important information about the risk posed by remaining unpatched clients.&lt;br/&gt;&lt;br/&gt;Vulnerable: Client applications which use CredSSP will expose the remote servers to attacks by supporting fall back to the insecure versions and services using CredSSP will accept unpatched clients.&lt;br/&gt;&lt;br/&gt;For more information about the vulnerability and servicing requirements for protection, see https://go.microsoft.com/fwlink/?linkid=866660" gpmc_supported="At least Windows Vista">Encryption Oracle Remediation</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>Protection Level:</td><td>Force Updated Clients</td></tr>
</table></td></tr><tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Remote host allows delegation of non-exportable credentials" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Credentials Delegation" gpmc_settingDescription="Remote host allows delegation of non-exportable credentials&lt;br/&gt;&lt;br/&gt;When using credential delegation, devices provide an exportable version of credentials to the remote host. This exposes users to the risk of credential theft from attackers on the remote host.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the host supports Restricted Admin or Remote Credential Guard mode.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, Restricted Administration and Remote Credential Guard mode are not supported. User will always need to pass their credentials to the host." gpmc_supported="At least Windows Server 2016, Windows 10 Version 1703">Remote host allows delegation of non-exportable credentials</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Early Launch Antimalware</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Boot-Start Driver Initialization Policy" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Early Launch Antimalware" gpmc_settingDescription="This policy setting allows you to specify which boot-start drivers are initialized based on a classification determined by an Early Launch Antimalware boot-start driver. The Early Launch Antimalware boot-start driver can return the following classifications for each boot-start driver:&lt;br/&gt;-  Good: The driver has been signed and has not been tampered with.&lt;br/&gt;-  Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized.&lt;br/&gt;-  Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver.&lt;br/&gt;-  Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot-start driver.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting you will be able to choose which boot-start drivers to initialize the next time the computer is started.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the boot start drivers determined to be Good, Unknown or Bad but Boot Critical are initialized and the initialization of drivers determined to be Bad is skipped.&lt;br/&gt;&lt;br/&gt;If your malware detection application does not include an Early Launch Antimalware boot-start driver or if your Early Launch Antimalware boot-start driver has been disabled, this setting has no effect and all boot-start drivers are initialized.&lt;br/&gt;      " gpmc_supported="At least Windows Server 2012, Windows 8 or Windows RT">Boot-Start Driver Initialization Policy</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>Choose the boot-start drivers that can be initialized:</td><td>Good, unknown and bad but critical</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Internet Communication Management/Internet Communication settings</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn off downloading of print drivers over HTTP" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings" gpmc_settingDescription="This policy setting specifies whether to allow this client to download print driver packages over HTTP.&lt;br/&gt;&lt;br/&gt;To set up HTTP printing, non-inbox drivers need to be downloaded over HTTP.&lt;br/&gt;&lt;br/&gt;Note: This policy setting does not prevent the client from printing to printers on the Intranet or the Internet over HTTP.  It only prohibits downloading drivers that are not already installed locally.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, print drivers cannot be downloaded over HTTP.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, users can download print drivers over HTTP." gpmc_supported="At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2">Turn off downloading of print drivers over HTTP</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn off Internet download for Web publishing and online ordering wizards" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings" gpmc_settingDescription="This policy setting specifies whether Windows should download a list of providers for the web publishing and online ordering wizards.&lt;br/&gt;&lt;br/&gt;These wizards allow users to select from a list of companies that provide services such as online storage and photographic printing. By default, Windows displays providers downloaded from a Windows website in addition to providers specified in the registry.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, Windows does not download providers, and only the service providers that are cached in the local registry are displayed.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, a list of providers are downloaded when the user uses the web publishing or online ordering wizards.&lt;br/&gt;&lt;br/&gt;See the documentation for the web publishing and online ordering wizards for more information, including details on specifying service providers in the registry." gpmc_supported="At least Windows Server 2003 operating systems or Windows XP Professional with SP2">Turn off Internet download for Web publishing and online ordering wizards</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Kernel DMA Protection</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Enumeration policy for external devices incompatible with Kernel DMA Protection" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Kernel DMA Protection" gpmc_settingDescription="Enumeration policy for external DMA-capable devices incompatible with DMA remapping. This policy only takes effect when Kernel DMA Protection is enabled and supported by the system. Note: this policy does not apply to 1394, PCMCIA or ExpressCard devices." gpmc_supported="At least Windows Server 2016, Windows 10">Enumeration policy for external devices incompatible with Kernel DMA Protection</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>Enumeration policy</td><td>Block all</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Local Security Authority</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow Custom SSPs and APs to be loaded into LSASS" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Local Security Authority" gpmc_settingDescription="This policy controls the configuration under which LSASS loads custom SSPs and APs.&lt;br/&gt;&lt;br/&gt;If you enable this setting or do not configure it, LSA allows custom SSPs and APs to be loaded.&lt;br/&gt;&lt;br/&gt;If you disable this setting, LSA does not load custom SSPs and APs." gpmc_supported="At least Windows 10 Version 1903">Allow Custom SSPs and APs to be loaded into LSASS</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Configures LSASS to run as a protected process" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Local Security Authority" gpmc_settingDescription="This policy controls the configuration under which LSASS is run.&lt;br/&gt;&lt;br/&gt;If you do not configure this policy and there is no current setting in the registry, LSA will run as protected process for clean installed, HVCI capable, client SKUs that are domain or cloud domain joined devices. This configuration is not UEFI locked. This can be overridden if the policy is configured.&lt;br/&gt;&lt;br/&gt;If you configure and set this policy setting to &amp;quot;Disabled&amp;quot;, LSA will not run as a protected process.&lt;br/&gt;&lt;br/&gt;If you configure and set this policy setting to &amp;quot;EnabledWithUEFILock,&amp;quot; LSA will run as a protected process and this configuration is UEFI locked.&lt;br/&gt;&lt;br/&gt;If you configure and set this policy setting to &amp;quot;EnabledWithoutUEFILock&amp;quot;, LSA will run as a protected process and this configuration is not UEFI locked. " gpmc_supported="At least Windows 10 Version 1903">Configures LSASS to run as a protected process</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>Configure LSA to run as a protected process</td><td>Enabled with UEFI Lock</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Logon</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Enumerate local users on domain-joined computers" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Logon" gpmc_settingDescription="This policy setting allows local users to be enumerated on domain-joined computers.  &lt;br/&gt;&lt;br/&gt;If you enable this policy setting, Logon UI will enumerate all local users on domain-joined computers.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the Logon UI will not enumerate local users on domain-joined computers." gpmc_supported="At least Windows Server 2012, Windows 8 or Windows RT">Enumerate local users on domain-joined computers</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn on convenience PIN sign-in" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Logon" gpmc_settingDescription="This policy setting allows you to control whether a domain user can sign in using a convenience PIN.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, a domain user can set up and sign in with a convenience PIN.&lt;br/&gt;&lt;br/&gt;If you disable or don&amp;#39;t configure this policy setting, a domain user can&amp;#39;t set up and use a convenience PIN.&lt;br/&gt;&lt;br/&gt;Note: The user&amp;#39;s domain password will be cached in the system vault when using this feature.&lt;br/&gt;&lt;br/&gt;To configure Windows Hello for Business, use the Administrative Template policies under Windows Hello for Business." gpmc_supported="At least Windows Server 2012, Windows 8 or Windows RT">Turn on convenience PIN sign-in</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Power Management/Sleep Settings</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Require a password when a computer wakes (on battery)" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Power Management/Sleep Settings" gpmc_settingDescription="This policy setting specifies whether or not the user is prompted for a password when the system resumes from sleep.&lt;br/&gt;&lt;br/&gt;If you enable or do not configure this policy setting, the user is prompted for a password when the system resumes from sleep.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, the user is not prompted for a password when the system resumes from sleep." gpmc_supported="At least Windows Vista">Require a password when a computer wakes (on battery)</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Require a password when a computer wakes (plugged in)" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Power Management/Sleep Settings" gpmc_settingDescription="This policy setting specifies whether or not the user is prompted for a password when the system resumes from sleep.&lt;br/&gt;&lt;br/&gt;If you enable or do not configure this policy setting, the user is prompted for a password when the system resumes from sleep.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, the user is not prompted for a password when the system resumes from sleep." gpmc_supported="At least Windows Vista">Require a password when a computer wakes (plugged in)</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Remote Assistance</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Configure Solicited Remote Assistance" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Remote Assistance" gpmc_settingDescription="This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, users on this computer can use email or file transfer to ask someone for help. Also, users can use instant messaging programs to allow connections to this computer, and you can configure additional Remote Assistance settings.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, users on this computer cannot use email or file transfer to ask someone for help. Also, users cannot use instant messaging programs to allow connections to this computer.&lt;br/&gt;&lt;br/&gt;If you do not configure this policy setting, users can turn on or turn off Solicited (Ask for) Remote Assistance themselves in System Properties in Control Panel. Users can also configure Remote Assistance settings.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, you have two ways to allow helpers to provide Remote Assistance: &amp;quot;Allow helpers to only view the computer&amp;quot; or &amp;quot;Allow helpers to remotely control the computer.&amp;quot;&lt;br/&gt;&lt;br/&gt;The &amp;quot;Maximum ticket time&amp;quot; policy setting sets a limit on the amount of time that a Remote Assistance invitation created by using email or file transfer can remain open.&lt;br/&gt;&lt;br/&gt;The &amp;quot;Select the method for sending email invitations&amp;quot; setting specifies which email standard to use to send Remote Assistance invitations. Depending on your email program, you can use either the Mailto standard (the invitation recipient connects through an Internet link) or the SMAPI (Simple MAPI) standard (the invitation is attached to your email message). This policy setting is not available in Windows Vista since SMAPI is the only method supported.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting you should also enable appropriate firewall exceptions to allow Remote Assistance communications." gpmc_supported="At least Windows Server 2003 operating systems or Windows XP Professional">Configure Solicited Remote Assistance</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">System/Remote Procedure Call</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Restrict Unauthenticated RPC clients" gpmc_settingPath="Computer Configuration/Administrative Templates/System/Remote Procedure Call" gpmc_settingDescription="This policy setting controls how the RPC server runtime handles unauthenticated RPC clients connecting to RPC servers.&lt;br/&gt;&lt;br/&gt;This policy setting impacts all RPC applications.  In a domain environment this policy setting should be used with caution as it can impact a wide range of functionality including group policy processing itself.  Reverting a change to this policy setting can require manual intervention on each affected machine.  This policy setting should never be applied to a domain controller.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, the RPC server runtime uses the value of &amp;quot;Authenticated&amp;quot; on Windows Client, and the value of &amp;quot;None&amp;quot; on Windows Server versions that support this policy setting. &lt;br/&gt;&lt;br/&gt;If you do not configure this policy setting, it remains disabled.  The RPC server runtime will behave as though it was enabled with the value of &amp;quot;Authenticated&amp;quot; used for Windows Client and the value of &amp;quot;None&amp;quot; used for Server SKUs that support this policy setting. &lt;br/&gt;&lt;br/&gt;If you enable this policy setting, it directs the RPC server runtime to restrict unauthenticated RPC clients connecting to RPC servers running on a machine. A client will be considered an authenticated client if it uses a named pipe to communicate with the server or if it uses RPC Security. RPC Interfaces that have specifically requested to be accessible by unauthenticated clients may be exempt from this restriction, depending on the selected value for this policy setting.&lt;br/&gt;&lt;br/&gt;--  &amp;quot;None&amp;quot; allows all RPC clients to connect to RPC Servers running on the machine on which the policy setting is applied.&lt;br/&gt;&lt;br/&gt;--  &amp;quot;Authenticated&amp;quot; allows only authenticated RPC Clients (per the definition above) to connect to RPC Servers running on the machine on which the policy setting is applied. Exemptions are granted to interfaces that have requested them.&lt;br/&gt;&lt;br/&gt;--  &amp;quot;Authenticated without exceptions&amp;quot; allows only authenticated RPC Clients (per the definition above) to connect to RPC Servers running on the machine on which the policy setting is applied.  No exceptions are allowed.&lt;br/&gt;&lt;br/&gt;Note: This policy setting will not be applied until the system is rebooted." gpmc_supported="At least Windows XP Professional with SP2">Restrict Unauthenticated RPC clients</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>RPC Runtime Unauthenticated Client Restriction to Apply:</td><td>Authenticated</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/App Privacy</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Let Windows apps activate with voice while the system is locked" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/App Privacy" gpmc_settingDescription="&lt;br/&gt;This policy setting specifies whether Windows apps can be activated by voice while the system is locked.&lt;br/&gt;&lt;br/&gt;If you choose the &amp;quot;User is in control&amp;quot; option, employees in your organization can decide whether users can interact with applications using speech while the system is locked by using Settings &amp;gt; Privacy on the device.&lt;br/&gt;&lt;br/&gt;If you choose the &amp;quot;Force Allow&amp;quot; option, users can interact with applications using speech while the system is locked and employees in your organization cannot change it.&lt;br/&gt;&lt;br/&gt;If you choose the &amp;quot;Force Deny&amp;quot; option, users cannot interact with applications using speech while the system is locked and employees in your organization cannot change it.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, employees in your organization can decide whether users can interact with applications using speech while the system is locked by using Settings &amp;gt; Privacy on the device.&lt;br/&gt;&lt;br/&gt;This policy is applied to Windows apps and Cortana. It takes precedence of the “Allow Cortana above lock” policy. This policy is applicable only when “Allow voice activation” policy is configured to allow applications to be activated with voice.&lt;br/&gt;      " gpmc_supported="At least Windows Server 2016, Windows 10">Let Windows apps activate with voice while the system is locked</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>Default for all apps:</td><td>Force Deny</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/App runtime</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow Microsoft accounts to be optional" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/App runtime" gpmc_settingDescription="This policy setting lets you control whether Microsoft accounts are optional for Windows Store apps that require an account to sign in. This policy only affects Windows Store apps that support it.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, Windows Store apps that typically require a Microsoft account to sign in will allow users to sign in with an enterprise account instead.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, users will need to sign in with a Microsoft account." gpmc_supported="At least Windows Server 2012 R2, Windows 8.1 or Windows RT 8.1">Allow Microsoft accounts to be optional</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/AutoPlay Policies</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Disallow Autoplay for non-volume devices" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/AutoPlay Policies" gpmc_settingDescription="This policy setting disallows AutoPlay for MTP devices like cameras or phones.&lt;br/&gt;&lt;br/&gt;          If you enable this policy setting, AutoPlay is not allowed for MTP devices like cameras or phones.&lt;br/&gt;&lt;br/&gt;          If you disable or do not configure this policy setting, AutoPlay is enabled for non-volume devices." gpmc_supported="At least Windows Server 2008 R2 or Windows 7">Disallow Autoplay for non-volume devices</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Set the default behavior for AutoRun" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/AutoPlay Policies" gpmc_settingDescription="This policy setting sets the default behavior for Autorun commands.&lt;br/&gt;&lt;br/&gt;          Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines.&lt;br/&gt;&lt;br/&gt;          Prior to Windows Vista, when media containing an autorun command is inserted, the system will automatically execute the program without user intervention.&lt;br/&gt;&lt;br/&gt;          This creates a major security concern as code may be executed without user&amp;#39;s knowledge. The default behavior starting with Windows Vista is to prompt the user whether autorun command is to be run. The autorun command is represented as a handler in the Autoplay dialog.&lt;br/&gt;&lt;br/&gt;          If you enable this policy setting, an Administrator can change the default Windows Vista or later behavior for autorun to:&lt;br/&gt;&lt;br/&gt;          a) Completely disable autorun commands, or&lt;br/&gt;          b) Revert back to pre-Windows Vista behavior of automatically executing the autorun command.&lt;br/&gt;&lt;br/&gt;          If you disable or not configure this policy setting, Windows Vista or later will prompt the user whether autorun command is to be run." gpmc_supported="At least Windows Vista">Set the default behavior for AutoRun</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>Default AutoRun Behavior</td><td>Do not execute any autorun commands</td></tr>
</table></td></tr><tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn off Autoplay" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/AutoPlay Policies" gpmc_settingDescription="This policy setting allows you to turn off the Autoplay feature.&lt;br/&gt;&lt;br/&gt;          Autoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs and the music on audio media start immediately.&lt;br/&gt;&lt;br/&gt;          Prior to Windows XP SP2, Autoplay is disabled by default on removable drives, such as the floppy disk drive (but not the CD-ROM drive), and on network drives.&lt;br/&gt;&lt;br/&gt;          Starting with Windows XP SP2, Autoplay is enabled for removable drives as well, including Zip drives and some USB mass storage devices.&lt;br/&gt;&lt;br/&gt;          If you enable this policy setting, Autoplay is disabled on CD-ROM and removable media drives, or disabled on all drives.&lt;br/&gt;&lt;br/&gt;          This policy setting disables Autoplay on additional types of drives. You cannot use this setting to enable Autoplay on drives on which it is disabled by default.&lt;br/&gt;&lt;br/&gt;          If you disable or do not configure this policy setting, AutoPlay is enabled.&lt;br/&gt;&lt;br/&gt;          Note: This policy setting appears in both the Computer Configuration and User Configuration folders. If the policy settings conflict, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration." gpmc_supported="At least Windows 2000">Turn off Autoplay</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>Turn off Autoplay on:</td><td>All drives</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Biometrics/Facial Features</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Configure enhanced anti-spoofing" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Biometrics/Facial Features" gpmc_settingDescription="This policy setting determines whether enhanced anti-spoofing is required for Windows Hello face authentication.&lt;br/&gt;&lt;br/&gt;If you enable this setting, Windows requires all users on managed devices to use enhanced anti-spoofing for Windows Hello face authentication. This disables Windows Hello face authentication on devices that do not support enhanced anti-spoofing.&lt;br/&gt;&lt;br/&gt;If you disable or don&amp;#39;t configure this setting, Windows doesn&amp;#39;t require enhanced anti-spoofing for Windows Hello face authentication.&lt;br/&gt;&lt;br/&gt;Note that enhanced anti-spoofing for Windows Hello face authentication is not required on unmanaged devices.&lt;br/&gt;" gpmc_supported="At least Windows Server 2016 or Windows 10">Configure enhanced anti-spoofing</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Cloud Content</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn off Microsoft consumer experiences" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Cloud Content" gpmc_settingDescription="This policy setting turns off experiences that help consumers make the most of their devices and Microsoft account.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, users will no longer see personalized recommendations from Microsoft and notifications about their Microsoft account.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, users may see suggestions from Microsoft and notifications about their Microsoft account.&lt;br/&gt;&lt;br/&gt;Note: This setting only applies to Enterprise and Education SKUs." gpmc_supported="At least Windows 10">Turn off Microsoft consumer experiences</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Credential User Interface</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Enumerate administrator accounts on elevation" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Credential User Interface" gpmc_settingDescription="This policy setting controls whether administrator accounts are displayed when a user attempts to elevate a running application. By default, administrator accounts are not displayed when the user attempts to elevate a running application.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, all local administrator accounts on the PC will be displayed so the user can choose one and enter the correct password.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, users will always be required to type a user name and password to elevate." gpmc_supported="At least Windows Vista">Enumerate administrator accounts on elevation</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Event Log Service/Application</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Specify the maximum log file size (KB)" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Event Log Service/Application" gpmc_settingDescription="This policy setting specifies the maximum size of the log file in kilobytes.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes), in kilobyte increments.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 1 megabyte." gpmc_supported="At least Windows Vista">Specify the maximum log file size (KB)</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>Maximum Log Size (KB)</td><td>32768</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Event Log Service/Security</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Specify the maximum log file size (KB)" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Event Log Service/Security" gpmc_settingDescription="This policy setting specifies the maximum size of the log file in kilobytes.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, you can configure the maximum log file size to be between 20 megabytes (20480 kilobytes) and 2 terabytes (2147483647 kilobytes), in kilobyte increments.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 20 megabytes." gpmc_supported="At least Windows Vista">Specify the maximum log file size (KB)</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>Maximum Log Size (KB)</td><td>196608</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Event Log Service/System</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Specify the maximum log file size (KB)" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Event Log Service/System" gpmc_settingDescription="This policy setting specifies the maximum size of the log file in kilobytes.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes), in kilobyte increments.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 1 megabyte." gpmc_supported="At least Windows Vista">Specify the maximum log file size (KB)</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>Maximum Log Size (KB)</td><td>32768</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Remote Desktop Services/Remote Desktop Connection Client</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Do not allow passwords to be saved" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection Client" gpmc_settingDescription="Controls whether passwords can be saved on this computer from Remote Desktop Connection.&lt;br/&gt;&lt;br/&gt;If you enable this setting the password saving checkbox in Remote Desktop Connection will be disabled and users will no longer be able to save passwords. When a user opens an RDP file using Remote Desktop Connection and saves his settings, any password that previously existed in the RDP file will be deleted.&lt;br/&gt;&lt;br/&gt;If you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection." gpmc_supported="At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2">Do not allow passwords to be saved</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Remote Desktop Services/Remote Desktop Session Host/Device and Resource Redirection</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Do not allow drive redirection" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Session Host/Device and Resource Redirection" gpmc_settingDescription="This policy setting specifies whether to prevent the mapping of client drives in a Remote Desktop Services session (drive redirection).&lt;br/&gt;&lt;br/&gt;By default, an RD Session Host server maps client drives automatically upon connection. Mapped drives appear in the session folder tree in File Explorer or Computer in the format &amp;lt;driveletter&amp;gt; on &amp;lt;computername&amp;gt;. You can use this policy setting to override this behavior.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, client drive redirection is not allowed in Remote Desktop Services sessions, and Clipboard file copy redirection is not allowed on computers running Windows Server 2003, Windows 8, and Windows XP.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, client drive redirection is always allowed. In addition, Clipboard file copy redirection is always allowed if Clipboard redirection is allowed.&lt;br/&gt;&lt;br/&gt;If you do not configure this policy setting, client drive redirection and Clipboard file copy redirection are not specified at the Group Policy level.&lt;br/&gt;" gpmc_supported="At least Windows Server 2003 operating systems or Windows XP Professional">Do not allow drive redirection</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Always prompt for password upon connection" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security" gpmc_settingDescription="This policy setting specifies whether Remote Desktop Services always prompts the client for a password upon connection.&lt;br/&gt;&lt;br/&gt;You can use this setting to enforce a password prompt for users logging on to Remote Desktop Services, even if they already provided the password in the Remote Desktop Connection client.&lt;br/&gt;&lt;br/&gt;By default, Remote Desktop Services allows users to automatically log on by entering a password in the Remote Desktop Connection client.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, users cannot automatically log on to Remote Desktop Services by supplying their passwords in the Remote Desktop Connection client. They are prompted for a password to log on.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, users can always log on to Remote Desktop Services automatically by supplying their passwords in the Remote Desktop Connection client.&lt;br/&gt;&lt;br/&gt;If you do not configure this policy setting, automatic logon is not specified at the Group Policy level.&lt;br/&gt;" gpmc_supported="At least Windows Server 2003 operating systems or Windows XP Professional">Always prompt for password upon connection</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Require secure RPC communication" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security" gpmc_settingDescription="Specifies whether a Remote Desktop Session Host server requires secure RPC communication with all clients or allows unsecured communication.&lt;br/&gt;&lt;br/&gt;You can use this setting to strengthen the security of RPC communication with clients by allowing only authenticated and encrypted requests.&lt;br/&gt;&lt;br/&gt;If the status is set to Enabled, Remote Desktop Services accepts requests from RPC clients that support secure requests, and does not allow unsecured communication with untrusted clients.&lt;br/&gt;&lt;br/&gt;If the status is set to Disabled, Remote Desktop Services always requests security for all RPC traffic. However, unsecured communication is allowed for RPC clients that do not respond to the request.&lt;br/&gt;&lt;br/&gt;If the status is set to Not Configured, unsecured communication is allowed.&lt;br/&gt;&lt;br/&gt;Note: The RPC interface is used for administering and configuring Remote Desktop Services." gpmc_supported="At least Windows Server 2003">Require secure RPC communication</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Set client connection encryption level" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security" gpmc_settingDescription="Specifies whether to require the use of a specific encryption level to secure communications between client computers and RD Session Host servers during Remote Desktop Protocol (RDP) connections. This policy only applies when you are using native RDP encryption. However, native RDP encryption (as opposed to SSL encryption) is not recommended. This policy does not apply to SSL encryption.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, all communications between clients and RD Session Host servers during remote connections must use the encryption method specified in this setting. By default, the encryption level is set to High. The following encryption methods are available:&lt;br/&gt;&lt;br/&gt;* High: The High setting encrypts data sent from the client to the server and from the server to the client by using strong 128-bit encryption. Use this encryption level in environments that contain only 128-bit clients (for example, clients that run Remote Desktop Connection). Clients that do not support this encryption level cannot connect to RD Session Host servers.&lt;br/&gt;&lt;br/&gt;* Client Compatible: The Client Compatible setting encrypts data sent between the client and the server at the maximum key strength supported by the client. Use this encryption level in environments that include clients that do not support 128-bit encryption.&lt;br/&gt;&lt;br/&gt;* Low: The Low setting encrypts only data sent from the client to the server by using 56-bit encryption.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this setting, the encryption level to be used for remote connections to RD Session Host servers is not enforced through Group Policy.&lt;br/&gt;&lt;br/&gt;Important&lt;br/&gt;&lt;br/&gt;FIPS compliance can be configured through the System cryptography. Use FIPS compliant algorithms for encryption, hashing, and signing settings in Group Policy (under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options.) The FIPS compliant setting encrypts and decrypts data sent from the client to the server and from the server to the client, with the Federal Information Processing Standard (FIPS) 140 encryption algorithms, by using Microsoft cryptographic modules. Use this encryption level when communications between clients and RD Session Host servers requires the highest level of encryption.&lt;br/&gt;" gpmc_supported="At least Windows Server 2003 operating systems or Windows XP Professional">Set client connection encryption level</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>Encryption Level</td><td>High Level</td></tr>
<tr><td colspan="2">Choose the encryption level from the drop-down list.</td></tr></table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/RSS Feeds</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Prevent downloading of enclosures" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/RSS Feeds" gpmc_settingDescription="This policy setting prevents the user from having enclosures (file attachments) downloaded from a feed to the user&amp;#39;s computer.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the user cannot set the Feed Sync Engine to download an enclosure through the Feed property page. A developer cannot change the download setting through the Feed APIs.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the user can set the Feed Sync Engine to download an enclosure through the Feed property page. A developer can change the download setting through the Feed APIs." gpmc_supported="At least Internet Explorer 7.0">Prevent downloading of enclosures</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Search</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow indexing of encrypted files" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Search" gpmc_settingDescription="This policy setting allows encrypted items to be indexed. If you enable this policy setting, indexing  will attempt to decrypt and index the content (access restrictions will still apply). If you disable this policy setting, the search service components (including non-Microsoft components) are expected not to index encrypted items or encrypted stores. This policy setting is not configured by default. If you do not configure this policy setting, the local setting, configured through Control Panel, will be used. By default, the Control Panel setting is set to not index encrypted content.  &lt;br/&gt;&lt;br/&gt;When this setting is enabled or disabled, the index is rebuilt completely. &lt;br/&gt;&lt;br/&gt;Full volume encryption (such as BitLocker Drive Encryption or a non-Microsoft solution) must be used for the location of the index to maintain security for encrypted files." gpmc_supported="Microsoft Windows Vista, or any version of Windows with Windows Search 4.0 or later">Allow indexing of encrypted files</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Defender SmartScreen/Enhanced Phishing Protection</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Notify Malicious" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Defender SmartScreen/Enhanced Phishing Protection" gpmc_settingDescription="&lt;br/&gt;This policy setting determines whether Enhanced Phishing Protection in Microsoft Defender SmartScreen warns your users if they type their work or school password into one of the following malicious scenarios: into a reported phishing site, into a Microsoft login URL with an invalid certificate, or into an application connecting to either a reported phishing site or a Microsoft login URL with an invalid certificate.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, Enhanced Phishing Protection in Microsoft Defender SmartScreen warns your users if they type their work or school password into one of the malicious scenarios described above and encourages them to change their password.&lt;br/&gt;&lt;br/&gt;If you disable or don’t configure this policy setting, Enhanced Phishing Protection in Microsoft Defender SmartScreen will not warn your users if they type their work or school password into one of the malicious scenarios described above.&lt;br/&gt;      " gpmc_supported="">Notify Malicious</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Notify Password Reuse" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Defender SmartScreen/Enhanced Phishing Protection" gpmc_settingDescription="&lt;br/&gt;This policy setting determines whether Enhanced Phishing Protection in Microsoft Defender SmartScreen warns your users if they reuse their work or school password.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, Enhanced Phishing Protection in Microsoft Defender SmartScreen warns users if they reuse their work or school password and encourages them to change it.&lt;br/&gt;&lt;br/&gt;If you disable or don’t configure this policy setting, Enhanced Phishing Protection in Microsoft Defender SmartScreen will not warn users if they reuse their work or school password.&lt;br/&gt;      " gpmc_supported="">Notify Password Reuse</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Notify Unsafe App" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Defender SmartScreen/Enhanced Phishing Protection" gpmc_settingDescription="&lt;br/&gt;This policy setting determines whether Enhanced Phishing Protection in Microsoft Defender SmartScreen warns your users if they type their work or school passwords in Notepad, Winword, or M365 Office apps like OneNote, Word, Excel, etc.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, Enhanced Phishing Protection in Microsoft Defender SmartScreen warns your users if they store their password in text editor apps.&lt;br/&gt;&lt;br/&gt;If you disable or don’t configure this policy setting, Enhanced Phishing Protection in Microsoft Defender SmartScreen will not warn users if they store their password in text editor apps.&lt;br/&gt;      " gpmc_supported="">Notify Unsafe App</span></td><td>Enabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Service Enabled" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Defender SmartScreen/Enhanced Phishing Protection" gpmc_settingDescription="&lt;br/&gt;This policy setting determines whether Enhanced Phishing Protection in Microsoft Defender SmartScreen is in audit mode or off. Users do not see notifications for any protection scenarios when Enhanced Phishing Protection in Microsoft Defender is in audit mode. Audit mode captures unsafe password entry events and sends telemetry through Microsoft Defender.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, Enhanced Phishing Protection in Microsoft Defender SmartScreen is enabled in audit mode and your users are unable to turn it off.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, Enhanced Phishing Protection in Microsoft Defender SmartScreen is off and it will not capture events, send telemetry, or notify users. Additionally, your users are unable to turn it on.&lt;br/&gt;&lt;br/&gt;If you don’t configure this setting, users can decide whether or not they will enable Enhanced Phishing Protection in Microsoft Defender SmartScreen.&lt;br/&gt;      " gpmc_supported="">Service Enabled</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Defender SmartScreen/Explorer</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Configure Windows Defender SmartScreen" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Defender SmartScreen/Explorer" gpmc_settingDescription="This policy allows you to turn Windows Defender SmartScreen on or off.  SmartScreen helps protect PCs by warning users before running potentially malicious programs downloaded from the Internet.  This warning is presented as an interstitial dialog shown before running an app that has been downloaded from the Internet and is unrecognized or known to be malicious.  No dialog is shown for apps that do not appear to be suspicious.&lt;br/&gt;&lt;br/&gt;Some information is sent to Microsoft about files and programs run on PCs with this feature enabled.&lt;br/&gt;&lt;br/&gt;If you enable this policy, SmartScreen will be turned on for all users.  Its behavior can be controlled by the following options:&lt;br/&gt;&lt;br/&gt;• Warn and prevent bypass&lt;br/&gt;• Warn&lt;br/&gt;&lt;br/&gt;If you enable this policy with the &amp;quot;Warn and prevent bypass&amp;quot; option, SmartScreen&amp;#39;s dialogs will not present the user with the option to disregard the warning and run the app.  SmartScreen will continue to show the warning on subsequent attempts to run the app.&lt;br/&gt;&lt;br/&gt;If you enable this policy with the &amp;quot;Warn&amp;quot; option, SmartScreen&amp;#39;s dialogs will warn the user that the app appears suspicious, but will permit the user to disregard the warning and run the app anyway.  SmartScreen will not warn the user again for that app if the user tells SmartScreen to run the app.&lt;br/&gt;&lt;br/&gt;If you disable this policy, SmartScreen will be turned off for all users.  Users will not be warned if they try to run suspicious apps from the Internet.&lt;br/&gt;&lt;br/&gt;If you do not configure this policy, SmartScreen will be enabled by default, but users may change their settings." gpmc_supported="At least Windows Server 2012, Windows 8 or Windows RT">Configure Windows Defender SmartScreen</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>Pick one of the following settings:</td><td>Warn and prevent bypass</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Game Recording and Broadcasting</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Enables or disables Windows Game Recording and Broadcasting" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Game Recording and Broadcasting" gpmc_settingDescription="Windows Game Recording and Broadcasting.&lt;br/&gt;&lt;br/&gt;This setting enables or disables the Windows Game Recording and Broadcasting features. If you disable this setting, Windows Game Recording will not be allowed.&lt;br/&gt;If the setting is enabled or not configured, then Recording and Broadcasting (streaming) will be allowed.&lt;br/&gt; " gpmc_supported="At least Windows 10">Enables or disables Windows Game Recording and Broadcasting</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Ink Workspace</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow Windows Ink Workspace" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Ink Workspace" gpmc_settingDescription="Allow Windows Ink Workspace" gpmc_supported="At least Windows 10 Redstone">Allow Windows Ink Workspace</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>Choose one of the following actions</td><td>&nbsp;</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Installer</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow user control over installs" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Installer" gpmc_settingDescription="This policy setting permits users to change installation options that typically are available only to system administrators.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, some of the security features of Windows Installer are bypassed. It permits installations to complete that otherwise would be halted due to a security violation.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the security features of Windows Installer prevent users from changing installation options typically reserved for system administrators, such as specifying the directory to which files are installed.&lt;br/&gt;&lt;br/&gt;If Windows Installer detects that an installation package has permitted the user to change a protected option, it stops the installation and displays a message. These security features operate only when the installation program is running in a privileged security context in which it has access to directories denied to the user.&lt;br/&gt;&lt;br/&gt;This policy setting is designed for less restrictive environments. It can be used to circumvent errors in an installation program that prevents software from being installed." gpmc_supported="At least Windows 2000">Allow user control over installs</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Always install with elevated privileges" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Installer" gpmc_settingDescription="This policy setting directs Windows Installer to use elevated permissions when it installs any program on the system.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, privileges are extended to all programs. These privileges are usually reserved for programs that have been assigned to the user (offered on the desktop), assigned to the computer (installed automatically), or made available in Add or Remove Programs in Control Panel. This profile setting lets users install programs that require access to directories that the user might not have permission to view or change, including directories on highly restricted computers.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the system applies the current user&amp;#39;s permissions when it installs programs that a system administrator does not distribute or offer.&lt;br/&gt;&lt;br/&gt;Note: This policy setting appears both in the Computer Configuration and User Configuration folders. To make this policy setting effective, you must enable it in both folders.&lt;br/&gt;&lt;br/&gt;Caution: Skilled users can take advantage of the permissions this policy setting grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this policy setting is not guaranteed to be secure." gpmc_supported="At least Windows 2000">Always install with elevated privileges</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Logon Options</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Sign-in and lock last interactive user automatically after a restart" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Logon Options" gpmc_settingDescription="This policy setting controls whether a device will automatically sign in and lock the last interactive user after the system restarts or after a shutdown and cold boot.&lt;br/&gt;&lt;br/&gt;This only occurs if the last interactive user didn’t sign out before the restart or shutdown.​&lt;br/&gt;&lt;br/&gt;If the device is joined to Active Directory or Azure Active Directory, this policy only applies to Windows Update restarts. Otherwise, this will apply to both Windows Update restarts and user-initiated restarts and shutdowns.​&lt;br/&gt;&lt;br/&gt;If you don’t configure this policy setting, it is enabled by default. When the policy is enabled, the user is automatically signed in and the session is automatically locked with all lock screen apps configured for that user after the device boots.​&lt;br/&gt;&lt;br/&gt;After enabling this policy, you can configure its settings through the ConfigAutomaticRestartSignOn policy, which configures the mode of automatically signing in and locking the last interactive user after a restart or cold boot​.&lt;br/&gt;&lt;br/&gt;If you disable this policy setting, the device does not configure automatic sign in. The user’s lock screen apps are not restarted after the system restarts." gpmc_supported="At least Windows 10 Version 1903">Sign-in and lock last interactive user automatically after a restart</span></td><td>Disabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows PowerShell</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Turn on PowerShell Script Block Logging" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows PowerShell" gpmc_settingDescription="&lt;br/&gt;        This policy setting enables logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. If you enable this policy setting,&lt;br/&gt;        Windows PowerShell will log the processing of commands, script blocks, functions, and scripts - whether invoked interactively, or through automation.&lt;br/&gt;        &lt;br/&gt;        If you disable this policy setting, logging of PowerShell script input is disabled.&lt;br/&gt;        &lt;br/&gt;        If you enable the Script Block Invocation Logging, PowerShell additionally logs events when invocation of a command, script block, function, or script&lt;br/&gt;        starts or stops. Enabling Invocation Logging generates a high volume of event logs.&lt;br/&gt;        &lt;br/&gt;        Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.&lt;br/&gt;      " gpmc_supported="At least Microsoft Windows 7 or Windows Server 2008 family">Turn on PowerShell Script Block Logging</span></td><td>Enabled</td><td></td></tr>
<tr><td colspan="3"><table class="subtable_frame">
<tr><td>Log script block invocation start / stop events:</td><td>Disabled</td></tr>
</table></td></tr></table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Remote Management (WinRM)/WinRM Client</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow Basic authentication" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Remote Management (WinRM)/WinRM Client" gpmc_settingDescription="This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Basic authentication.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the WinRM client uses Basic authentication. If WinRM is configured to use HTTP transport, the user name and password are sent over the network as clear text.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the WinRM client does not use Basic authentication." gpmc_supported="At least Windows Vista">Allow Basic authentication</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow unencrypted traffic" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Remote Management (WinRM)/WinRM Client" gpmc_settingDescription="This policy setting allows you to manage whether the Windows Remote Management (WinRM) client sends and receives unencrypted messages over the network.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the WinRM client sends and receives unencrypted messages over the network.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the WinRM client sends or receives only encrypted messages over the network." gpmc_supported="At least Windows Vista">Allow unencrypted traffic</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Disallow Digest authentication" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Remote Management (WinRM)/WinRM Client" gpmc_settingDescription="This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Digest authentication.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the WinRM client does not use Digest authentication.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the WinRM client uses Digest authentication." gpmc_supported="At least Windows Vista">Disallow Digest authentication</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Windows Components/Windows Remote Management (WinRM)/WinRM Service</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i"><table class="info3">
<tr><th scope="col">Policy</th><th scope="col">Setting</th><th scope="col">Comment</th></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow Basic authentication" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Remote Management (WinRM)/WinRM Service" gpmc_settingDescription="This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Basic authentication from a remote client.&lt;br/&gt;&lt;br/&gt;        If you enable this policy setting, the WinRM service accepts Basic authentication from a remote client.&lt;br/&gt;&lt;br/&gt;        If you disable or do not configure this policy setting, the WinRM service does not accept Basic authentication from a remote client." gpmc_supported="At least Windows Vista">Allow Basic authentication</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Allow unencrypted traffic" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Remote Management (WinRM)/WinRM Service" gpmc_settingDescription="This policy setting allows you to manage whether the Windows Remote Management (WinRM) service sends and receives unencrypted messages over the network.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the WinRM client sends and receives unencrypted messages over the network.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the WinRM client sends or receives only encrypted messages over the network." gpmc_supported="At least Windows Vista">Allow unencrypted traffic</span></td><td>Disabled</td><td></td></tr>
<tr><td><span class="explainlink" tabindex="0" onkeypress="javascript:showExplainText(this); return false;" onclick="javascript:showExplainText(this); return false;" gpmc_settingName="Disallow WinRM from storing RunAs credentials" gpmc_settingPath="Computer Configuration/Administrative Templates/Windows Components/Windows Remote Management (WinRM)/WinRM Service" gpmc_settingDescription="This policy setting allows you to manage whether the Windows Remote Management (WinRM) service will not allow RunAs credentials to be stored for any plug-ins.&lt;br/&gt;&lt;br/&gt;If you enable this policy setting, the WinRM service will not allow the RunAsUser or RunAsPassword configuration values to be set for any plug-ins.  If a plug-in has already set the RunAsUser and RunAsPassword configuration values, the RunAsPassword configuration value will be erased from the credential store on this computer.&lt;br/&gt;&lt;br/&gt;If you disable or do not configure this policy setting, the WinRM service will allow the RunAsUser and RunAsPassword configuration values to be set for plug-ins and the RunAsPassword value will be stored securely.&lt;br/&gt;&lt;br/&gt;If you enable and then disable this policy setting,any values that were previously configured for RunAsPassword will need to be reset." gpmc_supported="At least Windows Vista">Disallow WinRM from storing RunAs credentials</span></td><td>Enabled</td><td></td></tr>
</table>
</div></div><div class="he3"><span class="sectionTitle" tabindex="0">Extra Registry Settings</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i">Display names for some settings cannot be found. You might be able to resolve this issue by updating the .ADM files used by Group Policy Management.<br /><br /><table class="info">
<tr><th scope="col">Setting</th><th scope="col">State</th></tr>
<tr><td>Software\Microsoft\Windows\CurrentVersion\Policies\LAPS\ADBackupDSRMPassword</td><td>1</td></tr>
<tr><td>Software\Microsoft\Windows\CurrentVersion\Policies\LAPS\ADPasswordEncryptionEnabled</td><td>1</td></tr>
<tr><td>Software\Microsoft\Windows\CurrentVersion\Policies\LAPS\BackupDirectory</td><td>2</td></tr>
<tr><td>Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableMPR</td><td>0</td></tr>
<tr><td>Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITHashAlgorithmConfigurationEnabled</td><td>1</td></tr>
<tr><td>Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA1</td><td>0</td></tr>
<tr><td>Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA256</td><td>3</td></tr>
<tr><td>Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA384</td><td>3</td></tr>
<tr><td>Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA512</td><td>3</td></tr>
<tr><td>Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitHashAlgorithmConfigurationEnabled</td><td>1</td></tr>
<tr><td>Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA1</td><td>0</td></tr>
<tr><td>Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA256</td><td>3</td></tr>
<tr><td>Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA384</td><td>3</td></tr>
<tr><td>Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA512</td><td>3</td></tr>
<tr><td>Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy</td><td>0</td></tr>
<tr><td>Software\Policies\Microsoft\Windows NT\Printers\CopyFilesPolicy</td><td>1</td></tr>
<tr><td>Software\Policies\Microsoft\Windows NT\Printers\RPC\ForceKerberosForRpc</td><td>0</td></tr>
<tr><td>Software\Policies\Microsoft\Windows NT\Printers\RPC\RpcAuthentication</td><td>0</td></tr>
<tr><td>Software\Policies\Microsoft\Windows NT\Printers\RPC\RpcProtocols</td><td>5</td></tr>
<tr><td>Software\Policies\Microsoft\Windows NT\Printers\RPC\RpcTcpPort</td><td>0</td></tr>
<tr><td>Software\Policies\Microsoft\Windows NT\Printers\RPC\RpcUseNamedPipeProtocol</td><td>0</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\Bowser\EnableMailslots</td><td>0</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\Explorer\DisableMotWOnInsecurePathCopy</td><td>0</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\LanmanServer\AuditClientDoesNotSupportEncryption</td><td>1</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\LanmanServer\AuditClientDoesNotSupportSigning</td><td>1</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\LanmanServer\AuditInsecureGuestLogon</td><td>1</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\LanmanServer\EnableAuthRateLimiter</td><td>1</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\LanmanServer\InvalidAuthenticationDelayTimeInMs</td><td>2000</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\LanmanServer\MaxSmb2Dialect</td><td>785</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\LanmanServer\MinSmb2Dialect</td><td>768</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditInsecureGuestLogon</td><td>1</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditServerDoesNotSupportEncryption</td><td>1</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditServerDoesNotSupportSigning</td><td>1</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\LanmanWorkstation\MaxSmb2Dialect</td><td>785</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\LanmanWorkstation\MinSmb2Dialect</td><td>768</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\LanmanWorkstation\RequireEncryption</td><td>0</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\NetworkProvider\EnableMailslots</td><td>0</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\Sudo\Enabled</td><td>0</td></tr>
<tr><td>Software\Policies\Microsoft\Windows\System\RunAsPPL</td><td>1</td></tr>
<tr><td>SYSTEM\CurrentControlSet\Control\Print\RpcAuthnLevelPrivacyEnabled</td><td>1</td></tr>
<tr><td>SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential</td><td>0</td></tr>
<tr><td>SYSTEM\CurrentControlSet\Control\Session Manager\kernel\DisableExceptionChainValidation</td><td>0</td></tr>
<tr><td>SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1</td><td>0</td></tr>
<tr><td>SYSTEM\CurrentControlSet\Services\MrxSmb10\Start</td><td>4</td></tr>
<tr><td>SYSTEM\CurrentControlSet\Services\Netbt\Parameters\NodeType</td><td>2</td></tr>
<tr><td>SYSTEM\CurrentControlSet\Services\Netbt\Parameters\NoNameReleaseOnDemand</td><td>1</td></tr>
<tr><td>SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableIPSourceRouting</td><td>2</td></tr>
<tr><td>SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableICMPRedirect</td><td>0</td></tr>
<tr><td>SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisableIPSourceRouting</td><td>2</td></tr>
</table>
</div></div></div></div></div>
<div class="filler"></div>
<div class="he0_expanded"><span class="sectionTitle" tabindex="0">User Configuration (Disabled)</span><a class="expando" href="#"></a></div>
<div class="container"><div class="he4i">No settings defined.</div></div>
</body></html>